IAT vs IAM Certifications: IAT Level I–III and the DoD 8140 Transition

By Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3   Published: 01/12/19   Updated: 10/08/26   8 min read
IT Certifications

Updated September 2026. This guide has been rewritten for DoD 8140. The old IAT and IAM levels came from DoD 8570, which has been replaced for DoD civilians and service members, and in 2026 the contractor rules changed too. Below we explain both systems, list the last official 8570 certification chart, and show how qualifications work now. For the certifications approved for each 8140 work role, see our DoD 8140 approved certifications guide.

If you’ve seen a job ad asking for “IAT Level II” or “IAM Level I,” you’re looking at DoD 8570 language. It’s still common in postings and resumes, but the Department of Defense (now also styled the Department of War) no longer uses those categories in its own policy.

What IAT and IAM mean

IAT and IAM were categories in the DoD Information Assurance Workforce Improvement Program, set out in DoD 8570.01-M (December 19, 2005, as amended).

Each category had three levels (I, II and III) that reflected the scope of a person’s responsibilities in the network. 8570 also had IASAE (IA System Architect and Engineer) levels and Cybersecurity Service Provider (CSSP) specialties.

To fill a position, a person had to hold one of the DoD-approved baseline certifications for that category and level.

IAT vs IAM at a glance

IATIAM
FocusTechnical, hands-on workSecurity management and oversight
LevelsI, II, IIII, II, III
Level I example certsA+ CE, Network+ CE, SSCPSecurity+ CE, CAP, GSLC
Level III example certsCISSP, CASP+ CE, CISACISSP, CISM, CCISO
Status in 2026Legacy 8570 categories, replaced by DCWF work roles under DoD 8140

The last official DoD 8570 baseline certification chart

The table below reproduces the “DoD Approved 8570 Baseline Certifications” chart for IAT and IAM as it appeared on the DoD Cyber Exchange (archived copy from January 2024). The live page now sits behind a DoD login.

LevelApproved baseline certifications (8570)
IAT Level IA+ CE, CCNA-Security, CND, Network+ CE, SSCP
IAT Level IICCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, SSCP
IAT Level IIICASP+ CE, CCNP Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP
IAM Level ICAP, CND, Cloud+, GSLC, Security+ CE, HCISPP
IAM Level IICAP, CASP+ CE, CISM, CISSP (or Associate), GSLC, CCISO, HCISPP
IAM Level IIICISM, CISSP (or Associate), GSLC, CCISO

Name changes to know: ISC2 renamed CAP to CGRC (Certified in Governance, Risk and Compliance) in February 2023. CompTIA renamed CASP+ to SecurityX in December 2024 (our SecurityX exam guide covers the current CAS-005 exam). Existing holders kept their status in both cases.

Several certifications in older versions of this chart, such as GIAC GSE and GISF, were removed years ago. If you see them on an old list, it’s out of date.

What replaced 8570: DoD 8140

DoD Manual 8140.03, “Cyberspace Workforce Qualification and Management Program,” took effect on February 15, 2023. It incorporates and cancels DoD 8570.01-M.

Instead of three broad IAT and IAM levels, 8140 uses the DoD Cyber Workforce Framework (DCWF). The DCWF describes specific work roles, each with its own tasks, knowledge, skills and abilities.

Work roles and proficiency levels

Every cyber position is coded with a primary work role and up to two additional work roles. Each role is filled at one of three proficiency levels:

The manual says proficiency levels don’t have to match a person’s rank or grade.

How you qualify under 8140

Qualification has three parts:

  1. Foundational qualification. You can meet it through education, DoD or military training, commercial training, or a personnel certification that’s approved for your work role and proficiency level. In some cases, documented experience is accepted instead.
  2. Residential qualification. You show you can do the job in your own environment, through on-the-job qualification and any requirements your organization adds.
  3. Annual maintenance. At least 20 hours of continuous professional development a year, or whatever your certification requires, whichever is greater.

