Learn how DoD 8140 replaced DoD 8570, how to map cyber work roles to approved qualifications, and how organizations can build audit-ready workforce development programs in 2026.
This article provides general workforce-development information and is not a substitute for applicable DoD policy, component-specific guidance, or an organization's official qualification determination.
Overview
For organizations supporting the Department of Defense, defense programs, federal missions, or regulated environments, cybersecurity workforce management involves more than tracking certifications.
The DoD 8140 policy set establishes a role-based approach for managing and qualifying the DoD cyberspace workforce. The DoD Cyber Workforce Framework (DCWF) defines cyber work roles, while the qualification program addresses foundational qualifications, resident qualifications, and continuing professional development.
This creates a practical workforce-management sequence:
Work role → qualification requirements → current workforce status → gap analysis → training and experience → assessment → continuing development
For organizations, the objective is to maintain evidence that personnel are appropriately qualified for the cyber work they perform and that workforce development continues as requirements and mission environments change.
This guide covers what changed from DoD 8570, how to build a work-role-to-qualification map, what evidence organizations can retain for workforce reviews, and how hands-on cyber range exercises and cohort training can support continuous professional development.
What Did DoD 8140 Replace?
DoD 8140 replaced the previous DoD 8570.01-M Information Assurance Workforce Improvement Program approach.
The important change is not simply that one certification list replaced another.
DoD 8140 introduced a broader and more role-based workforce-management model using the DoD Cyber Workforce Framework.
The DCWF describes the work performed across the cyber workforce and organizes that work into defined work roles. The current DCWF contains seven workforce elements and 74 work roles, with each work role including a definition and representative tasks and knowledge, skills, and abilities (KSAs).
The qualification model also moves beyond a certification-only mindset.
DoDM 8140.03 describes a workforce-development and sustainment process consisting of:
- Foundational qualification requirements
- Resident qualification requirements
- Continuing professional development (CPD)
Personnel assigned to applicable cyberspace workforce positions are considered qualified after meeting both the foundational and resident qualification requirements for the applicable work role and proficiency level.
DoD 8570 vs. DoD 8140
| Area | DoD 8570 | DoD 8140 |
|---|---|---|
| Primary model | Information assurance workforce qualification | Broader cyberspace workforce management and qualification |
| Workforce structure | Organized around information assurance categories and requirements | Organized around defined DCWF work roles |
| Qualification approach | Strong emphasis on approved certification requirements | Role-based foundational and resident qualification requirements |
| Workforce development | Primarily qualification and certification focused | Includes qualification, resident development, and continuing professional development |
| Mission alignment | Focused primarily on information assurance requirements | Designed around the broader cyberspace workforce and mission requirements |
The practical implication is significant: organizations should not treat DoD 8140 as simply a new certification checklist.
The more useful question is:
Does each person have the qualifications and practical capabilities associated with the cyber work role they perform?
Understanding the DoD Cyber Workforce Framework
The DCWF provides the role structure used to describe cyber work across the Department.
The framework covers personnel who build, secure, operate, defend, and protect cyber resources, as well as personnel supporting cyber intelligence, operations, data and AI, software engineering, and related cyberspace functions.
The current workforce elements include:
- Cyberspace IT Workforce
- Cybersecurity Workforce
- Cyberspace Effects Workforce
- Intelligence Workforce (Cyberspace)
- Cyberspace Enablers
- Data/AI Workforce
- Software Engineering Workforce
Within those elements are individual work roles with defined responsibilities, tasks, and KSAs.
That makes the DCWF the starting point for workforce mapping.
The DoD 8140 Qualification Model
The qualification model can be understood as three connected layers.
Foundational Qualification
Foundational qualification establishes the baseline qualification for a work role.
DoDM 8140.03 describes foundational qualification areas that can include education, training, personnel certification, or an applicable experience qualification alternative. The exact requirements depend on the work role and applicable proficiency level.
Resident Qualification
Resident qualification addresses qualification within the operational environment.
This can include on-the-job qualification and component or environment-specific requirements.
The distinction matters because personnel can have a strong cybersecurity foundation while still needing role-specific or environment-specific qualification.
Continuing Professional Development
Qualification does not end when an employee meets the initial requirements.
DoDM 8140.03 includes continuing professional development as part of the workforce-development and sustainment process. It also requires continuous review and updating of workforce KSAs.
This creates an ongoing cycle:
Qualify → practice → assess → develop → re-assess → maintain readiness
DoD 8140 Work Role → Approved Qualification Mapping
The following table is designed as a reference asset for workforce managers. It illustrates how an organization can structure its mapping process.
