CSSP Analyst
CSSP — Cybersecurity Service Provider
CSSP Analyst is a specialty of the DoD 8570 baseline for cybersecurity service provider teams — the people who monitor sensors and analyze security events to detect intrusions. CSSP cells are specialties rather than stacked levels: each role has its own certification list, and holding one does not satisfy another.
IAT, IAM, IASAE and CSSP are the DoD baseline certification levels. A great deal of the contractor workforce is still held to them, so if you were told to “get IAT Level II,” this is what that means — and any one certification in the level satisfies it.
8140 is the newer framework, organized around work roles rather than these levels. There is no official crosswalk between the two — DoD CIO states plainly that the 8570 IA categories do not map to DCWF work roles — so treat “which level” and “which work role” as separate questions. How the two frameworks relate.
Certifications that satisfy CSSP Analyst
Any one of these satisfies the level. Reproduced exactly as DoD published them, which is why a few names look dated — 3 have since been renamed, retired or withdrawn. Where a name has changed, the change is noted beside it rather than swapped in.
- CEHCourse available
- CFRCourse available
Now CertNexus CFR-410. The table lists CFR twice, under both CertNexus and Logical Operations — CertNexus was spun out of Logical Operations, and the second row is stale.
- CCNA Cyber OpsRetiredCourse available
Cisco retired exams 210-250 and 210-255 on 2020-05-28, consolidating them into 200-201. That exam number is now branded CCNA Cybersecurity.
- CCNA-SecurityRetiredCourse available
Cisco retired exam 210-260 on 2020-02-23. The table’s own footnote acknowledges this and points to a DoD CIO waiver for holders who were in a position requiring it. The rebranded CCNA (200-301) is the successor, but it is the waiver — not the rename — that DoD addressed.
- CySA+Course available
- GCIACourse available
- GCIHCourse available
- GICSPCourse available
- Cloud+Course available
- SCYBERRetired
Cisco retired exam 600-199 on 2018-07-27 with no replacement — and DoD carried it on this table for six more years, until the page came down.
- PenTest+Course available
Which is easiest to obtain
Any one of these satisfies CSSP Analyst, so the real question is which costs you the least to get and keep. Ranked by barriers we can source — whether the credential requires work experience to be awarded, then exam length — not by how hard the exam is, which no vendor publishes. Covers the 8 we document in detail.
| Certification | To hold it | Exam | Renewal |
|---|---|---|---|
| Cloud+CompTIA | Pass the exam | 90 min | 3y · $150 |
| CFRCertNexus (Logical Operations) | Pass the exam | 120 min | 3y · $90 |
| CySA+CompTIA | Pass the exam | 165 min | 3y · no fee |
| PenTest+CompTIA | Pass the exam | 165 min | 3y · $150 |
| GICSPGIAC | Pass the exam | 3 hr | 4y · $499 |
| CEHEC-Council | Pass the exam | 4 hr | 3y · $80 |
| GCIAGIAC | Pass the exam | 4 hr | 4y · $499 |
| GCIHGIAC | Pass the exam | 4 hr | 4y · $499 |
Top row is the lightest lift — the fastest, cheapest route to satisfying CSSP Analyst. “Pass the exam” means the credential is yours the day you pass; an experience line means you can sit the exam but the credential isn’t awarded until you meet it (CISSP and CCSP grant “Associate” status meanwhile).
Not ranked, because you cannot earn them any more: CCNA Cyber Ops, CCNA-Security, SCYBER. If you already hold one, it may still count on a contract that names this level.
Unlike IAT and IAM, CSSP levels do not cascade. A higher CSSP certification does not satisfy a lower CSSP requirement.
Where this came from
Reproduced verbatim from “DoD Approved 8570 Baseline Certifications,” published by the DoD Cyber Exchange as an extension of Appendix 3 to DoD 8570.01-M. DoD moved this section behind CAC login in late 2024, so it is no longer on the public web — this is the last public capture, dated 2024-10-02, and the original can’t be linked. Content had been unchanged since 2022-11-24.
Spelling and punctuation are the source’s, including its own errors — we flag them rather than silently correct them.
View the archived page