The chart that tells a cleared job seeker which certifications satisfy IAT Level II has not been publicly readable since March 9, 2023. That is the last archived rendering of the DoD Cyber Exchange page that returned the table instead of a login redirect. Snapshots from August 11, 2025, January 25, 2026 and May 3, 2026 all return a 302 to a SAML sign-in. The requirement still sits in thousands of contractor job descriptions. The list defining it sits behind a CAC.

Which certifications actually qualify for IAT Level II?

Seven certifications appeared in the IAT Level II cell as of March 9, 2023: CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND and SSCP. Only one is required. The source page has since gone behind a login, so treat the list as a dated snapshot.

They come from the DoD Approved 8570 Baseline Certifications table maintained by DISA. The version here was parsed from the raw table cells of the archived March 9, 2023 rendering, so the column alignment comes off the government’s own markup, not somebody’s blog post.

The neighboring cells matter. IAT Level I listed A+ CE, CCNA-Security, CND, Network+ CE and SSCP; Level III listed CASP+ CE, CCNP Security, CISA, CISSP, GCED, GCIH and CCSP. Levels stack upward only: a Level III certification satisfies a Level II billet, while A+ and Network+ qualify for Level I alone. That is where people lose six months. One sign of how well the chart was tended: the page told readers they “could obtain any one of the four certifications listed in the IAT Level II cell” while its own table showed seven.

Why can’t you read the official list anymore?

The manual never contained the list. It delegated it to a website, which has moved twice and now demands a CAC or SAML login. The requirement ran from a clause to a manual to a URL, and the URL closed.

DoD 8570.01-M did not print the table. It pointed at one, saying the approved IA baseline certification table “on the DISA IASE website” lists the certifications for personnel performing IA functions. IASE became public.cyber.mil, which folded into cyber.mil. Both hostnames now redirect programmatic visitors to an ADFS login.

So a clause obligated a company to certify its people per the current version of a manual, the manual delegated the list to a website, and the website closed to anyone without a government credential. The job seeker screened against the requirement cannot read what defines it. Often neither can the recruiter.

The successor lists move too: the DoD 8140 qualification matrices for cybersecurity and IT are refreshed quarterly by design. Any printed list ages; one nobody outside can check ages invisibly.

Is IAT Level II still a real requirement in 2026?

The manual behind it was cancelled in February 2023. The contract clause that kept it alive for contractors was deleted effective February 1, 2026. Postings still say “IAT Level II” because existing contracts carry the clause they were awarded with.

Three steps. First, the cover page of DoD Manual 8140.03 lists one entry under “Incorporates and Cancels”: DoD 8570.01-M, Information Assurance Workforce Improvement Program, December 19, 2005, as amended. It took effect February 15, 2023. On paper, 8570 ended there.

Second, it did not end for contractors. DoD CIO’s transition paper of August 7, 2024 says it plainly: “Contractors remain under DoD 8570 policy until update of the Defense Federal Acquisition Regulation Supplement (DFARS) authorizes DoD 8140 implementation for contractor personnel.” The mechanism was DFARS clause 252.239-7001, dated JAN 2008, requiring contractor personnel to hold certifications “as listed in the current version of DoD 8570.01-M.” A cancelled manual kept governing contractor hiring because a 2008 clause still named it. That is why your job req says IAT Level II.

Third, the part most published guidance has missed. Class Deviation 2026-O0024, signed December 18, 2025, directs: “Effective February 1, 2026, contracting officers shall use … The attached DFARS Part 239, Acquisition of Information and Communication Technology in lieu of the text codified at 48 CFR chapter 2.” In that replacement text, Subpart 239.71 through 239.73 is marked [Reserved]. DoD’s own line-out version of the old Part 239 carries clause 252.239-7001 in full and names 8570.01-M seven times across the part. The new text never names it.

What that means for you: contracts already awarded keep whatever clause was in them at award, so the requirement persists for years. The codified clause is also still displayed on acquisition.gov as though nothing happened, which is why circulating advice is stale. The memo sits on the Defense Pricing and Contracting class deviations page. If your offer is contingent on a certification, the contract decides it: a DD-254 tells you more than any policy summary, and the 32 CFR Part 117 obligations shape which demands are negotiable.

Which one should you take first?

Not the one you have been told. Security+ CE reaches two of the chart’s fourteen category cells; CySA+ reaches five. If you already hold Security+, CySA+ multiplies your chart coverage two and a half times.

What can be measured is reach: how many of the fourteen category cells each certification appears in, a proxy for how many billets one exam opens. Counts come from inverting the approved-baseline table.

Now the counterweight, because reach is not the only axis. Security+ CE is the cheapest and most widely taught security certification in the country, the one hiring managers outside DoD recognize without explanation, and one of only two IAT Level II certifications that crosses into the IAM management column. Its current exam, SY0-701, runs a maximum of 90 questions. If you need a billet in six weeks it is the right answer, and the narrow reach is a cost you pay later, not a reason to skip it.

CCNA-Security is the trap. Four cells looks strong, but Cisco retired it and rebranded it plain CCNA. The Cyber Exchange footnote is explicit: if you held CCNA-Security and were in a position requiring it when it was retired, you may be eligible for a waiver to cite the rebranded CCNA. That is a grandfather clause, not an on-ramp.