The exact qualification determination should always be verified against the current DCWF work role, applicable DoD/component qualification requirements, and current authoritative guidance. The table is therefore an operational mapping template, not a substitute for an official qualification determination.
| DCWF Work Role | Work Role Code | Qualification Mapping | Practical Evidence to Track |
|---|---|---|---|
| Cyber Defense Analyst | 511 | Map the position to the applicable 511 proficiency level and its current foundational and resident qualification requirements. | Qualification record, applicable certification/education/training evidence, role-specific training, practical assessments, CPD record. |
| Cyber Defense Infrastructure Support Specialist | 521 | Map the position to the applicable 521 proficiency level and its current foundational and resident qualification requirements. | Qualification record, infrastructure/security training, practical exercises, assessment results, CPD evidence. |
| Cyber Defense Incident Responder | 531 | Map the position to the applicable 531 proficiency level and its current foundational and resident qualification requirements. | Qualification record, incident-response training, scenario results, practical exercise evidence, CPD record. |
| Authorizing Official/Designating Representative | 611 | Map the position to the applicable 611 proficiency level and its current foundational and resident qualification requirements. | Qualification record, applicable training/certification evidence, RMF-related development, role-specific assessment and CPD evidence. |
| Security Control Assessor | 612 | Map the position to the applicable 612 proficiency level and its current foundational and resident qualification requirements. | Qualification record, assessment-related training, practical assessment evidence, RMF-related development and CPD record. |
| Software Developer | 621 | Map the position to the applicable 621 proficiency level and its current foundational and resident qualification requirements. | Qualification record, secure development training, technical exercises, assessment results and CPD evidence. |
| Information Systems Security Developer | 631 | Map the position to the applicable 631 proficiency level and its current foundational and resident qualification requirements. | Qualification record, secure engineering training, practical exercises, technical assessments and CPD evidence. |
| Security Architect | 652 | Map the position to the applicable 652 proficiency level and its current foundational and resident qualification requirements. | Qualification record, architecture/security training, design exercises, assessments and CPD record. |
| Information Systems Security Manager | 722 | Map the position to the applicable 722 proficiency level and its current foundational and resident qualification requirements. | Qualification record, management/security training, leadership development, assessments and CPD evidence. |
The DCWF officially identifies work roles such as Cyber Defense Analyst (511), Cyber Defense Infrastructure Support Specialist (521), Cyber Defense Incident Responder (531), Authorizing Official/Designating Representative (611), Security Control Assessor (612), Software Developer (621), Information Systems Security Developer (631), Security Architect (652), and Information Systems Security Manager (722).
How to Use This Mapping Table
Organizations can turn the reference table into a workforce register with fields such as:
- Employee or position identifier
- DCWF work role
- Proficiency level
- Foundational qualification status
- Resident qualification status
- Required training
- Certification or education evidence
- Practical assessment evidence
- CPD activity
- Qualification date
- Next review date
- Open remediation items
This creates a much more useful workforce picture than maintaining a standalone certification spreadsheet.
DoD 8140 Audit-Readiness Checklist
DoD 8140 workforce readiness should be supported by evidence that demonstrates how positions are mapped, how qualification decisions were made, and how personnel maintain their capabilities.
The following is a practical audit-readiness checklist, not an official DoD audit checklist.
Evidence to Retain
Organizations should consider retaining evidence such as:
- Current position-to-DCWF work-role mappings
- Applicable proficiency levels
- Foundational qualification records
- Resident qualification records
- Education and training records
- Applicable certification records
- Experience-based qualification documentation where applicable
- On-the-job qualification records
- Practical exercise and assessment results
- Continuing professional development records
- Training completion records
- Remediation plans and closure evidence
- Workforce qualification reviews and approvals
The evidence should allow a reviewer to follow the chain from:
Position → Work Role → Qualification Requirement → Employee Evidence → Assessment → Continuing Development
Common Workforce Findings
Common problem areas can include:
- Employees not mapped to a current work role
- Job titles being used instead of actual work-role responsibilities
- Missing or outdated qualification records
- Foundational requirements documented without corresponding resident qualification evidence
- Training completion recorded without evidence of practical application
- Expired or incomplete certification documentation
- Missing continuing professional development records
- Training plans that do not address identified skill gaps
- Inconsistent qualification records across teams
- Remediation actions without documented closure evidence
Suggested Remediation Timeline
The remediation timeline should be based on organizational risk and applicable policy requirements rather than treated as a universal DoD deadline.
| Timeline | Recommended Action |
|---|---|
| 0–30 days | Confirm affected positions, validate DCWF mappings, identify missing qualification evidence, and assign owners. |
| 31–60 days | Complete priority training, qualification activities, documentation updates, and practical assessments. |
| 61–90 days | Close remaining gaps, verify evidence, conduct management review, and establish recurring monitoring. |
| 90+ days | Maintain continuous development, periodically review role mappings, and address new qualification or capability gaps. |
The timeline should be adjusted for mission criticality, workforce size, component-specific requirements, and the severity of each finding.
How Continuous Learning Supports DoD 8140 Readiness
Continuous professional development is an important part of the DoD 8140 qualification model.
