CSSP explained: the five roles and which certification each needs

CSSP - Cybersecurity Service Provider - is the DoD 8570 baseline's column for the people who run defensive cyber operations as a service: watching sensors, maintaining the defensive infrastructure, investigating intrusions, auditing the operation, and running the team. If your contract or position description says "CSSP" plus a role word, it's pointing at one of five specific cells, and the requirement is one certification from that cell's list.

The rule that surprises people

IAT and IAM levels cascade - a higher level satisfies a lower one. CSSP cells don't. Each specialty stands alone: a CSSP Manager certification does not satisfy a CSSP Analyst requirement, and vice versa. If your role changes from Analyst to Incident Responder, you check the new cell's list against what you hold - and this is exactly why the cross-cell certifications below matter.

The five cells, and what each role does

Analyst - reads the sensor data and security events to find intrusions. The largest list: CEH, CFR, CySA+, GCIA, GCIH, GICSP, Cloud+, PenTest+, plus three entries you can no longer earn (both retired CCNA variants and Cisco's SCYBER, retired in 2018 and carried on the table for six more years).

Infrastructure Support - installs, tests and maintains the defensive plumbing itself: the IDS sensors, firewalls, and monitoring systems everyone else works from. CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, CND.

Incident Responder - investigates and responds when the Analyst finds something. CEH, CFR, CHFI, CySA+, GCFA, GCIH, PenTest+, plus the same retired Cisco entries.

Auditor - assesses whether the cybersecurity service actually does what it claims. CEH, CySA+, CISA, GSNA, CFR, and PenTest - printed exactly that way on DoD's table, missing its "+"; the typo is theirs and we preserve it because the table is a historical artifact, not our editorial work.

Manager - leads the CSSP team or program. Three certifications only: CISM, CISSP-ISSMP, CCISO. Notice the pattern break: the Manager cell shares nothing with the other four. Management is its own track here, the way IAM is separate from IAT.

The efficient picks

Lay the four technical cells side by side and two names repeat: CySA+ and CEH each appear in all four (Analyst, Infrastructure Support, Incident Responder, Auditor), and CFR appears in all four as well. That's the practical takeaway the raw table never states:

If your future is on CSSP contracts, one CySA+ is the highest-leverage certification on the entire 8570 table. It covers four CSSP specialties plus IAT Level II - five separate requirements, one exam. CEH offers similar CSSP coverage but does not satisfy any IAT level, and EC-Council's renewal model (annual membership fees plus continuing-education credits) makes it the more expensive credential to hold over time. We have courses for both: CySA+ and CEH.

For the Manager cell, the realistic path for most people is CISM - our CISM course - since CISSP-ISSMP requires the CISSP first and CCISO is aimed at sitting executives.

Check what you already hold

Before studying for anything, read your target cell's list against your current certifications - including the specialist ones. GCIA, GCIH, GCFA, CHFI and GICSP all appear in specific cells, and if you already hold one from forensics or SOC work, you may already satisfy the requirement. Each cell page linked above shows every entry with its current status - several names on DoD's table are retired or renamed, and the page says so beside each one rather than pretending the 2024 snapshot is current.

Know what your contract says but not what to do about it? Answer two questions and we’ll name the certification, the hours, and open the first lesson.

Provenance: the CSSP cells reproduce DoD's approved 8570 baseline certification table exactly as last published - the manual behind it was cancelled in 2023, but legacy contracts still cite these specialties, which is why position descriptions still say "CSSP." The preserved table and its sourcing are here.