Open the DFARS Part 239 that Defense contracting officers have been directed to use since 1 February 2026 and look for the information assurance certification rules. One line sits where they used to be: Subpart 239.71-239.73 [Reserved]. The words “8570,” “8140,” “information assurance” and “252.239-7001” appear zero times in it. The requirement that put “IAT Level II” into a decade of cleared IT job postings is not in the text a contracting officer works from today.

It is still in the Code of Federal Regulations, though, and still says what it said in January 2008. Two official sources now disagree about whether the certification clause exists. That gap is why “what cert do I need?” no longer has a chart-shaped answer, and why the real answer runs through the contract.

What replaced the 8570 certification chart?

Short answer: DoD Manual 8140.03, effective 15 February 2023, which cancelled 8570.01-M outright. It replaced IA categories and levels with Cyber Workforce Framework work roles and three proficiency levels, and never uses the terms IAT, IAM or IASAE.

The old system sorted people by information assurance category and level. Technical or management, then I, II or III. That is where the vocabulary came from: IAT meant Information Assurance Technical, and the levels mapped to computing environment, network environment and enclave. DFARS 239.7102-3 still spells it out, requiring a list of responsibilities “by category (e.g., technical or management) and level (e.g., computing environment, network environment, or enclave).”

DoDM 8140.03 discarded that structure. Positions are now coded to a DCWF work role carrying a three-digit code, at Basic, Intermediate or Advanced proficiency. The manual states that it “does not require any connection between proficiency level and the rank or grade of the individual,” which breaks the habit of reading a level as a seniority signal. Appendix B of the August 2025 coding guide lists 71 work roles. A job once posted as “IAT Level II” now resolves to something specific, such as 461 System Administrator or 521 Cyber Defense Analyst.

Why did the certification requirement fall out of the contract?

Short answer: A class deviation reserved the DFARS subpart that carried it. Since 1 February 2026, contracting officers use replacement text in which 239.7102-3 and clause 252.239-7001 do not appear. The clause remains codified in the CFR, so the two sources conflict.

The chain used to be intact. DoDD 8140.01, effective 5 October 2020, told components to “specify workforce qualification requirements in contracts” for cyberspace work roles, applying those standards “according to Defense Federal Acquisition Regulation Supplement Subpart 239.71.” That subpart prescribed clause 252.239-7001, whose paragraph (c) is the sentence that actually removes people from contracts: “Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.”

Then Class Deviation 2026-O0024 instructed officers to use an attached Part 239 “in lieu of the text codified at 48 CFR chapter 2.” In that attachment the subpart is reserved. DoD’s own line-out document shows the deletion as strikethrough across every matching passage: the 239.7102 headings, the reference to 8570.01-M, the clause prescription and the clause text itself.

Precision matters, because the distinction is easy to get wrong. Clause 252.239-7001 has not been removed from the CFR. It is still published on acquisition.gov, still dated JAN 2008, still citing a manual cancelled in 2023. A deviation displaced it for new work. A contract signed before 1 February 2026 may still carry it, and if it does, it still binds. The deviation itself holds only “until rescinded or incorporated into the FAR, DFARS, and DFARS PGI.”

How do the two systems compare?

Does a contractor actually have to hold a certification?

Short answer: Not necessarily. Contractors owe foundational qualification at the commencement of work, and a certification is one of three ways to meet it. What they cannot do is substitute experience, a path reserved for federal civilians who held a coded position on 15 February 2023.

The manual applies to contractors by name, covering “personnel who provide contracted services (referred to in this issuance as ‘contractors’)” alongside service members and civilians. The timing rule is blunt: “Contractors must be qualified in accordance with this issuance at the commencement of work.” There is no phase-in. The two-year and three-year windows people quote apply to DoD civilians and service members, running from the 15 February 2023 effective date, which puts them at February 2025 and February 2026. Those are not contractor deadlines, and the widely repeated “February 2027” date appears nowhere in the manual.

The good news sits one paragraph further down. Contracted support must meet foundational requirements on day one, and “contractors are not required to meet resident qualification requirements, unless the OSD or DoD Component requires it and the contract includes language to indicate this requirement and how it will be achieved.” Resident qualification is the on-the-job component. Absent contract language, it is not your burden.

The asymmetry in the experience rule is worth understanding before an interview. Experience substitutes for a foundational option only for federal civilians incumbent in a coded position on the effective date. A contractor on the same task order as a federal civilian doing identical work cannot use the waiver that civilian can. If you are unsure which side of that line you sit on, the difference between a government contract job and a federal job decides which 8140 rules reach you.

Who verifies it, and against which document?

Short answer: The employer verifies, against the performance work statement and the clauses actually incorporated into that contract. The PWS names the work role and proficiency level, for up to three work role codes. No general chart governs.

DoDM 8140.03 puts the requirement where the work is defined: contracted support whose “performance work statement requires the performance of cyberspace work” should have that work “identified by DCWF work role and proficiency level for primary and additional work roles (up to 3 work role codes) as applicable.” That is the verification pivot. A recruiter cannot answer “what cert do I need” from a framework, only from the requirement documents for one specific contract.

Three documents carry the answer, held by different people. The PWS names the work role and proficiency. The clause list determines whether 252.239-7001 was actually incorporated. The DD-254 states security requirements for the classified side of the effort, a separate question from cyber qualification and frequently conflated with it. Inside the company, the facility security officer owns clearance verification, while qualification evidence usually sits with a program or contracts manager.

