DoD IAT Levels I, II, III and IAM Certifications: 8570 Chart and 8140 Guide (2026)

Updated October 16, 2026. We rebuilt this guide around the question most readers bring: what the DoD IAT and IAM levels were, which certifications met each one, and where those certifications sit under DoD 8140 today. Every certification mapping comes from the final DoD 8570 baseline chart or the current DoD 8140 Qualification Matrix V2.1. For the full list of approved certifications by 8140 work role, see our DoD 8140 approved certifications guide.

Job ads still ask for “IAT Level II” or “IAM Level I.” Those labels come from DoD 8570.01-M, the Defense Department manual that ran the information assurance workforce program from 2005. That manual was cancelled in February 2023. The certifications it named are still in demand, though, and most of them count under the new rules.

Short answer: on the last DoD 8570 chart, the IAT Level II certifications were CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND and SSCP (DoD Cyber Exchange, archived). Today DoD 8140 qualifies people by work role and proficiency level (Basic, Intermediate or Advanced), and DoD says there is no direct crosswalk from IAT Level II to any one 8140 role or level.

What IAT, IAM, IASAE and CSSP mean

DoD 8570.01-M, “Information Assurance Workforce Improvement Program” (December 19, 2005, last changed November 10, 2015), sorted IA jobs into categories and levels (DoD 8570.01-M, archived). DoD’s transition guide describes the three levels as showing the “scope of responsibilities in an enclave’s hierarchy” (DoD CIO transition guide).

• IAT (Information Assurance Technical): hands-on work on computers, networks and enclaves. Levels I, II and III.
• IAM (Information Assurance Management): people who ran IA programs for a system, network or enclave. Levels I, II and III.
• IASAE (IA System Architect and Engineer): people who designed and built secure systems. Levels I, II and III.
• CSSP (Cybersecurity Service Provider): specialties for Analyst, Infrastructure Support, Incident Responder, Auditor and Service Provider Manager. The manual called this category CND-SP (Computer Network Defense Service Provider).

The manual ties each level to a system environment. Level I works in the computing environment (CE), Level II in the network environment (NE), and Level III across the enclave.

DoD IAT levels I, II and III

This table pulls the position requirements from DoD 8570.01-M, Chapter 3, and the approved certifications from the final DoD Cyber Exchange chart (8570.01-M; 8570 baseline chart).

IAT Level I

IAT Level I staff made the computing environment “less vulnerable by correcting flaws and implementing IAT controls” in the hardware and software they worked on, according to the manual. Think help desk, desktop support and junior system administration. The usual entry certifications were CompTIA A+ and CompTIA Network+. The chart’s own example: A+ and Network+ qualified only for Level I and could not be used for a Level II position.

IAT Level II

IAT Level II is the level most job ads still name. The manual describes it as network-level support with “special attention to intrusion detection, finding and fixing unprotected vulnerabilities, and ensuring that remote access points are well secured.” Most people met it with CompTIA Security+. CySA+, GIAC GSEC, SSCP, EC-Council CND and GIAC GICSP were on the same list.

SSCP is the one certification the manual itself uses to show how levels stacked: it was listed at both Level I and Level II, so someone moving from a Level I to a Level II job did not need a new certification.

IAT Level III

IAT Level III covered the enclave. The manual says these staff “support, monitor, test, and troubleshoot hardware and software IA problems” across the CE, NE and enclave, and may lead the work of others. The list mixed senior technical and broad security certifications: CASP+ CE (now CompTIA SecurityX), Cisco CCNP Security, ISACA CISA, ISC2 CISSP, GIAC GCED and GCIH, and ISC2 CCSP.

DoD IAM levels I, II and III

IAM positions were management roles. Chapter 4 of the manual sets the requirements below (8570.01-M).

For IAM Level II and III, the familiar picks were ISACA CISM and CISSP. Our CISSP vs CISM comparison covers how those two differ. CAP is now called CGRC: ISC2 renamed it in February 2023 and existing holders kept their credential (ISC2). CompTIA renamed CASP+ to SecurityX in December 2024 and said the change did not affect current holders (CompTIA).

IASAE and CSSP certifications

The same chart listed two smaller categories (8570 baseline chart).

