IAT Level III: which certification should you actually get?
By 8140.study · Published 2026-09-18 · Last updated 2026-09-18
You are reading this because a contract, a security officer, or an offer letter said “IAT Level III.” That phrase comes from the DoD 8570 baseline table, where seven certifications share the Level III cell. Nobody needs two of them, and a Level III certification also satisfies Level II and Level I, so this is the last technical tier you have to solve. Every exam figure below was read off the vendor’s own page on September 18, 2026 and links back to it.
The seven, as their vendors describe them today
Read the format column before comparing anything across rows. A GIAC percentage, an ISC2 scaled score, and a CompTIA pass/fail are three different scoring systems, and the only figure that compares cleanly is seat time.
| Certification | Exam | Format | Experience required |
|---|---|---|---|
| CompTIA SecurityX | CAS-005 | Max 90 questions, max 165 minutes, pass/fail with no scaled score | None required. CompTIA recommends 10 years in IT including 5 in security |
| ISC2 CISSP | CISSP | 100 to 150 items, 3 hours, adaptive, 700 of 1000 to pass | 5 years in 2 or more of the 8 domains, or pass and hold Associate of ISC2 |
| ISC2 CCSP | CCSP | 100 to 150 items, 3 hours, 700 of 1000 to pass | 5 years in IT, 3 of them in security, 1 in a CCSP domain |
| ISACA CISA | CISA | 150 questions, 4 hours, scored 200 to 800, 450 to pass | 5 years of IS audit, control or security work, gained in the last 10 |
| GIAC GCED | GCED | 115 questions, 3 hours, 69 percent to pass | None stated on the certification page |
| GIAC GCIH | GCIH | 106 questions, 4 hours, 69 percent to pass | None stated on the certification page |
| Cisco CCNP Security | 350-701 SCOR plus one concentration exam | Two exams: 120 minutes for the core, 90 for the concentration | No prerequisite for the core exam |
Two notes the table cannot hold. The 8570 cell still prints CASP+ CE, the name CompTIA retired when it renamed the credential CompTIA SecurityX in December 2024; it is the same certification, and CompTIA lists the current exam as CAS-005. And Cisco CCNP Security is two exams, the 350-701 SCOR core plus one concentration exam of your choice, which makes it the longest road on this list for anyone who is not already a Cisco engineer.
The experience gate decides it for most people
CISSP, CCSP, and CISA are not harder versions of the same checkbox. They are credentials you can pass and still not hold, because each vendor requires years of work before it will certify you. If your contract needs the box ticked this quarter and you do not have the years, that narrows the list to four.
| Certification | Years required | What reduces it | If you do not have them yet |
|---|---|---|---|
| CISSP | 5 years, 2 or more domains | A degree or an approved credential waives up to 1 year. Only 1 year can be waived. | Pass the exam and become an Associate of ISC2, with 6 years to earn the 5 years of experience. |
| CCSP | 5 years in IT, 3 in security, 1 in a CCSP domain | A degree waives up to 1 year, CCSK waives 1 year, and an active CISSP replaces the requirement entirely. | Pass the exam and become an Associate of ISC2, again with 6 years. |
| CISA | 5 years of IS audit, control, assurance or security work | Experience has to have been gained in the 10 years before you apply, and you have 5 years from passing to apply. | You can sit the exam first, but ISACA does not certify you until the years are in. |
The Associate route is the one people miss. ISC2 says a candidate without the experience may pass the CISSP exam and become an Associate of ISC2, then has six years to earn the five years required. The 8570 table anticipated exactly that: its Level III entry is written “CISSP (or Associate),” so the Associate satisfies the cell while you finish accruing. If that is your plan, read our CISSP study guide for technical people first, because the exam punishes engineers who answer as engineers.
One quiet shortcut in the other direction: an active CISSP replaces the CCSP experience requirement entirely. If you already hold the CISSP, you already satisfy IAT Level III, so treat CCSP as a cloud credential you might want rather than a box you need.