Consider the scale. DARPA awarded SecuriGence LLC a $121,521,288 modification in June 2026 for information technology multi-network support services, taking the task order’s cumulative face value to $816,412,874. The announcement names no clearance levels, work roles or certifications, which is the point: a nine-figure award is public while the requirements binding the people who staff it sit in documents you have to ask for.

So why do job ads still say IAT Level II?

Short answer: The legacy chart retains market force without legal force. Primes still write it into requisitions, and the authoritative 8140 matrices now sit behind CAC login while the superseded chart circulates freely on commercial training sites.

Here is the concession that matters most on this page: a candidate holding Security+ CE is still, practically, more hireable for cleared IT work than one who is not. The chart lost its legal footing. It did not lose its grip on the requisition template. If your target roles say “IAT Level II,” the certifications on that superseded list still clear the screen, and pretending otherwise would cost you interviews.

The information environment makes this worse. The DoD Cyber Exchange page that hosted the baseline chart now redirects to a single sign-on prompt, and the matrices behind it require CAC. The archived 8570 chart, meanwhile, is reproduced across commercial training vendors with an obvious interest in it staying authoritative. For historical context only, that chart listed A+ CE and Network+ CE at Level I; Security+ CE, CySA+ and GSEC at Level II; and CISSP, CISA and CASP+ CE at Level III. Treat it as terminology from old job ads, not current requirements.

DoD is candid about the unfinished state of this. The DCWF Workforce Identification and Coding Guide, version 1.6 from August 2025, says outright that it “is not applicable to DoD contractors as the Defense Federal Acquisition Regulation Supplement (DFARS) is pending update; more guidance will be promulgated when approved.” DoDI 8140.02 likewise excludes contracted services support, noting that governing requirements sit in “supporting guidance, currently under development.” That was December 2021. The guidance has not landed, and the acquisition hook it was meant to hang from has been reserved out. Anyone selling certainty about contractor 8140 obligations in 2026 is selling something DoD has not published.

What should you ask before you accept the offer?

Short answer: Which work role code and proficiency level the PWS names for your labor category; whether clause 252.239-7001 is incorporated into that contract; and who pays for certification and continuing education.

The first tells you what you are actually measured against, and a recruiter who cannot answer it has not read the requirement documents. The second separates a pre-February-2026 contract still carrying the old clause from newer work written under the deviation, which decides whether a lapsed certification can bar you from the systems. The third is a compensation question in a compliance costume. Certification fees, retakes and the minimum 20 hours per year of continuous professional development are real costs that show up in the wrap rate your employer bids.

One more detail: certifications approved at a higher proficiency level also count for lower levels in the same work role, so a credential earned for an Advanced posting travels down. Qualification status can also gate a start date the way an investigation can, which feeds into when a cleared hire can actually begin billing.

On pay, resist the numbers quoted at you. BLS put the median annual wage for information security analysts at $124,910 in May 2024, with employment projected to grow 29 percent from 2024 to 2034. That is an all-industry national figure, not a cleared-market number: read it as a floor-setting proxy, not your rate. What a clearance is worth in the cleared market is a different calculation, and compliance-driven roles behave differently again, as the staffing pattern around CMMC Level 2 shows.

The trajectory through the rest of 2026 is legible enough. The deviation stands until rescinded or folded into the FAR and DFARS, and DoD has promised contractor guidance it has not issued. Until it does, “8140 certification requirement” describes a contractual term, not a governmentwide rule. Ask which work role code the PWS names. If nobody on the hiring side can tell you, the requirement is a habit rather than an obligation, and you should know that before you build a certification plan around it.

Frequently Asked Questions

Is DoD 8570 still in effect in 2026?

No. DoDM 8140.03 incorporated and cancelled DoD 8570.01-M effective 15 February 2023. The cancellation line on the cover page is the only place “8570” appears in the entire manual. Training vendors still reference it, and the DFARS clause codified in the CFR still cites it, but the manual is superseded.

What is the 8140 equivalent of IAT Level II?

There is no direct equivalent, which is the honest answer rather than an evasive one. DoDM 8140.03 does not use the term IAT anywhere. Work is coded to a specific work role, such as 461 System Administrator or 521 Cyber Defense Analyst, at Basic, Intermediate or Advanced proficiency. Ask which code and level the performance work statement names.

Do I need a certification to start work on a cleared IT contract?

You need foundational qualification at the commencement of work, and a certification is one of three ways to achieve it. Education and training are the others. Contractors cannot substitute experience, a path limited to federal civilians already in a coded position on 15 February 2023. Your contract may still impose a specific certification by its own terms.

What happens if my certification lapses mid-contract?

It depends on whether clause 252.239-7001 is incorporated into your contract. Where it is, paragraph (c) states that contractor personnel without proper and current certifications “shall be denied access to DoD information systems for the purpose of performing information assurance functions.” The class deviation effective 1 February 2026 removed the prescription that put the clause into new contracts.

Does any certification count under 8140?

No. A qualifying certification must be accredited to ISO/IEC 17024 through the National Commission for Certifying Agencies, ISO/IEC 17011 or ANSI, and must align to at least 70 percent of the work role’s core tasks and knowledge, skills and abilities. Vendor course completion certificates do not automatically qualify.