The clause that put “IAT Level II” into a generation of cleared job descriptions is dated JAN 2008 and points at DoD 8570.01-M, a manual the Department cancelled on February 15, 2023. It is still printed in the codified DFARS, and since February 1, 2026 contracting officers have been told to use a Part 239 that omits it. Both are true.

Do IAT, IAM and IASAE still exist?

As DoD qualification policy, no. The cover page of DoD Manual 8140.03 reads “Incorporates and Cancels: DoD 8570.01-M, ‘Information Assurance Workforce Improvement Program,’ December 19, 2005, as amended.” One line, and a scheme most cleared IT people can recite stopped being policy.

The remembered version is partial. DoD’s transition paper gives three parts: levels I, II and III across the IA Technical, IA Management and IA System Architect and Engineer categories; certifications for Computer Network Defense-Service Provider specialties; and third, “additional Computing Environment and/or Operating System (CE/OS) certificates were required based on the particular requirements of a system environment.” Summaries drop the third. Many readers had to satisfy it.

Does IAT Level II map to a DCWF work role code?

No, and DoD says so twice in one document. What moves across is an individual certification, conditionally, by work role and proficiency level. The category does not translate.

One sentence in the DoD 8570 to 8140 transition paper of August 7, 2024 settles it, and both halves get quoted alone: “The DoD 8570 and DoD 8140 programs are not structured the same and there is no ‘crosswalk’ of qualifications between them, however, an individual’s certifications may carry over from 8570 to 8140 dependent on the work role(s) and proficiency level(s) assigned to their position.” It repeats: “There is no direct comparison, or mapping, between 8570 IA functional categories and the DCWF work roles.”

Carry-over depends on currency, and “Good for Life” certifications “are not valid under DoD 8140.” CE/OS/NE certificates, appointment letters and privileged-access designations stopped being federal requirements, but each keeps a Component carve-out: they “may be required by Components for performing certain roles or jobs.”

What replaced the levels?

A three-digit work role code plus a proficiency level, attached to a position, which carries a primary code and up to two additional ones. Per DoD Instruction 8140.02, work roles “are represented by a three-digit code within the DCWF,” and a primary code from 111 to 999 “indicates that cyberspace work is the primary role of the billet.” The DoD CIO’s June 2026 briefing lists 451 System Administrator, 511 Cyber Defense Analyst and 722 Information Systems Security Manager among them, a selection rather than the framework.

These are not renamed IAT levels. They scale within one work role, one person can sit at different levels on different codes in a single position, and the manual “does not require any connection between proficiency level and the rank or grade of the individual.”

How do you qualify under 8140?

Personnel “complete any one of the three foundational qualification options,” and the on-the-job area “must be completed to achieve qualification.” Two carve-outs belong in the same breath. A command “may dictate more stringent requirements above the options in the program,” though “the baseline standards cannot be waived.” And the pick of three is often not a pick: where an area “has not been defined, or is not available for an individual work role, there will be an option between the two remaining” areas, and where requirements exist for only one, “those requirements must be satisfied.”

On education, a secondary diploma is the minimum “for all work roles at all proficiency levels.” The often-quoted trap is that a post-secondary degree must be conferred within the past five years. That sentence does not stop there: it continues “unless continuous work in the relevant discipline can be demonstrated,” defined as employment covering any cyberspace work role “with no more than 3 consecutive years lapse in cyberspace work,” which components validate on their own processes. But the clock is not the only gate. The paragraph before it reads “higher education and degree discipline requirements are evaluated and enacted on a role-by-role basis.” A degree in a discipline your work role does not list clears nothing, however unbroken the employment.

Certifications are specified tightest: ISO/IEC 17024 accreditation, 70 percent alignment to the work role’s core content. One sentence matters most when picking an exam, and it runs one way only. “Certifications approved at a higher proficiency level also apply to lower proficiency levels within the work role.” Higher covers lower; lower does not reach up, and nothing carries sideways into another work role. DoD’s current matrix document puts it the same way: an option aligned to “advanced” also aligns to “intermediate” and “basic.” Never the reverse. Coded Advanced, you get nothing from the cheaper Intermediate exam. Our breakdown of the IAT Level II certification list covers the legacy table those contracts reference. On funding, VET TEC pays a provider’s “tuition and fees,” housing and “books and supplies” — training, not a bare exam fee — and caps enrolment at 4,000 paid participants a fiscal year. Our GI Bill and VET TEC guide has the rest.

