Baseline certification levels: IAT, IAM, IASAE, CSSP
Told to get “IAT Level II” rather than a work role? These are the DoD baseline levels. Pick yours to see which certifications satisfy it, and which is the lightest lift to obtain.
IAT, IAM, IASAE and CSSP are the DoD baseline certification levels. A great deal of the contractor workforce is still held to them, so if you were told to “get IAT Level II,” this is what that means — and any one certification in the level satisfies it.
8140 is the newer framework, organized around work roles rather than these levels. There is no official crosswalk between the two — DoD CIO states plainly that the 8570 IA categories do not map to DCWF work roles — so treat “which level” and “which work role” as separate questions. How the two frameworks relate.
Where most people start
A few certifications satisfy several baseline levels at once, which makes them the most common starting points:
- CySA+ (CS0-004) course: satisfies 5 baseline levels
- CISSP course: satisfies 5 baseline levels
- CND (312-38) course: satisfies 4 baseline levels
- SecurityX (CAS-005) course: satisfies 4 baseline levels
IAT — Information Assurance Technical
IAM — Information Assurance Management
IASAE — Information Assurance System Architect and Engineer
CSSP — Cybersecurity Service Provider
Where this came from
Reproduced verbatim from “DoD Approved 8570 Baseline Certifications,” published by the DoD Cyber Exchange as an extension of Appendix 3 to DoD 8570.01-M. DoD moved this section behind CAC login in late 2024, so it is no longer on the public web — this is the last public capture, dated 2024-10-02, and the original can’t be linked. Content had been unchanged since 2022-11-24.
Spelling and punctuation are the source’s, including its own errors — we flag them rather than silently correct them.
View the archived page