FAQs: Department of Defense (DoD) Directive 8140

The DoD Directive 8140 “Cyberspace Workforce Management,” reissues, renumbers, and cancels DoD Directive (DoDD) 8570.01 to update and expand established policies and assigned responsibilities for managing the DoD cyberspace workforce. It was officially signed August 11, 2015. DoDD 8140.01 does NOT address operational employment of the work roles. Operational employment of the cyberspace workforce will be determined by the Joint Staff, Combatant Commands, and other DoD Components to address mission requirements.

DoD 8570.01-M will remain in effect until it is cancelled formally. The DoD Directive (DoDD) 8140.01 is now the overarching governance document. DoDD 8140.01 reissued, renumbered, and canceled DoDD 8570.01 to update and expand established policies and assigned responsibilities for managing the DoD cyberspace workforce. The DoD Chief Information Officer (CIO) and other stakeholders are developing and will publish instructions and manuals to implement the policies in DoDD 8140.01. Until those policies are vetted and published, the DoD 8570.01-M policies and guidance are considered the most current. A copy of the current Manual is available on the DoD Publications website located at: https://dl.dod.cyber.mil/wp-content/uploads/cyber-workforce/pdf/unclass-dod-manual-8140_03.pdf

DoDD 8140 / 8570 provides guidance and procedures for the training, certification, and management of all government employees who conduct Information Assurance functions in assigned duty positions. These individuals are required to carry an approved certification for their particular job classification. The Directive's accompanying manual identifies the specific individual qualifications mandated by the Directive's enterprise-wide IA workforce management program. Much of the Directive addresses workforce management issues. Components must:

• Identify and document IA positions in manpower databases
• Identify and assign qualified personnel in those positions

The ultimate vision of the Directive is a sustained, professional IA workforce with the knowledge and skills to effectively prevent and respond to attacks against DoD information, information systems, and information systems infrastructures. This effort will enable DoD to put the right people with the right skills in the right position to protect DoD information systems.

The DoDM 8140.03 will be implemented in a phased approach:

• 2025 - February 15: All DoD civilian employees and military service members in DCWF work roles under the cybersecurity workforce element must be qualified in accordance with DoDM 8140.03.
  
• 2026 - February 15: All DoD civilian employees and military service members in DCWF work roles under the cyberspace IT, cyberspace effects, intelligence (cyberspace), and cyberspace enabler workforce elements must be qualified in accordance with DoDM 8140.03

DoD Directive 8140 requires:

• All personnel performing Information Assurance Technical (IAT) and IA Management (IAM) functions must be certifed.
• All personnel performing CND-SP and IASAE roles must be certifed.
• All IA jobs will be categorized as ‘Technical’ or ‘Management’ Level I, II, or III, and to be qualifed for those jobs, you must be certifed.

IAM personnel are responsible for the management of information security/IA requirements for DoD operational systems and perform the IA functions described in the DoD 8140-M. The policy defines IAT workforce members as anyone with privileged access to information system and performing IA functions.

The qualification and workforce management requirements of DoD 8140-M apply to all members of the DoD IA workforce including military, civilians, local nationals, Non-Appropriated Fund (NAF) personnel, and contractors. The requirements apply whether the duties are performed full-time, part-time, or as an embedded duty.

Certification requirements also exist for members of the workforce who perform system design functions such as System Architecture and Engineering (IASAE) and Computer Network Defense (CND) Service Providers.

DoD Components should individually budget and pay for DoD military and civilian IA Workforce members’ required certifications and include IA WIP sustainment requirements in their budget plans. The Government does not pay for contractor certifications or certification preparation training. (Reviewed October 17, 2017)

DoD 8140.03-M states six (6) months. Please refer to specific jobs identified within the manual.

Information Assurance Technical (IAT) and IA Management (IAM) personnel are strongly encouraged to complete DoD training available internally (e.g., Service Schoolhouse courses, DISA web-based training) or external training currently supported by your Component for courses with learning objectives directly aligned to the IA baseline certifications outlined in DoD 8570.01-M. Contact your Component’s IA Workforce Office of Primary Responsibility Points of Contact (OPR POC) for more information.

You are not required to take specific training to prepare for the certification test. However, you should be able to demonstrate the ability to pass the test (e.g., take and pass a “pre-test” or assessment exam). Your IAM should verify that you are prepared to take the certification exam before authorizing you to request an exam voucher. (Reviewed October 17, 2017).

DWCA stands for Defense Workforce Certification Application. This is the authoritative database of DoD Military, Civilian and Contractor personnel who hold active DoD certifications used by the DoD CIO office to validate, monitor and report on the certification status of certified IA workforce members.

The Department of Defense Workforce Certification (DWC) application has moved to milConnect. In order to access DWC, please login to milConnect portal using your CAC. Navigate to DWC by clicking the ‘Correspondence’ tab and selecting DWC (https://www.dmdc.osd.mil/milconnect).

In addition to registering your IA baseline certification in the DWCA, you should also notify your Component’s IA Workforce personnel point of contact (POC) to make certain that your certification status is properly documented in all your Component’s personnel databases of record. The Manual also requires IATs to obtain a local operating system certificate in addition to the IA baseline requirements. Your Component POC should be able to assist you in identifying and meeting any additional requirements of your Component.

You will need to maintain your certification status by completing continuous learning requirements as defined by your respective certification provider. You are encouraged to monitor current certification provider activity to see if they have imposed additional continuous learning requirements.

The Department of Defense Workforce Certification (DWC) application has moved to milConnect. In order to access DWC, please login to milConnect portal using your CAC. Navigate to DWC by clicking the ‘Correspondence’ tab and selecting DWC (https://www.dmdc.osd.mil/milconnect). You are encouraged to monitor current certification provider activity to see if they have imposed additional continuous learning requirements. (Reviewed October 17, 2017).

Since January 2011, your DoD Component has been responsible for paying your AMF. Contact your IAM or Component Office of Primary Responsible for executing the DoD 8140-M.

The DoD 8140-M does not set a limit on the number of times a person may attempt to qualify for certification. Components must support at least one retest attempt but may enforce a limit on the number of additional retests they will fund. If the individual’s Component has set a limit on the number of retest attempts, individuals may take a subsequent test at their own expense. If they qualify for certification, then they would qualify to fill an IAT or IAM position (assuming they meet the other requirements such as the background investigation, OJT, etc.).

Yes. Chapter 101 of Title 10, United States Code has been amended to permit Services to use appropriated funds to pay for commercial certifications (tests) for uniformed personnel. Whether or not the service has appropriated funding for commercial certifications is up to each component. (Reviewed October 17, 2017)

Continuing education requirements and acceptable continuous learning activities vary based on certification provider. Certification providers determine the specific training and other activities that qualify for continuous learning credit. The minimum continuous learning requirement for certifications included in DoD 8140.03-M is 40 hours annually or 120 hours over a three-year period. Contact your certification provider to find out more.

Contact an ONLC Education Advisor weekdays via chat or our toll free number below for assistance. Also, see the list of approved training classes at ONLC that are DoD 8140 Approved Baseline Certifications.