RMFInsider

As an Amazon Associate, RMF Insider earns from qualifying purchases.

If you’re trying to sort out DoD 8140 ISSO certifications and which ones actually count toward your qualification, the honest answer is that the matrix is more forgiving than a quick skim of the acronym suggests — but only once you understand how it’s structured. DoDM 8140.03, signed February 15, 2023, formally cancelled the old DoD 8570.01-M and replaced the rigid, certification-only model with a broader qualification framework built around DoD Cyber Workforce Framework (DCWF) work roles. This post walks through exactly how that structure applies to the ISSO role, which certifications qualify, and how to plan your path if you’re starting from zero.

Free download: the RMF Quick Reference. All 7 RMF steps, the key artifacts, and field-tested tips on one page. Subscribe below and it lands in your inbox, followed by one practical ISSO email a week. No spam, unsubscribe anytime.

The 8570-to-8140 Transition, Briefly

The transition from 8570 to 8140 was completed as of February 15, 2023, when DoDM 8140.03 formally cancelled 8570.01-M. If you’re still hearing people talk about “8570 baseline certs” as though that’s the current governing document, that terminology is out of date — 8140 is what’s in effect now, and it changes more than the acronym.

The biggest structural shift: 8570 tied qualification almost entirely to holding specific certifications at specific tiers. 8140 ties qualification to DCWF work roles, and certifications are one of several ways to demonstrate you meet a given work role’s requirements — alongside training, education, and in some cases direct experience, depending on how your component implements the policy locally.

The Qualification Matrix: What Version You Should Be Looking At

The current DoD 8140 qualification matrix in circulation is version 2025-09-19_DOD8140MATRIXV2.1, released in May 2026. If you’re checking your own qualifications or advising someone else, confirm you’re working from this version — matrix updates happen, and cross-referencing an outdated PDF against a certification list is a common way ISSOs end up confused about whether they’re actually compliant.

One caveat worth stating plainly: the specific DCWF work role code tied to the ISSO position isn’t something I could confirm from public DoD documentation for this post, and I’m not going to guess at a code and present it as fact. If your qualification status depends on matching to a specific work role code, pull that directly from DISA Cyber Exchange or your component’s official DCWF documentation rather than relying on a secondhand summary — including this one.

How to Actually Read the Matrix Instead of Guessing

The matrix is dense, and I’ve watched people either skim it and assume they’re covered, or open it once, get overwhelmed, and never go back. Neither approach works. The structure is organized around work roles and proficiency levels, not a flat alphabetical list of certifications, which means the same certification can satisfy different requirements depending on which role and level you’re mapping it against.

The process that actually works: identify the specific work role tied to your position description first — don’t start from “what certs do I already have” and work backward. Once you know the work role, cross-reference it against the current matrix version for the qualification options at your level, which may include certifications, but may also include training or education pathways depending on how your component has implemented 8140 locally. Skipping straight to a certification list without that first step is how people end up studying for the wrong exam.

Which DoD 8140 ISSO Certifications Actually Qualify

Here’s where the picture is clearer. ISC2 confirmed that all nine of its certifications — including CISSP and CGRC — are approved training courses under DoD 8140, and together they’re mapped to roughly 87% of DCWF work roles. Separately, CompTIA’s Security+ (SY0-701) is mapped to 20 DCWF work roles, covering categories like cyber defense analyst, incident responder, and vulnerability analyst. That Security+ mapping isn’t ISSO-specific — it’s broad DCWF coverage across multiple analyst-type roles — so don’t assume a Security+ credential alone checks every box an ISSO position might require without confirming against the current matrix for your specific role and level.

Certification	8140 Status	Where It Typically Fits an ISSO Path
CompTIA Security+ (SY0-701)	Approved; maps to 20 DCWF work roles	Common entry point — foundational, no experience requirement
ISC2 CGRC	Approved ISC2 certification under 8140	Governance/risk-focused, closely aligned to RMF-driven ISSO work
CompTIA CySA+	Widely used as a mid-tier analyst credential in 8140 planning	Bridges foundational certs to more advanced roles
ISC2 CISSP	Approved ISC2 certification under 8140	Common target for more senior ISSO and ISSO-to-ISSM progression

I’ve also written a direct comparison of CISSP vs CISM under DoD 8140 if you’re weighing those two specifically — short version, both are viable, but they’re not interchangeable in terms of typical DoD adoption.

