IAM Level I: which certification should you actually get?
By 8140.study · Published 2026-10-20 · Last updated 2026-10-20
You are reading this because a job posting, a contract, or a security officer said “IAM Level I.” That phrase comes from the DoD 8570 baseline table, where six certifications share the IAM Level I cell. IAM is the management track: it is about being responsible for the security of a system, not administering it by hand, and Level I is the entry tier. You need only one certification from the cell. Every exam figure below was read off the vendor’s own page on October 20, 2026 and links back to it.
The six, as their vendors describe them today
Read the format column before comparing across rows. A CompTIA scaled score, an ISC2 scaled score, an EC-Council percentage range, and a GIAC percentage are four different scoring systems, and only seat time compares cleanly.
| Certification | Exam | Format | Experience |
|---|---|---|---|
| ISC2 CGRC (formerly CAP) | CGRC | 125 items, 3 hours, 700 of 1000 to pass | 2 years full time in 1 or more of the 7 CGRC domains |
| EC-Council CND | 312-38 | 100 multiple choice questions, 4 hours; EC-Council states 60 to 85 percent to pass | 2 years in information security, or official EC-Council training |
| CompTIA Cloud+ | CV0-004 | Max 90 questions, 90 minutes, 750 on a scale of 100 to 900 to pass | None required. CompTIA recommends 2 to 3 years as a systems administrator or cloud engineer |
| GIAC GSLC | GSLC | 115 questions, 3 hours, 70 percent to pass | None stated on the certification page |
| CompTIA Security+ | SY0-701 | Max 90 questions, 90 minutes, 750 on a scale of 100 to 900 to pass | None required. CompTIA recommends Network+ and 2 years as a security or systems administrator |
| ISC2 HCISPP | No longer offered | Retired. The final exam date was December 1, 2023 | Not applicable |
Two names in the cell need translating. The table prints CAP, and ISC2 renamed CAP to CGRC in February 2023, saying that the exam outline and exam domains are not impacted by this name change. It is the same certification under a new name. The table also prints HCISPP, which is a dead end: ISC2 held the final HCISPP exam on December 1, 2023 and designates the credential inactive on December 1, 2026. If you hold it, plan your replacement now; if you do not, you cannot get it.
Cloud+ is the odd one out. It is an operations exam, not a management one: CompTIA weights it cloud architecture 23 percent, deployment 19 percent, operations 17 percent, security 19 percent, devops fundamentals 10 percent, troubleshooting 12 percent. It earns its place for someone whose management responsibility is a cloud environment they also run. The 8570 table also lists it for two CSSP specialties, Analyst and Infrastructure Support.
Two of the six have experience gates
Security+ and Cloud+ have recommendations, not requirements, and GIAC states no prerequisite for GSLC. CGRC and CND are different: you can study for them today, but the vendor wants proof of work before it will certify you or, for CND, before it will let you sit the exam.
| Certification | What the vendor requires | If you do not have it yet |
|---|---|---|
| CGRC | 2 years of cumulative, full time work in 1 or more of the 7 CGRC domains. Part-time work and internships can count. | Pass the exam and become an Associate of ISC2, with 3 years to earn the 2. |
| CND | 2 years of information security work, proven through an eligibility application with a $100 non-refundable fee. | Attend official EC-Council training, which makes you eligible to sit the exam. |
CGRC’s bar is lower than it looks for anyone already working on a federal system. ISC2 counts information systems security work performed in pursuit of information system authorization, which is much of what an ISSO does in a week. If you are short of the two years, passing the exam makes you an Associate of ISC2 with three years to earn them. One caution: the 8570 table writes its CISSP entry as “CISSP (or Associate)” but prints CAP with no such wording. If you plan to rely on Associate status for Level I, confirm with your security officer that it will be accepted.
Will the job become Level II?
The table’s own rule is that higher level IAM certifications satisfy lower level requirements, while Level I certifications do not satisfy Level II unless they are listed there too. That splits the cell in two:
| Certification | Also sits in |
|---|---|
| ISC2 CGRC (formerly CAP) | IAM Level II |
| EC-Council CND | IAT Level I and II, CSSP Infrastructure Support |
| CompTIA Cloud+ | CSSP Analyst, CSSP Infrastructure Support |
| GIAC GSLC | IAM Level II and III |
| CompTIA Security+ | IAT Level II (and so IAT Level I) |
Security+ is the strongest pick for a position that will stay at Level I, and the weakest for one that will not. If a recode to IAM Level II is likely, CGRC or GSLC saves you a second exam later, and GSLC goes all the way to Level III. Our guide to IAM Level II certifications covers that cell in full, including the five year experience rules for CISM and CISSP.