The manual recommended experience for the CSSP specialties as well: at least 2 years for Analyst and Auditor, at least 4 years for Infrastructure Support and Manager, and at least 5 years for Incident Responder (8570.01-M, Appendix 3). CompTIA PenTest+ and EC-Council CEH both appear in the Analyst, Incident Responder and Auditor rows.

How the old 8570 rules worked

• One certification was enough. You needed one approved certification for your category and level.
• Higher levels rolled down for IAT and IAM. A certification listed at Level II or III also met Level I, but a Level I certification did not meet Level II or III unless it was listed there too.
• Six months to certify. The manual gave people 6 months from assignment to earn the baseline certification. For IAT Level I, it was also required before unsupervised privileged access.
• Extra certificates for technical staff. IAT staff and most CSSP specialties also needed a computing environment or operating system (CE/OS) certificate for the systems they supported. DoD says CE/OS certificates are not required under 8140 policy, though components may still require them for some jobs (DoD CIO transition guide).
• “CE” in a cert name meant continuing education. The chart listed A+ CE, Network+ CE, Security+ CE and CASP+ CE, the CompTIA versions kept current through continuing education.

One special case: Cisco retired CCNA-Security on February 24, 2020. A 2022 DoD CIO waiver let people who held it before that date use the revised CCNA for IAT I, IAT II, CSSP Analyst and CSSP Incident Responder positions (DoD CIO CCNA waiver). DoD’s 2024 transition guide says that waiver was valid through February 15, 2025 for cybersecurity work roles (DoD CIO transition guide).

Is DoD 8570 still in effect?

No. DoD Manual 8140.03, “Cyberspace Workforce Qualification and Management Program,” took effect on February 15, 2023, and it “incorporates and cancels” DoD 8570.01-M (DoDM 8140.03, esd.whs.mil). The DoD CIO’s cyber workforce page says the same (DoD CIO). Contractors were the last group still tied to 8570, and that link was cut in 2026.

The May 2026 memo says detailed implementation guidance for contractors is still being developed (DoW CIO memo). Under DoDM 8140.03, contractors must meet foundational qualification when they start cyber work, and they meet residential qualification only if the contract requires it (DoDM 8140.03).

How IAT and IAM levels translate to DoD 8140

DoD’s transition guide is direct about this: “There is no direct comparison, or mapping, between 8570 IA functional categories and the DCWF work roles” (DoD CIO transition guide). In other words, IAT Level II does not become Intermediate, and IAM Level III does not become Advanced.

What carried over were the certifications. The DoD 8140 FAQ says all DoD 8570 certifications carried over to the 8140 program “and they were aligned to the appropriate DCWF Work Role and DoD 8140 proficiency level” (DoD 8140 FAQ). A certification you earned for an 8570 job counts under 8140 only if it is current and approved for the work role and proficiency level coded to your position. “Good for life” certifications are not valid (DoD CIO transition guide).

Under 8140, each position is coded with a primary work role from the DoD Cyber Workforce Framework (DCWF) and up to two more, and each role has a proficiency level. DoDM 8140.03 defines the three levels this way (DoDM 8140.03, section 3.3):

• Basic: familiarity with basic concepts and processes, applied with frequent, specific guidance, in routine, structured situations.
• Intermediate: extensive knowledge of basic concepts and processes, applied with only periodic high-level guidance, in non-routine and sometimes complicated situations.
• Advanced: in-depth understanding of advanced concepts, little to no guidance, able to guide others and work in complex, unstructured situations.

The manual adds that proficiency level has no required connection to a person’s rank or grade. Qualification also takes more than a certification. You meet a foundational option (education, training, an approved certification, or in some cases documented experience), complete residential qualification on the job, and log at least 20 hours of continuous professional development a year.

Where IAT and IAM certifications land under DoD 8140

The table below takes each certification from the IAT and IAM rows of the final 8570 chart and shows how DoD 8140 Qualification Matrix V2.1 lists it. Counts cover the IT, cybersecurity and cyber enabler work roles owned by the DoD CIO, the elements V2.1 covers (DoD 8140 Document Library). Because higher-level options also count at lower levels in the same role, a certification listed at Intermediate also meets Basic for that role (DoDM 8140.03).