A Realistic Path: Security+ → CySA+ or CGRC → CISSP

If you’re mapping out a multi-year certification path rather than trying to qualify for a single role right now, this is the progression I see work most consistently for people building toward ISSO and beyond:

• Security+ (SY0-701) — no experience requirement, broad DCWF coverage, the standard starting point. My 8-week Security+ study plan covers how to approach this exam from zero.
• CySA+ or CGRC — depending on whether you’re heading toward technical analyst work or governance/RMF-focused ISSO work, pick the one that matches the role you actually want next.
• CISSP — the credential most consistently associated with senior ISSO and ISSO-to-ISSM movement, gated by ISC2’s own experience requirement of five years cumulative in two or more CISSP domains (or four years with an approved waiver).

I’m working through this material daily on the job and built a 241-question practice app to drill the domains that trip people up most — I’m not going to claim I’ve passed the exam, because I haven’t; I’m a candidate working toward it like a lot of people reading this. What I can say is that studying it while actively doing ISSO work changes how the material lands, because you’re not learning abstractions, you’re mapping concepts to the RMF process you already run every day.

Non-Certification Routes: What 8140 Actually Allows

One thing that’s genuinely different under 8140 compared to the old 8570 model is that certifications aren’t presented as the only route to qualification. The framework’s premise — tying qualification to DCWF work roles rather than a fixed certification checklist — opens room for training and education pathways to count as well, depending on your component’s specific implementation.

If you’re coming into this field without prior IT or cyber experience, that structural shift matters. I break down what a realistic no-experience path into cybersecurity looks like — including how 8140 factors into federal and DoD hiring — in my 6-month plan for landing a cybersecurity job with no experience. Don’t assume a lack of prior certifications locks you out of DoD roles entirely; it usually just means a longer runway.

Building a Study Reference Library

Whichever certification you’re targeting next, a solid reference text pays off well beyond exam day — I still pull my copy of the ISC2 CISSP Official Study Guide off the shelf when I need to double-check how a control family maps to exam language versus how it’s described in NIST guidance. It’s not a substitute for hands-on RMF work, but it’s a useful anchor when the two vocabularies don’t line up cleanly.

Frequently Asked Questions

Is 8570 still in effect?

No. DoDM 8140.03, signed February 15, 2023, formally cancelled DoD 8570.01-M. The transition is complete — 8140 is the current governing manual. If a job posting or a colleague still references 8570 baseline certifications, treat that as outdated shorthand and verify the actual requirement against the current 8140 matrix rather than the old tiered cert list.

Does Security+ alone qualify me as an ISSO?

Security+ is approved under 8140 and maps to 20 DCWF work roles, but that mapping isn’t ISSO-specific. Confirm your specific role and level requirements against the current qualification matrix rather than assuming one entry-level certification covers every ISSO scenario.

Is CISSP required to become an ISSO?

Not universally — requirements vary by position, component, and level. CISSP is a commonly targeted credential for more senior ISSO work and ISSO-to-ISSM progression, and it’s one of the nine ISC2 certifications approved under 8140, but plenty of ISSO positions are filled by people without it, especially at entry level.

What happens if my certification isn’t on the current matrix?

Check whether you’re looking at the current matrix version — 2025-09-19_DOD8140MATRIXV2.1, released May 2026, is the version to confirm against. Matrix updates happen periodically, so a certification that isn’t listed in an outdated copy may already be approved, or vice versa. When in doubt, verify with your component’s workforce management office rather than relying on an older PDF.

Can training substitute for a certification under 8140?

In some cases, yes — that’s one of the structural differences from the old 8570 model. 8140 ties qualification to DCWF work roles, and depending on how your component has implemented the policy, approved training or education pathways can count alongside or instead of a standalone certification. Confirm the specific options for your work role and level against the current matrix rather than assuming a certification is the only route.

If you’re starting from outside the field entirely and want a structured route in, my Zero to Hired guide lays out the practical steps I’d take if I were starting over today.