Security+ is also about to change. CompTIA lists SY0-801 launching November 17, 2026, and the current SY0-701 retires in English on June 11, 2027.
What each one costs to keep
The exam is paid once. The renewal repeats for as long as you hold the certification, and across this cell it ranges from $150 every three years to $499 every four.
| Certification | Upkeep | Cycle |
|---|---|---|
| ISC2 CGRC (formerly CAP) | 60 CPEs over 3 years, plus $135 a year | 3 years |
| EC-Council CND | 120 ECE credits over 3 years, plus $80 a year | 3 years |
| CompTIA Cloud+ | 50 CEUs over 3 years, plus a $150 fee | 3 years |
| GIAC GSLC | 36 CPEs over 4 years, plus $499 | 4 years |
| CompTIA Security+ | 50 CEUs over 3 years, plus a $150 fee | 3 years |
Three things fall out of that table. CompTIA’s $150 fee is per three year cycle, not per year, which makes Security+ and Cloud+ the cheapest to keep. ISC2 charges a single $135 annual maintenance fee no matter how many of its certifications you hold, so a CGRC holder who adds CISSP later pays nothing extra. And GSLC costs the most to keep, at $499 per renewal every four years, which makes it an easier choice when an employer is paying.
One CompTIA detail catches people out. Earning a higher CompTIA certification can renew a lower one with the fee waived, but CompTIA’s own table says Security+ fully renews Network+ and A+. Cloud+ is not on that list, and CompTIA says the current Cloud+ does not fully renew any other CompTIA certification. Hold both and you renew each one separately.
Which one to actually pick
Your position stays at Level I, or mixes management with technical work. Security+. One exam, no experience requirement, the lowest upkeep in the cell (tied with Cloud+), and it satisfies IAT Level II as well. Our Security+ exam format guide explains the performance based questions and the 750 passing score.
You work in authorization and have two years. CGRC. It is written around the authorization work you already do, and it covers IAM Level II, so a recode does not send you back to study. If that is you, our CGRC course is the place to start.
You want to cover every IAM level with one exam. GSLC. It sits in Levels I, II, and III, and GIAC states no experience requirement. The trade is the upkeep, so it works best when an employer is paying. Our GSLC course follows the exam.
You run the cloud environment you are responsible for. Cloud+. CompTIA recommends 2 to 3 years as a systems administrator or cloud engineer first, and it does not lead up the IAM ladder, so pick it for the skills rather than the level.
Your employer is sending you to EC-Council training. CND, which the training makes you eligible for. It also covers IAT Level I and II, which is useful in a billet that carries both tracks.
FAQ
What certifications meet IAM Level I?
The DoD 8570 baseline table lists six in the IAM Level I cell: CAP (now ISC2 CGRC), CND, Cloud+, GSLC, Security+, and HCISPP. HCISPP is retired. Any IAM Level II or Level III certification, such as CISM or CISSP, also satisfies Level I.
Is Security+ enough for IAM Level I?
Yes. Security+ sits in the IAM Level I cell and in the IAT Level II cell. It does not satisfy IAM Level II, so a position recoded to Level II would need a different certification.
What is the easiest IAM Level I certification to get?
By experience required, Security+ and Cloud+ carry only recommendations and GIAC states no prerequisite for GSLC. CGRC requires two years in its domains, and CND requires two years of information security work unless you attend official EC-Council training.
Does CAP still count for IAM Level I?
CAP is now called CGRC. ISC2 renamed it in February 2023 and said the exam outline and domains were not affected, so it is the same certification under a new name. The 8570 table still prints the old name because it predates the change.
Which IAM Level I certification also covers IAM Level II?
CGRC and GSLC both sit in the IAM Level II cell, and GSLC also sits in Level III. HCISPP was in both cells but is retired. Security+, Cloud+, and CND stop at IAM Level I.
How much does it cost to keep an IAM Level I certification?
Security+ and Cloud+ each need 50 CEUs and a $150 fee every three years. CGRC needs 60 CPEs over three years and $135 a year. CND needs 120 ECE credits over three years and $80 a year. GSLC needs 36 CPEs and $499 every four years.
Covering IAM Level I with one exam? Our Security+ course follows the SY0-701 objectives, and the first module, General security concepts, is free with a free account. Start there and see whether it fits before you book anything.
A note on currency: the 8570 baseline table this requirement comes from was published by DoD and then frozen. The manual behind it was cancelled in 2023, but legacy contract language keeps its terms in use, which is why postings still say “IAM Level I.” The preserved cell, with provenance, is here.