A workable order, then. Hold nothing and have a contingent offer? Take Security+ CE now. Already hold it? Your next exam should be CySA+, not another IAT II-only credential, because it adds four CSSP cells Security+ does not reach. In an IAT Level I billet and wanting up without retesting? SSCP does that, given one year of experience. Working industrial control systems? GICSP outperforms its cell count. Take GSEC when an employer funds it: one cell, 106 questions, 72% to pass, 36 GIAC credits over four years.

On money, the closest defensible anchor is occupational, not per-certification. The Bureau of Labor Statistics put employment of information security analysts at 175,350 with a median annual wage of $120,360 and a mean of $124,740; the 10th-to-90th percentile spread runs $69,210 to $182,370. Those are May 2023 estimates, national and all-sector, neither cleared-specific nor IAT II-specific. The clearance moves pay more than the certificate does, which we cover in what a clearance is actually worth.

What does the job require beyond the certificate?

Under 8570, an IAT Level II position expected the baseline certification within six months of assignment, normally at least three years of experience, and a separate computing environment certificate on top. Under 8140, that CE certificate is no longer required by policy.

Table C3.T4 of 8570.01-M set the position at the baseline certification plus a CE/OS certificate, with the incumbent normally holding at least three years in IA technology or a related area. The computing environment piece is the one people forget. Technicians with privileged access had to obtain CE certifications for the systems or security tools they support, at minimum for whichever tool they spend the most time on.

That burden has eased. Under 8140, computing environment, operating system and network environment certificates “are not required under DoD 8140 policy,” though Components may still impose them for particular roles. Read a posting demanding one as a customer preference, not a policy mandate.

Why must a contractor hold the cert on day one?

Because the manual says so in one sentence, and it applies only to contractors. Federal civilians and service members get nine months for foundational qualification and twelve for residential. Contractors must be qualified at the commencement of work.

DoDM 8140.03 gives civilian and military members a runway: foundational qualification within 9 months of assignment to a cyberspace work role, residential within 12. For contractors the text is one line with no runway in it. “Contractors must be qualified in accordance with this issuance at the commencement of work.” Same work role, often the same building. Different clock.

The escape hatches are narrow. Experience may substitute for a foundational qualification only for federal civilians already incumbent in a coded position on the effective date, and only where no qualifying education, training or mapped certification exists. That path is closed to a new contractor hire. Waivers must carry an expiration date not beyond six months, except during deployment to a combat environment.

This asymmetry belongs in the choice between tracks. The contract job versus federal civilian job decision is usually framed around pay and stability; the certification clock belongs in it too. It also explains why few contractors fund your exam. Their wrap rate has to absorb it, and the billet was bid assuming you arrived qualified.

What replaces IAT Level II under 8140?

Work roles from the DoD Cyber Workforce Framework, each with a proficiency level of Basic, Intermediate or Advanced. There is no crosswalk from the old categories, and a certification is now only one of three ways to satisfy the foundational requirement.

Proficiency levels indicate readiness to perform a specific role, replacing the old three-level ladder inside each category. DoD CIO states there is no crosswalk between the programs, though certifications may carry over depending on the work role and proficiency level assigned. Nobody can hand you a conversion chart; none exists.

Four consequences before you spend your own money. A certification is optional in principle: the manual requires any one of three foundational qualification options, which are education, training, or personnel certification. Good-for-life certifications are dead, not valid under 8140 and already phased out under 8570, with no blanket renewal. Residential qualification carries a minimum of 20 hours per year of continuing professional development. And to join the matrix at all, a certification must show at least 70 percent alignment with the core tasks and KSAs of the work role. The text sits in DoD Manual 8140.03; DoD CIO’s transition paper summarizes what carried over. The same shift drives the staffing CMMC Level 2 forces onto contractors.

Practically, “IAT Level II” in a 2026 job posting is a contract artifact. The manual behind it was cancelled in 2023, and the clause that made it enforceable for contractors vanished from the deviated DFARS Part 239 on February 1, 2026. Expect the label to survive in recompetes and legacy task orders for years, then thin out as awards turn over. When a recruiter uses the phrase, ask one question back: which DCWF work role and proficiency level is this position coded to? A shrug means the template predates the rule change, and the certification you buy on that basis may satisfy an obligation that has already lapsed.

Frequently Asked Questions

Does Security+ still satisfy IAT Level II?

On the last publicly readable DoD baseline chart, dated March 9, 2023, Security+ CE was one of seven certifications in the IAT Level II cell, and any one of them met the requirement. Where a contract still carries DFARS clause 252.239-7001, it is what most programs check for.

Do A+ or Network+ count toward IAT Level II?

No. DoD 8570.01-M is explicit that A+ and Network+ “qualify only for Technical Level I and cannot be used for Technical Level II positions.” SSCP covers both levels: someone moving from a Level I to a Level II position while holding SSCP need not take a new certification.

How long do I have to earn the certification after I am hired?

As a contractor, no time at all: DoDM 8140.03 requires contractors to be qualified at the commencement of work. Federal civilians and service members get 9 months for foundational qualification and 12 for residential. The older 8570 table allowed 6 months from assignment, which is where the figure in postings originates.

Is my “good for life” certification still valid?

Not under 8140. DoD CIO states that good-for-life certifications are not valid under DoD 8140 and were phased out under 8570 as well, and that every certification must be renewed on its provider’s own periodicity. There is no blanket renewal.

Which single certification opens the most DoD billets?

By coverage of the March 2023 chart, CySA+ appears in five of the fourteen category cells: IAT Level II plus four of the five CSSP cells. Security+ CE, the most commonly held, appears in two.