How 8140 qualification actually works
Most of what is written about 8140 online is wrong in the same few places. This page states the model as DoDM 8140.03 states it, with the section references, so you can check us.
On this page
Certification is one of three routes at DoD level — but yours is probably required anyway
To be fully qualified you satisfy both halves: foundational and residential. For the foundational half, the manual says personnel complete any one of the three options — an OR, not an AND. That is the Department's floor, not necessarily your requirement.
If you were told to get a specific certification, that is your requirement
A component may require two of the three foundational areas rather than one, but the baseline standards themselves cannot be waived. Components set their own implementation, and contract support qualifies on whatever terms the contract carries. So a command or a contract can narrow three routes down to one named certification — and frequently does, because a certification is the cleanest evidence to audit.
What follows is the model underneath that instruction. It matters when you are choosing between routes, checking whether a degree or completed training already counts, or arguing that it should.
Education
A secondary diploma or GED is the minimum for every work role at every proficiency level. Higher-education degree requirements are set role by role.
The degree must have been conferred within the past 5 years, unless the person demonstrates continuous work.
Training
Training must cover 70% of the core task and KSA content for the work role at the assigned proficiency level.
Completed within the past 5 years, subject to the same continuous-work exception. Training offerings from outside the Department need prior CWMB approval.
Certification
The certification must be accredited to ISO/IEC 17024 and align to 70% of the role's core tasks and KSAs. Approval requires a CWMB vote and independent third-party review.
A certification approved at a higher proficiency level also satisfies lower levels within the same work role (§3.2.b.(1)(c)5.a.).
Plus residential qualification — always, no options
On-the-job qualification must cover all pertinent tasks and KSAs and must include a formal, documented period of supervised engagement before the individual works unsupervised. Performance-based assessment in simulated environments is permitted.
Computing-environment, operating-system and network-environment certificates are not required by 8140 policy. Components may impose them at their own discretion.
Residential qualification is maintained by the component, not the Department — which is why the training pipelines and OJT requirements for the same work role differ between the Navy and the Marine Corps while the certification, education and experience options are identical.
Experience is not a fourth option
It is a narrow substitution with a closing door — and it was never open to contractors or new hires.
Open to DoD civilian and military service cyber workforce members who were incumbent in a DCWF IT, cybersecurity, or enabler-coded position as of 16 December 2024 (per EQP v1.2), and only where qualifying education, training, or certification is absent. Earlier guidance set this date differently and it has moved twice — check the current EQP version rather than relying on a fixed date.
Runs as a formal, mandatory Experience Evaluation Board. The member cannot self-nominate: the supervisor identifies the operational need and the cyber workforce program manager initiates or coordinates the nomination, with nomination procedures delegated to each Component. The evaluating team must include at least two of the ISSM, the member's CWF supervisor, or a work-role SME, and the supervisor's participation is mandatory. Scoring is against the same 70% core task and KSA threshold, captured on the DoD 8140 Experience Evaluation Worksheet. Final sign-off is recommended to be a DoD Component Official (GS-14/GS-15/O-6 or equivalent), with the certificate and worksheet retained in the official personnel file and tracking databases updated. EQP v1.2 also gates use of the alternative on severe operational constraints, requires a separate EQP per work role, and gives a member nine months to pursue another option if disapproved.
The experience alternative expires 31 December 2027 for the Cybersecurity element and 31 December 2028 for IT and Cyber Enabler. Qualification already earned is retained past those dates — but it is lost on a move to a different work role or proficiency level, which is the more common way people lose it.
Contractors are excluded. EQP v1.2 dropped v1.1's explicit prohibition sentence, so the exclusion now follows from the population the alternative is scoped to rather than from a standalone rule.
Proficiency levels
The level does not change the structure of the requirement. It changes the content of each cell.
Familiarity with basic concepts and processes; applies them with frequent, specific guidance; performs in routine, structured situations.
Extensive knowledge of basic concepts; applies them with only periodic high-level guidance; performs in non-routine, sometimes complicated situations.
In-depth understanding of advanced concepts; applies them with little to no guidance and provides guidance to others; performs in complex, unstructured situations.
- Proficiency level is decoupled from rank and grade. The manual states directly that it "does not require any connection between proficiency level and the rank or grade of the individual."
- Proficiency changes the content of each qualification cell, not the structure. The same task appears at all three levels with escalating verbs — demonstrates knowledge of, contributes to developing, develops and approves.
- A position may carry up to three work role codes, and the incumbent must qualify for each one at that role's assigned proficiency level.
The clocks
The difference between a civilian and a contractor here is the single most expensive detail in the policy.
Military and civilian personnel
Foundational within 9 months of assignment
Residential qualification within 12 months. Personnel may work under direct supervision while qualifying. Failure to qualify in time means removal from work-role duties unless waived.
Contract support
Foundationally qualified at commencement of work
Contractors get no 9-month runway — the requirement attaches when work begins. Contractors are not required to meet residential qualification unless the component requires it and the contract says so.
Waivers are granted only for severe operational or personnel constraints, run for a maximum of 6 months, and consecutive waivers are not authorized.
Continuous professional development
Qualification is not a one-time event. CPD is where most secondary sources get the numbers wrong.
The 20 hours are identical at Basic, Intermediate and Advanced — CPD does not scale with proficiency. Hours earned toward a certification's own continuing-education requirement count toward CPD, but the reverse does not hold: meeting the 20 hours does not satisfy an issuer's CE cycle.