Two patterns stand out for anyone who held an IAT Level II certification. First, the old Level II certs now sit at different levels. Security+ is an Intermediate option for 19 work roles, while CySA+ is Advanced for 7 of its 8 roles, and CND is a Basic option for 8 of its 9 roles. Second, some certs dropped out: HCISPP and CCNA-Security do not appear in V2.1, and neither does Cisco SCYBER from the CSSP rows.

The management side moved up as a group. CISSP, CISM and GIAC GSLC are Advanced options for every role where V2.1 lists them. That is one more reason to look up your own work role rather than assume your old level carries a matching 8140 level. Our DoD 8140 certifications guide lists every approved certification for the most common work roles.

A job ad says “IAT Level II.” What should you get?

Read the ad, then ask the hiring manager or contracting officer which DCWF work role and proficiency level the position is coded to. Postings often keep the 8570 wording, but the May 2026 DoW CIO memo tells DoD components to update contracts to DCWF work role requirements. Some practical rules:

• If you have nothing yet: Security+ met IAT Level II and IAM Level I under 8570, and it is an Intermediate option for 19 work roles in V2.1, from 451 System Administrator to 612 Security Control Assessor. For most readers it is the safest first DoD certification. Our Security+ vs CySA+ comparison helps if you are deciding between the two.
• If you work in a SOC or on incident response: CySA+ was IAT Level II and is an Advanced option for 511 Cyber Defense Analyst and 531 Cyber Defense Incident Responder in V2.1.
• If the ad says IAT Level III or IAM Level II/III: CISSP and CISM cover both old categories, and V2.1 lists them at Advanced for management and assessment roles such as 612 and 722 Information Systems Security Manager.
• If you are a contractor: check the contract or task order. Under DoDM 8140.03 you must meet the foundational requirement for your work role when you start cyber work.
• If you already hold an 8570 cert: keep it current and look up your work role in the DoD 8140 Document Library matrix. If it is listed at your level or higher, it still counts.

Practice before you book an exam. The CyberExperts Lab offers free certification practice for 12 cybersecurity exams, with no card needed. Tracks that match certifications in this guide: Security+, Network+, SSCP, SecurityX (CASP+), CISSP, CISM, CISA, CCSP, CEH and CISSP-ISSEP. If you are newer to the field, the ISC2 CC track covers a Basic option for five cybersecurity work roles in V2.1. Always free.

Planning your next certification? See the full certification roadmap for the order to take them by career goal.

DoD workforce rules change a few times a year. The CyberExperts Daily Brief tracks policy and security news like this in five minutes, weekday mornings. Get tomorrow’s brief.

Frequently asked questions

Sources

• DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program (Feb 15, 2023): esd.whs.mil (PDF)
• DoD 8570.01-M, Information Assurance Workforce Improvement Program, Change 4 (Nov 10, 2015), archived copy: web.archive.org (PDF)
• DoD Cyber Exchange, DoD Approved 8570 Baseline Certifications (archived Jan 30, 2024): web.archive.org
• DoD CIO, DoD 8570 IA Program Transition to DoD 8140 CWQP (Aug 7, 2024): dl.dod.cyber.mil (PDF)
• DoD CIO, DoD 8140 Document Library (Qualification Matrix V2.1, effective Sep 19, 2025): cyberworkforce.mil
• DoD CIO, DoD 8140 FAQ: cyberworkforce.mil
• DoD CIO, Cyber Workforce Development: dodcio.defense.gov
• DoD CIO, Waiver to Temporarily Accept the CCNA Certification (Apr 2022): cyberworkforce.mil (PDF)
• DoW CIO memo, Implementation of DoW Cyberspace Workforce Policy Requirements for Contractors (May 27, 2026): cyberworkforce.mil (PDF)
• Class Deviation 2026-O0024, FAR Overhaul Part 39 / DFARS Part 239 (effective Feb 1, 2026): acquisition.gov (PDF)
• DoD Cyber Exchange, DoD 8140 page (migration and sunset notice): cyber.mil
• ISC2, CAP renamed CGRC (Feb 2023): isc2.org
• CompTIA, Introducing SecurityX (Dec 18, 2024): comptia.org

CyberExperts Editorial Team

CyberExperts guides are researched from official certification body sources and fact-checked by the CyberExperts editorial team.