Options approved at a higher proficiency level also count at lower levels within the same work role. DoD civilians and service members must meet foundational requirements within 9 months of assignment and residential requirements within 12 months.

How IAT and IAM map to 8140 work roles

Here’s the key point: there is no official crosswalk. DoD’s own 8570-to-8140 transition guide says there is “no direct comparison, or mapping, between 8570 IA functional categories and the DCWF work roles.”

So “IAT Level II” doesn’t automatically become a particular work role. Your qualification depends on the work role and proficiency level coded to your position.

Your certifications may still carry over. The same guide says certifications earned under 8570 can count under 8140 if they’re current and approved for your work role and level. “Good for life” certifications don’t count; every certification must be kept current.

Example: the Security Control Assessor (612) work role

DoD’s transition guide includes a sample qualification matrix for work role 612, Security Control Assessor. Its personnel certification options were:

Proficiency levelCertification options shown in DoD’s example (Aug 2024)
BasicNo certification option listed. Qualify through the education or DoD training options.
IntermediateCGRC/CAP, CASP+, Cloud+, PenTest+, Security+, GSEC
AdvancedCISM, CISSO, CPTE, CySA+, FITSP-A, GCSA, CISA, CISSP, CISSP-ISSEP, GSLC, GSNA

This shows how 8140 differs from 8570. Security+ was an IAT Level II certification under 8570, but here it appears at the Intermediate level for one work role. CySA+ was IAT Level II, but here it’s an Advanced option. The matrices are updated over time, so always check the current DoD 8140 qualification matrices on the DoD Cyber Exchange (DoD’s matrix guide explains how to read them) or ask your organization’s cyber workforce program manager for the version that applies to your position.

What 8140 means for contractors in 2026

For years, contractors stayed under 8570 because DFARS clause 252.239-7001 still referred to it. That has changed.

In practice, check your contract. It should name the work roles and proficiency levels you need to meet.

Which certification should you get?

Because 8140 depends on your work role, there’s no single answer. But a few certifications show up across many roles and were widely accepted under 8570:

For the order to take them by career goal, see our cybersecurity certification roadmap. For a broader view beyond DoD requirements, see our guide to the best cybersecurity certifications for 2026. If you’re new to the field, our guide on moving into a cybersecurity career can help you plan.

To keep up with workforce policy and security news, sign up for the CyberExperts Daily Brief.

Frequently asked questions

What is an IAT certification?

IAT stands for Information Assurance Technical. Under DoD 8570, an IAT certification was an industry certification approved for technical security positions at Level I, II or III. For example, Security+ CE was an approved IAT Level II certification.

What certifications meet IAT Level II?

On the last DoD 8570 chart, IAT Level II certifications were CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND and SSCP. Under DoD 8140, what you need depends on your DCWF work role and proficiency level.

What is the difference between IAT and IAM?

IAT covered hands-on technical security work, such as administering systems and networks. IAM covered managing security programs and systems. Both had three levels under DoD 8570.

Is DoD 8570 still valid?

Not for DoD civilians and service members. DoDM 8140.03 replaced DoD 8570.01-M on February 15, 2023. A DFARS class deviation effective February 1, 2026 also removed the 8570 contractor clause, and a May 2026 DoD CIO memo directs contracts to require DCWF work role qualifications.

Does IAT Level II equal a specific DoD 8140 work role?

No. DoD says there is no crosswalk between 8570 categories and DCWF work roles. Your certifications may still count if they’re current and approved for your position’s work role and proficiency level.

Does Security+ still count under DoD 8140?

Often, yes. Security+ appears as a certification option for many work roles, but the proficiency level varies by role. Check the qualification matrix for your work role.

Sources

Stay Current

Newer CyberExperts coverage on this topic

This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.

Latest Daily Brief

Tuesday’s brief: GitLab’s critical fix, then Patch Tuesday, hijacked fridge controllers and Server 2012’s last update

The fastest way to catch up on what changed after this article was published.

Read Today's Brief

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.