CPD commences in the fiscal year after the individual completes both foundational and residential qualification.
CPD applies even to someone holding no certification at all. It never excuses a certification's own continuing-education requirements. Conversely, credits earned toward a work-role certification's CE count toward CPD.
Qualifying activities
- Coursework and training
- Subject-matter meetings, seminars, colloquia and workshops
- Documented professional or technical society membership
- Cyber ranges, exercises and virtual labs
- Webcasts and web seminars
- Component- or certification-body-authorized mentoring, self-study and e-learning
- Passing a related professional exam
- Publishing a paper, article or book
The contractor transition
The contractor 8570 carve-out closed on 1 February 2026 — but the old clause is still on the books.
2023-02-15
DoDM 8140.03 takes effect and formally cancels DoD 8570.01-M. There is no crosswalk between the two regimes — certifications carry over individually by work role and proficiency level, or not at all.
2025-02-15
Two-year deadline: the Cybersecurity workforce element must be qualified.
2025-12-18
DFARS Class Deviation 2026-O0024 is signed, issued under E.O. 14275. The deviated text drops clause 252.239-7001 while its sibling clauses survive.
2026-02-01
The deviated DFARS text takes effect, removing the references to DoD 8570.01-M, DoDD 8140.01 and clause 252.239-7001 that had kept 8570 contractually alive for industry.
2026-02-15
Three-year deadline: cyberspace IT, cyberspace effects, intelligence (cyberspace) and cyberspace enablers must be qualified. 8140 is now in steady state, not phase-in.
2026-05-07
A DFARS change reconfirms 252.239-7001 as codified and still mandating 8570.01-M — after the deviation, and weeks before the CIO memo.
2026-05-27
The DoW CIO memo directs components to ensure cyber workforce personnel including contract support meet DCWF work role qualification requirements, and to update contracts accordingly. It sets no contractor deadline and states that detailed implementation guidance is still under development.
Where it stands today
- New and updated contracts written under the deviation carry no 252.239-7001. Contractor cyber personnel qualify by DCWF work role under DoDM 8140.03.
- Legacy contracts that already incorporate 252.239-7001 remain contractually bound to its 8570.01-M terms until they are modified. Expect both regimes to coexist across a contract portfolio.
- No contractor compliance deadline or grace period has been published. But DoDM 8140.03 has always required contract support to be foundationally qualified at commencement of work.
What we don't know
Where our own sourcing stops. A product that quietly papers over its gaps is worse than one that names them.
- Qualification Matrix V2.1 (effective 19 Sep 2025) could not be retrieved as a PDF — the DoD host edge-blocks automated access and no archive snapshot exists. The per-role qualification data in this product was extracted from DoD COOL, which renders the same matrix, and validated by spot-checking rendered pages. It has not been diffed against the canonical workbook, which sits behind CAC.
- DoDD 8140.01 and DoDM 8140.03 both still describe five workforce elements. Data/AI and Software Engineering were added to the DCWF afterwards and appear in neither issuance's element list — so the February 2025 and February 2026 deadlines, by their terms, do not cover them. No qualification deadline for those two elements could be located.
- The DCWF Coding Guide reachable publicly is v1.4 (11 Sep 2024), listing work roles as of April 2024. It is already stale: work roles 452 and 633 exist in the live matrix but not in that guide. A newer coding guide may exist behind CAC.
- The contractor implementation guidance promised in the May 2026 CIO memo does not appear to have been published.
- The Experience Qualification Process is at v1.2 (Aug 2025), but DoD's own canonical links — dl.dod.cyber.mil, cool.osd.mil/usmc, and the unversioned "..._EQP.pdf" filename — still serve v1.1 byte-identically. Only the explicit "..._EQP_v1.2.pdf" path on cool.osd.mil/usn returns current text, and cyberworkforce.mil edge-blocks automated access. Our experience-substitution dates therefore rest on a SINGLE retrievable source, and anyone spot-checking us against "the" EQP URL will land on the superseded version and think we are wrong.
- DoDM 8140.03 and the EQP state different incumbency dates for experience substitution (the manual's effective date vs. an explicit, rolling date in the EQP). The EQP subordinates itself to the manual and cannot formally amend it, yet states a different date, a wider population, and expirations the manual does not contain. No published source reconciles the two. We follow the EQP as controlling in practice and say so.
- EQP v1.2 contradicts itself on who gives final approval for experience qualification: the Final Approval section says a DoD Component Official (GS-14/GS-15/O-6 or equivalent), while the Experience Evaluation Worksheet procedure says "Commanding Officer or designated official." We follow Final Approval because the change log flags it as the new clarifying section, but v1.2 never reconciles the two and a Component could defensibly follow either. Our wording keeps the document's own "recommended to be" hedge rather than asserting one.
- EQP v1.2 uses "Experience Evaluation Board" and "Experience Evaluation Team" interchangeably without defining a distinction between them. We treat them as the same body, which is the natural reading but is not stated. v1.2 also names no military-side equivalent to DCPDS despite covering military service members, and its Appendices A and B (the Worksheet and the Board Certificate) are embedded images whose field-level contents are not text-extractable — they would need OCR before we could mirror the worksheet.
DoD CIO now serves this behind an edge block; the link resolves to a Wayback snapshot captured 27 Jan 2026. The snapshot shows no change transmittal — the manual stands at its original February 2023 issuance.
Source: DoDM 8140.03, Cyberspace Workforce Qualification and Management Program · dated 2023-02-15 · checked 2026-07-16