What does a qualification matrix contain?

A grid per work role: the three foundational options across Basic, Intermediate and Advanced, then residential requirements, then annual maintenance. The interactive matrices are gated: the Cyber Exchange page serves an empty JavaScript shell to bots, the public.cyber.mil workforce paths a DoD login portal wanting a CAC. The document is not. DoD’s “Qualification Matrix and Training Repository … V2.1,” published on media.defense.gov, states that “the effective date of this document is September 19, 2025.” That supersedes the March 25, 2025 V2.0 date most write-ups still print.

Do not overstate the churn. The matrix standard operating procedure offers the quarterly cadence as “a tentative refresh schedule,” a plan rather than a record of refreshes performed, and DoD published two versions across that window. The V2.0 bulletin says, beside its effective date, “no updates have been made to DoD 8140 foundational qualification options as it relates to education and personnel certifications.” If your certification qualified in 2024, that sentence cuts in your favour. For 451, 511 and 722 we have no primary list we can stand behind, and will not invent one; ask your program manager for the workbook.

Do contractors get the same clocks as federal civilians?

No, and this is the scheme’s most consequential difference. The 9-month and 12-month clocks, the supervised-work provision, the 6-month waivers and the experience alternative are written for DoD civilians and Service members. Contractors get none of them.

DoDM 8140.03 names contractors in its applicability paragraph and sets the substance: contracted support personnel “must meet foundational qualification requirements upon commencement of cyberspace work,” and are “not required to meet resident qualification requirements, unless the OSD or DoD Component requires it and the contract includes language to indicate this requirement and how it will be achieved.”

Read the parent DoD Directive 8140.01 past its applicability paragraph, which lists only DoD Components and is why it is often said not to reach contractors. Paragraph 2.10 puts the duty on Component heads directly: “identify, document, track, and report qualifications for military, DoD civilian, and contractor support personnel who perform cyberspace work roles,” and “specify workforce qualification requirements in contracts … Contractor personnel performing such work roles must have their qualifications documented.” That is why a customer can demand qualification evidence where the performance work statement is silent.

Weighing a move between the two worlds? Our comparison of contractor and federal roles takes it apart. Miss these clocks without a waiver and the manual directs removal from duties. The provision immediately before that gets misquoted twice over: it sits under a heading reading “DoD civilian employees and Service members:” and so is closed to contractors, and it does not end where it is usually stopped. In full, such a person “may temporarily perform cyberspace workforce position duties while obtaining qualification requirements under the direct observation/supervision of an appropriately qualified individual, unless the qualification requirement is waived … If such observation is not feasible, and the qualification requirement is not waived … then the individual must be reassigned to other duties consistent with applicable law.” A way to keep working while you qualify, not a grace period, and no contractor version exists.

On experience, the Experience Qualification Process guide of December 16, 2024 is blunt: “The application of this conditional alternative … is not authorized for contractor personnel.” For civilians it sits inside three walls. The manual limits it to members “incumbent in an IT, cybersecurity, or enabler workforce element coded position,” so a 551 Red Team Specialist or a 121 Exploitation Analyst is excluded outright. It applies only “in the absence of qualifying education, training … or a commercial certification” for the role. And the paperwork disagrees on incumbency: the guide says “as of 13 December 2024,” the manual keys it to February 15, 2023. Ask your program manager. The sunsets are years: 2027 for cybersecurity, 2028 for IT and enablers.

Why does the job posting still say IAT Level II?

Because of an acquisition clause, not a policy. The clause on acquisition.gov reads: “(a) The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification … in accordance with DoD 8570.01-M.” Then “(b) Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel.” And the summaries drop: “(c) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.” That is why a cancelled manual’s categories still govern daily access on many contracts.