What each one costs to keep
The exam is the small number. The renewal is the one that repeats for as long as you hold the certification, and across this cell it differs by more than a factor of three.
| Certification | Upkeep | Cycle |
|---|---|---|
| CompTIA SecurityX | 75 CEUs over 3 years, plus a $150 fee | 3 years |
| ISC2 CISSP | 120 CPEs over 3 years, plus $135 a year | 3 years |
| ISC2 CCSP | 90 CPEs over 3 years, plus $135 a year | 3 years |
| ISACA CISA | 120 CPEs over 3 years and 20 a year, plus $45 or $85 a year | 3 years |
| GIAC GCED | 36 CPEs over 4 years, plus $499 | 4 years |
| GIAC GCIH | 36 CPEs over 4 years, plus $499 | 4 years |
| Cisco CCNP Security | 80 CE credits over 3 years | 3 years |
Three things fall out of that table. GIAC is the expensive tail: a $499 maintenance fee every four years, which is why GCIH and GCED usually make sense when an employer is paying rather than when you are. ISC2 charges one annual maintenance fee of $135 no matter how many ISC2 certifications you hold, so a CISSP holder adding CCSP pays nothing more per year. And ISACA wants CPEs reported every year, 20 minimum, not banked and dumped in year three.
CompTIA is the cheapest to hold, and its CEU rules are the same machinery Security+ holders already know. If you are renewing one of those alongside this, our guide to Security+ renewal, CEUs and fees covers how the cycle works, including the rule that renewing your highest level CompTIA certification renews the lower ones automatically.
Which one to actually pick
You need it soon and cannot prove five years. SecurityX. It is the only certification in the cell with no experience requirement and no four-figure renewal, and CompTIA scores it pass/fail with no scaled score, so there is no cut line to agonize over. The alternative is passing the CISSP and sitting as an Associate, which is more study for a credential that carries further.
You have the years and you want the certification to still matter in five. CISSP. It is the one on this list that hiring managers outside the contract recognize on sight, it satisfies Level III, and it also covers the management cells. The sitting itself is short: ISC2 publishes it as 100 to 150 items, 3 hours, adaptive, 700 of 1000 to pass. The preparation is not.
Your job is audit or assessment. CISA. ISACA puts 36 percent of the exam on the audit process and IT governance, and it is the credential audit shops ask for by name. Our CISA course is built on that same outline.
You do incident response for a living. GCIH, if someone else is paying. Same checkbox, and it is the only one in the cell that matches what a responder actually does day to day.
You are a Cisco network engineer already. CCNP Security is two exams, but if you were going to sit SCOR anyway it is a certification you would have earned regardless. For everyone else it is the slowest path to the same cell.
You are not actually at Level III. Check the wording again. Level III is the enclave tier, and plenty of positions described loosely as senior are Level II on paper, where the answer is almost always Security+ and the study time is a fraction of this.
FAQ
What certifications meet IAT Level III?
The DoD 8570 baseline table lists seven in the IAT Level III cell: CASP+ (now CompTIA SecurityX), CCNP Security, CISA, CISSP (or Associate of ISC2), GCED, GCIH, and CCSP. Holding any one of them satisfies the requirement, and a Level III certification also satisfies Level II and Level I.
Is Security+ enough for IAT Level III?
No. Security+ sits in the IAT Level I and Level II cells, not Level III. If your position is coded Level III you need one of the seven Level III certifications, though holding Security+ first makes SecurityX or CISSP a much shorter climb.
What is the easiest IAT Level III certification to get?
SecurityX is the most accessible: no experience requirement, a single exam, and the lowest cost to keep of the seven. It is still an advanced exam, scored pass/fail over a maximum of 90 questions in 165 minutes, and CompTIA recommends ten years in IT including five in security before attempting it.
Does Associate of ISC2 satisfy IAT Level III?
The 8570 table writes its entry as "CISSP (or Associate)", so yes, the Associate status you hold after passing the CISSP without the experience counts for the cell. ISC2 gives an Associate six years to earn the five years of experience required for full CISSP certification.
How long does the CISSP exam take?
ISC2 publishes the CISSP as an adaptive exam of 100 to 150 items in three hours, with a passing score of 700 out of 1000. Preparation is the long part, not the sitting.
Which IAT Level III certification is cheapest to maintain?
SecurityX. CompTIA asks for 75 CEUs across a three year cycle plus a $150 fee. The GIAC certifications in the cell are the most expensive, at a $499 maintenance fee every four years alongside 36 CPE credits.
Going the SecurityX route? Our SecurityX course follows the CAS-005 objectives, and the first module, Governance, risk and compliance, is free with a free account. Start there and see whether the level fits before you book anything.
A note on currency: the 8570 baseline table this requirement comes from was published by DoD and then frozen. The manual behind it was cancelled in 2023, but legacy contract language keeps its terms in force, which is why contracts still say “IAT Level III.” The preserved cell, with provenance, is here.