The addition of CompTIA and EC-Council credentials to the former DoD 8570.01-M approved-certification framework is a historical workforce-policy event, not a newly announced 2026 certification change. It influenced how information-assurance jobs were described and how organizations documented baseline knowledge. DoD Manual 8140.03 replaced that program on February 15, 2023. Today, workforce managers should treat old 8570 entries as legacy records to reconcile with assigned DoD Cyber Workforce Framework (DCWF) work roles, proficiency levels and the current qualification matrices.
This article addresses the administrative task behind that change: how to interpret an inherited 8570 certification list, classify current positions, examine qualification alternatives and keep evidence that can withstand an internal review. The DoD 8140 FAQ and official qualification matrices are the policy starting points; a commercial guide or historical exam chart is not a substitute for the issuing authority.
What the earlier 8570 certification announcement actually meant
The 8570 program used information-assurance functions and levels—particularly IAT, IAM and IASAE, together with specialized categories—to describe baseline qualification requirements. Certification bodies such as CompTIA and EC-Council contributed credentials associated with different security capabilities. The announcement about their inclusion or expanded recognition made sense within that framework: it gave administrators more named options when evaluating some historical responsibilities. It did not establish a timeless, universal credential list for all future Department of Defense positions.
A legacy roster may name CompTIA Security+, CySA+, CASP+ or EC-Council Certified Ethical Hacker. Those labels should be recorded exactly as the historical employee documents state, together with their issue and expiration dates. Do not relabel a certificate as a new product or qualification without a verified issuer record. In particular, the older CASP+ name is not identical to the present SecurityX CAS-005 exam branding, and the current DoD acceptance question must be resolved from the active matrix rather than from the old name alone.
The DoD’s published transition guidance explains that the earlier information-assurance program and the 8140 work-role program are not organized in the same way. Existing credentials may carry forward as specific options aligned to appropriate roles and proficiency levels; this does not create a one-to-one mapping from every historical IAT or IAM category to a current DCWF work role. An administrator should resist filling such a crosswalk by visual similarity or by matching only a certification name.
Identify the job and assigned work roles before checking credentials
A defensible qualification review begins with an authoritative position inventory. For each covered civilian, military or relevant contract position, capture the position identifier, sponsoring organization, assigned DCWF work-role code or codes, and associated proficiency level. Validate that coding against the work actually performed. A title such as “security engineer” is not specific enough to infer the entire qualification requirement, and one position can contain duties from more than one cyber work role.
Cross-check the position information against the organization’s personnel and workforce reporting systems. An individual who transfers to a different billet may require a new role-specific evaluation even if no certification has expired. Similarly, a reorganization that changes duties should trigger a review of coding rather than simply carrying forward the old 8570 category. Document who approved each role assignment and the date of that approval.
For defense contractors, the contracting officer and applicable contract clauses govern the personnel qualification obligation. DoD’s FAQ distinguishes contractor administration from qualification timelines applied to DoD civilian employees and military service members. Do not automatically copy government employee waiver or training-funding rules onto contractor personnel. Obtain the current contract interpretation from the authorized contracting or workforce authority and retain it with the compliance evidence.
Read foundational qualification options as choices, not a universal certificate quota
The active matrix identifies options for foundational qualification at the relevant DCWF role and proficiency level. Depending on the role, recognized personnel certifications, education, DoD or military training, and other documented pathways may be available. That flexibility does not mean every option is always interchangeable, nor does it permit the employer to skip resident qualifications or continuing professional development. Use the matrix version applicable to the review date and any organization-specific requirements.
Where an employee presents an old CompTIA or EC-Council credential, compare the exact issuer name and credential status with the matrix entry for their actual role. If the document uses historical branding, record the old name as evidence and confirm whether the current entry recognizes that credential; do not assume acceptance solely from a commercial certification comparison. For example, knowledge of CEH and authorized testing methods may be relevant to some duties, but the particular matrix option and role requirements remain controlling.
If the matrix does not resolve an unusual credential, training pathway or proficiency question, escalate it to the responsible Cyber Workforce Program Manager or designated qualification authority. The answer should identify the controlling document or approved determination. A verbal assurance that a credential “used to count under 8570” is insufficient evidence for a present-day qualification record.
Capture resident qualifications and ongoing development separately
DoD 8140 is more than a list of exam passes. Workforce administrators need to distinguish foundational qualifications from resident qualifications and continuing professional development. Resident qualifications are connected to actual role capability and the component’s applicable standards. A certification may help demonstrate baseline knowledge while separate workplace training, supervised experience or demonstrated tasks are still required. Combining these in one unchecked “compliant” field hides useful operational gaps.