Now the other track. Class Deviation 2026-O0024, signed December 18, 2025, directs that “Effective February 1, 2026, contracting officers shall use” the attached DFARS Part 239, where the subpart table reads “Subpart 239.71-239.73 [Reserved].” In it, “252.239-7001” and “8570” appear zero times, against twice and seven times in the text it supersedes.

Read the adjacent column before concluding from that. “8140” is also zero in the deviated Part 239, because the deviation struck all of Subpart 239.71, whose authorities named DoD Directive 8140.01 alongside 8570.01-M. It did not move contractors onto 8140; it left the DFARS silent both ways, and left the directive’s instruction to apply standards “according to … Subpart 239.71” pointing at a subpart that now reads Reserved. Nor is the clause rescinded. It is still printed under DFARS Change 5/7/2026, the deviation “remains in effect until rescinded or incorporated into the FAR, DFARS, and DFARS PGI,” and a pre-2026 contract can still carry it, paragraph (c) included.

DoD filled that silence outside the DFARS. On May 27, 2026 the Department of War CIO, Kirsten A. Davies, signed “Implementation of Department of War Cyberspace Workforce Policy Requirements for Contractors.” It records that acquisition signed the deviation “removing references to DoD Directive 8140.01, DoD 8570.01-M, and DFARS clause 252.239-7001” and has “endorsed” the CIO’s Workforce Innovation Directorate to implement DCWF coding and qualification guidance “for cyber workforce personnel, including contract support.” It directs that “DoW Components must ensure that cyber workforce personnel, including contract support, meet the qualification requirements for the specific DCWF work roles and update contracts accordingly.” Detailed implementation guidance, it adds, “is under development.” The direction is issued; the mechanics are not. It also retires the transition paper’s line that contractors “remain under DoD 8570 policy until update of the … DFARS authorizes DoD 8140 implementation for contractor personnel.” Read the contract artifact, not the advertisement, as with clearance requirements on job postings.

Where the answer actually lives

Not on a job board, ours included. We run one and we cannot tell you your code; neither can any other. A posting is copy written by a recruiter; the code is a data field in your Component’s manpower system, held by its cyber workforce program manager. Contract-side the controlling documents are the performance work statement and the contract. The manual says contracted support work “should be identified by DCWF work role and proficiency level,” softer than the language used for government positions, and the June 2026 briefing still lists coding contractors as future work. That slide is a reporting roadmap. The May 2026 memo is the direction.

So the clean answer to “which category am I in” is no longer a category. It is a code and a proficiency level in a system you probably cannot log into, attached to a position rather than to you. The move worth making this week is one question to one person: which code and proficiency level is my position coded to? Ask before you buy an exam, because a certification one level too low buys nothing. None of this is legal advice; your contract controls. Hiring managers face the mirror image, in 8140 certification requirements on a cleared IT contract.

Frequently Asked Questions

Does IAT Level II still exist?

Not as DoD qualification policy. DoDM 8140.03 cancelled DoD 8570.01-M effective February 15, 2023. The term survives in contracts carrying DFARS clause 252.239-7001, dated January 2008 and still citing that manual.

Which DCWF work role does IAT Level II map to?

None, and any table claiming otherwise is fabricated. DoD’s August 2024 transition paper says the programs “are not structured the same and there is no ‘crosswalk’ of qualifications between them.” Certifications may carry over conditionally; categories do not.

Does my Security+ still count under 8140?

Possibly, but it is now work-role-specific. Certifications carry over “depending on their validity and applicability for a particular work role and proficiency level,” and must be current; “Good for Life” ones are not valid. Check the level too: one aligned to Intermediate does not qualify an Advanced-coded position.

Can experience substitute for a certification?

Not for contractors: the December 2024 guide says the alternative “is not authorized for contractor personnel.” For DoD civilians it is limited to IT, cybersecurity and enabler work roles, applies only where no qualifying education, training or certification exists, and the two documents give different incumbency dates, December 13, 2024 and February 15, 2023.