CISSP and DoD 8140: how it counts for US defence cyber roles

What DoD 8140 is

The 8140 series is the Department of Defense's policy for qualifying its cyberspace workforce: military members, civilians and contractors in cyber roles. The qualification rules sit in DoD Manual 8140.03, "Cyberspace Workforce Qualification and Management Program", issued in February 2023.

It replaced DoD 8570.01-M, the older information assurance workforce manual. Under 8570, the familiar model was a table of certification categories and levels. Under 8140, the starting point is your work role in the DoD Cyber Workforce Framework (DCWF), and certifications are one of several ways to show you are qualified for it.

How qualification works under 8140.03

Work roles

Each cyber position is coded to one or more DCWF work roles, such as a security control assessor or an information systems security manager. The work role, not your job title, decides what you need.

Proficiency levels

Each work role has up to three proficiency levels: basic, intermediate and advanced. The requirements rise with the level.

Three qualification areas

A certification such as the CISSP sits in the first area. It is not, on its own, everything a role requires.

Where the CISSP fits

What we can confirm from public sources, as of 28 October 2026:

• ISC2's CISSP page lists the credential as approved by the Department of Defense under DoDM 8140.03.
• ISC2 states that the CISSP covers 44% of the approved work roles in the DoD 8140 Cyber Workforce Qualification Provider Marketplace, and that it applies to roles in five of the seven DCWF workforce elements: IT (cyberspace), cybersecurity, cyberspace effects, cyberspace enablers and software.
• In another article, ISC2 described the CISSP as recognised across 24 work roles. These are ISC2's own figures about its own credential.

What we could not confirm: the exact list of work roles and proficiency levels where the CISSP appears. The DoD publishes that in its qualification matrices on the DoD Cyber Exchange, and when we checked, the matrix page asked for a DoD sign-in. We will not reproduce a list we could not verify, and you should not rely on a list from a training vendor either, including any you see repeated across blogs.

How to check your own role

1. Find your DCWF work role code and proficiency level. They should be in your position description or billet. Contractors should ask their contract lead.
2. Open the qualification matrix on the DoD Cyber Exchange (public.cyber.mil). Find your work role and level.
3. Read the foundational options. See whether the CISSP is listed as a personnel certification option at your level, and what the education and training alternatives are.
4. Confirm with your component or contracting officer. Components can issue their own guidance, and contracts can add requirements beyond the matrix.
5. Plan for residential qualification. Even with the right certification, you will also need the on-the-job element for your role.

If the paperwork and the matrix disagree

Position descriptions are not always updated when roles change. If the work role on your paperwork no longer matches the work you do, raise it with your supervisor or workforce manager before you choose a certification. Qualifying for the wrong work role costs months. Keep a short written record of the work role, level and qualification option you agreed on, and the date, so you can show it later if your qualification is reviewed.

Keeping the CISSP valid for 8140

A certification used for qualification needs to stay in good standing. For the CISSP that means:

• 120 CPE credits every 3 years, at least 90 in Group A.
• The annual maintenance fee of $135.

A suspended credential is not one you can present. See CPE and maintenance for the rules, and log CPEs as you go; DoD training you complete may count.

If you do not have the CISSP yet

Experience

The CISSP needs 5 years of work in at least 2 of its 8 domains, with up to 1 year waived for a qualifying degree or credential. Military cyber experience counts like any other security work if it maps to the domains. See experience requirements.

If you pass without enough experience, you become an Associate of ISC2. Check with your component whether an Associate designation satisfies your role; do not assume it does.

The exam

The exam is adaptive, 100–150 questions in 3 hours, with a passing score of 700 out of 1,000. It costs $749 in the Americas. Ask your employer, education office or contract lead whether funding is available. See the CISSP exam and what it costs.

Which certification for which role

If the matrix lists several certifications for your role, choose the one that fits your career. The CISSP is broad and management-focused. If your role is entry level, a foundational credential may be listed at your level and be quicker to earn; compare CISSP and Security+. For cloud roles, see CISSP vs CCSP.

8570 and 8140 side by side

Planning your study around a qualification requirement

If your role needs a qualification by a set date, work backwards:

1. Confirm the requirement first. Check the matrix and your component guidance before you spend months on one certification.
2. Book the exam early, then build the plan to it. A date on the calendar sharpens study. Our study plan tool builds weekly targets from the date and the hours you have.
3. Leave margin for a retake. If you do not pass, ISC2 requires a waiting period before you can sit again (30 days after a first attempt; see the retake policy).
4. Start the endorsement paperwork early. You have 9 months after passing to apply, but the credential only counts once you are certified. See endorsement.

For contractors and job seekers

Job postings for defence contracts often state a work role, a proficiency level, or a certification requirement taken from the contract. Read them closely:

• If the posting names the CISSP, you need the full credential, not only a passed exam.
• If it names a work role and level, check the matrix to see which certifications satisfy it; the CISSP may be one of several.
• If it names an older 8570 category, ask the recruiter which 8140 work role the position now maps to.

Terms you will meet

• DCWF (DoD Cyber Workforce Framework): the catalogue of cyber work roles the DoD uses to code positions.
• Work role: a defined set of cyber tasks, such as assessing controls or managing a security programme. Your position is coded to one or more.
• Proficiency level: basic, intermediate or advanced, set for your position.
• Foundational qualification: the knowledge requirement, met through education, training or a personnel certification such as the CISSP.
• Residential qualification: the on-the-job requirement, specific to your environment.
• Continuous professional development: the ongoing learning that keeps you qualified.
• Qualification matrix: the DoD's table of which options satisfy each work role and level.

How CISSP preparation helps in 8140 roles

The exam outline covers governance and risk, architecture, networks, identity, assessment, operations and software security. Those topics overlap with many cyber work roles, which helps explain why the credential is approved for so many of them. The habit the exam builds, choosing the action that best manages risk for the mission, is also what assessors and managers in those roles do every day. Our think like a manager guide covers that mindset.

Common misunderstandings

• "The CISSP satisfies every 8140 role." It does not. It is approved for many roles; you need to check yours.
• "8570 levels still apply." 8140.03 replaced 8570.01-M. Old category and level tables are history.
• "A certification is all I need." Under 8140 you also need residential qualification for your role.
• "A vendor's mapping is the same as the matrix." Only the DoD's matrix decides.

Next steps

• Check your CISSP eligibility with the eligibility checker.
• Feel the adaptive exam in the CAT simulator.
• Build a schedule around your duty roster with the study plan tool.