DoD’s FAQ states that covered DoD civilian employees and military service members generally have nine months after assignment to meet foundational requirements and 12 months to meet resident requirements, with concurrent timeframes. These are not identical to the initial program transition milestones for the different workforce elements in 2025 and February 2026. For contractor personnel, consult the applicable contract and contracting authority. Organizations should also verify any updated policy, individual circumstances and authoritative exceptions before applying a deadline.
Continuing professional development should be recorded as its own obligation with the form of qualifying evidence required for the role. An issuer’s certification renewal calendar is relevant where that certification is used as a qualification option, but it should not be confused with the full workforce development program. A renewal receipt alone does not prove resident capability or that the employee has satisfied additional command-level training.
Build a qualification register that can survive turnover
A practical register should capture the position or billet identifier, assigned work-role code, proficiency level, required foundational option, accepted evidence type, credential or program name, evidence identifier, issue and expiration dates where applicable, resident requirement, continuing-development status, matrix version, reviewer and next review date. Store the underlying supporting records in accordance with the organization’s access and retention rules. The register should point to evidence, not merely contain a checked box.
The evidence review needs a clear status for each requirement: documented and verified, pending verification, missing evidence, or subject to a specific authorized exception. Keep the reason and authority for any exception. When the qualification matrix changes or an employee moves, revisit the affected rows and document the decision. Administrators should not simply overwrite last year’s interpretation; a dated record is useful when explaining why a credential was accepted under an earlier version.
The Department’s implementation documents and matrix updates should be tracked by version and effective date. That is especially important for organizations with distributed human-resources, training and cybersecurity teams. A central change record can identify which work roles were reviewed, which cases were revalidated and which unresolved issues require the cyber workforce authority’s interpretation.
Verify operational competence rather than relying on old category names
A matrix review is necessary for personnel qualification, but it does not substitute for management of operational risk. Someone assigned to defensive monitoring may need evidence that they can interpret telemetry and follow a correct escalation chain. Personnel conducting authorized vulnerability assessment should understand scope and evidentiary quality. Staff in engineering roles may need to demonstrate secure configuration decisions. Do not describe CEH, PenTest+ or Security+ as a blanket authorization for those responsibilities.
A workforce audit can sample representative work roles and trace each qualification claim to the current accepted option and its underlying record. Where a role includes incident investigation, check that training and task evidence aligns with the actual responsibilities; digital-forensics evidence handling may be relevant, but the exact qualification requirements still come from the current program. Record discrepancies as corrective actions with an owner, deadline and independent verification of closure.
This process benefits security leadership as well as compliance administrators. It reveals differences between documented eligibility and the competencies an operational team must maintain. Correcting a work-role code or completing resident training can be more important than recommending another general-purpose certification to a person who already has sufficient foundational evidence.
Handle changes, waivers and contractor issues through the correct authority
The DoD 8140 FAQ describes limited waivers for civilian employees and military members under severe operational or personnel constraints; these are not general permanent exemptions or discretionary permissions for every contractor. Workforce administrators should identify the authorized decision maker, record the exceptional circumstances and expiration date, and reassess the position before that date. Never invent an exception because an old 8570 chart is difficult to reconcile.
An updated matrix, changed work-role assignment, new contract or revised organizational requirement should trigger a controlled recheck. Keep separate fields for “policy verified,” “qualification evidence verified” and “work-ready capability assessed.” They answer different questions. If a job description still cites an IAT or IAM category, preserve it as historical source text while documenting the current interpreted requirement and the person who approved it.
Candidates evaluating a certification for their own career need a more learner-oriented decision process than this administrative control register. The accompanying defense cybersecurity certification career analysis explains how to choose study targets based on an actual vacancy, skills and accepted qualification paths. The two tasks are related but should not be collapsed into one misleading certificate checklist.
The governing control is role-specific evidence
CompTIA and EC-Council certificates remain relevant to defense cyber workforce discussions because they recognize substantive skills and because some credentials are legitimate current qualification options. Their historical addition to 8570, however, is no longer sufficient proof that any particular employee qualifies for an 8140 role. The sound process is to identify the position’s work roles, consult the current authoritative matrix, evaluate every applicable qualification component, retain dated evidence and escalate ambiguities to the correct DoD or contracting authority.