For organizations, continuous learning should be more than an annual slide deck or a list of completed online courses.
A stronger approach combines structured learning with practical exercises.
Range Exercises
Cyber range exercises can provide controlled environments where personnel practice role-specific activities.
For example, a cyber defense analyst cohort might work through:
- Security alert investigation
- Network and host analysis
- Threat detection
- Incident triage
- Investigation and reporting
An incident-response cohort can work through simulated incident scenarios, evidence collection, containment decisions, and response coordination.
A secure-development cohort can work through application security, vulnerability analysis, remediation, and secure deployment scenarios.
The exercise record can then become part of the organization's broader training and CPD evidence where the activity is applicable and accepted by the responsible organization.
Cohort Training
Cohort-based training provides another way to make continuous learning measurable.
A recurring program can combine:
Briefing → Hands-on Exercise → Assessment → Feedback → Remediation → Reassessment
This gives workforce managers more useful evidence than course completion alone.
Building a Continuous-Learning Cycle
An organization can establish a recurring cycle such as:
| Stage | Activity | Evidence |
|---|---|---|
| Identify | Review work-role requirements and current capability gaps | Gap analysis |
| Train | Deliver role-specific instruction and hands-on learning | Training records |
| Exercise | Run realistic cyber range scenarios | Exercise completion and performance data |
| Assess | Evaluate practical performance | Assessment results |
| Remediate | Address identified capability gaps | Remediation plan and closure evidence |
| Maintain | Repeat development activities as requirements and threats evolve | CPD record |
DoDM 8140.03 explicitly includes CPD within its workforce-development and sustainment process and requires continuous review and updating of workforce KSAs.
This makes continuous learning an ongoing workforce-management activity rather than a one-time compliance exercise.
Where FusionRange Fits Into DoD 8140 Workforce Development
FusionRange can support the practical training layer of an organization's workforce-development strategy.
The objective is not to claim that a cyber range by itself establishes DoD 8140 qualification.
Instead, a cyber range can provide the controlled environment in which personnel practice and demonstrate skills relevant to their assigned work roles.
Fusion Cyber combines hands-on FusionRange environments with AI-native capabilities such as RangeSherpa and BeaconAI to support practical cybersecurity learning and workforce development.
This model can support organizations that want to connect:
Work-role mapping → targeted training → hands-on exercise → practical assessment → continuing development
For example, a workforce team can organize cohorts around specific technical responsibilities, run scenario-based exercises, record performance, identify gaps, and use subsequent training to address those gaps.
The resulting evidence can become part of the organization's broader workforce-development records when aligned with its applicable qualification and CPD processes.
How to Build a DoD 8140 Workforce Readiness Program
A practical implementation can be organized into seven steps:
- Inventory the workforce: identify cyber positions, responsibilities, personnel, and mission requirements.
- Map work roles: align positions to the applicable DCWF work roles and proficiency levels.
- Map qualifications: identify applicable foundational and resident qualification requirements.
- Assess gaps: compare current workforce evidence against role requirements.
- Train and exercise: deliver targeted training and hands-on scenarios.
- Document evidence: retain qualification, assessment, training, remediation, and CPD records.
- Maintain readiness: continuously review workforce KSAs and update development plans.
The result is a workforce program that connects compliance documentation with actual workforce capability.
Frequently Asked Questions
Common questions and detailed answers about this topic
Resources & Further Reading
Trusted references and external documentation
Author's Thoughts
DoD 8140 is not simply a new list of cybersecurity certifications.
The major shift from DoD 8570 is toward a broader, role-based approach to managing and qualifying the cyber workforce. Organizations need to understand the work people actually perform, map those responsibilities to the appropriate DCWF work roles, identify applicable qualifications, and maintain evidence that personnel remain capable of performing those roles.
That makes workforce mapping the foundation of a strong DoD 8140 readiness program.
The next step is connecting that mapping to practical development.
Hands-on range exercises, cohort training, assessments, remediation, and continuing professional development can help organizations move from a static qualification record toward an active workforce-readiness program.
Fusion Cyber supports this approach through AI-native workforce development capabilities, including FusionRange, RangeSherpa, and BeaconAI.
If your organization needs to understand where its workforce stands today, identify qualification and capability gaps, and build a practical development roadmap, request a DoD 8140 workforce readiness assessment.
This article answers:
- What did DoD 8140 replace?
- What changed from DoD 8570 to DoD 8140?
- What is the DoD Cyber Workforce Framework?
- How do you map a cyber work role to approved qualifications?
- What are foundational and resident qualifications?
- What evidence should organizations retain for DoD 8140 readiness?
- How can organizations prepare for DoD 8140 workforce reviews?
- How can range exercises support continuous professional development?
- How can cohort training support cyber workforce readiness?
- How can organizations improve DoD 8140 workforce readiness?
© 2026 Fusion Cyber. All rights reserved.
