If you're in a DoD IT or cybersecurity role — active duty, reserve, civilian, or contractor — your career is tied to a piece of paper called DoD 8140 (and for a lot of people, still 8570). The short version: you need a specific certification to do your job, sit at a specific console, or touch a specific network. And for most of those roles, CompTIA Security+ is the one that matters more than all the others combined.
This post walks through which CompTIA certs map to DoD 8140 work roles, why CompTIA Security+ for military personnel is usually the first (and sometimes only) cert you need, and how to actually earn one while you've got a day job that includes things like "field exercise" and "watch rotation."
The 8570 to 8140 Shift — What You Actually Need to Know
DoD 8140 superseded 8570.01-M years ago, but anyone who's been in the DoD space knows the transition hasn't been clean. The 8140 Manual (published in 2023) replaced the old three-category model — IAT, IAM, IASAE — with the DoD Cyber Workforce Framework, which maps certifications to specific work roles instead of broad tiers.
What this means for you in practice:
- A lot of command-level policies, SOPs, and job postings still reference 8570 categories (IAT II, IAM I, etc.). Don't be surprised when you see them.
- The approved certification lists overlap heavily. CompTIA Security+ covers the vast majority of 8570 IAT II roles and a big chunk of 8140 work roles.
- The "baseline" you need depends on your specific work role now, not just a category. Before you commit to a cert, pull up the DoD 8140 Qualification Matrix for your work role and check the foundational and residential qualifications columns.
One pattern I've seen a lot: people pick a cert based on what their buddy got three years ago, then find out their new work role requires something different. Check the matrix for your role, not somebody else's.
Why CompTIA Security+ Matters Most for Military and DoD Roles
If you read nothing else in this post, read this. Among all the CompTIA certs on the DoD approved list, Security+ isn't just "one of the options" — it's the one that pays back the most hours you put into it.
Security+ maps to more DoD work roles than any other single CompTIA credential. It's the baseline for most IAT II positions under 8570 and remains a qualifying cert for a large number of 8140 roles, especially on the defensive and analyst side. If you're in a cleared environment or working toward one, Security+ is frequently the minimum technical credential to touch the network. Not "preferred." Minimum.
Two things I'd flag that don't always show up in the job posting.
First, many contractors will hire on condition that you get Security+ within 30, 60, or 90 days of start. Walking in already certified turns a conditional offer into a straight offer — and sometimes a higher starting rate. Second, Security+ is one of the few certs where TA, COOL, and most command-level funding programs will cover the exam voucher and usually the study materials too. The out-of-pocket cost for an active duty service member should be close to zero.
For anyone trying to figure out where to start, a realistic Security+ study timeline for someone juggling operational duties is usually 6–10 weeks of steady daily study. Not two weeks of cramming. The week-by-week study plan is a decent scaffold to adapt.
Stack order matters too. Security+ is the foundation. CySA+, PenTest+, or CASP+ come after — not before, and not instead of.
The Other CompTIA Certs That Show Up on the 8140 Lists
Past Security+, the rest of the CompTIA lineup slots into more specialized work roles. Here's the honest lay of the land:
| Cert | Where it fits in DoD |
|---|---|
| A+ | Entry-level IT support and help desk. Required or preferred for IAT I equivalent roles and technician pipelines. |
| Network+ | Network operations, telecommunications, and infrastructure work. Frequently bundled with Security+ for NetOps roles. |
| CySA+ | Defensive Cyber Operations, SOC analyst, threat hunting. Strong next step after Security+ for blue team work. |
| PenTest+ | Red team, penetration testing, and offensive cyber ops. Less commonly required than defensive certs. |
| CASP+ / SecurityX | Senior technical engineer, architect-level roles, technical director positions. CompTIA renamed CASP+ to SecurityX in 2024; most DoD listings still say CASP+ and will for a while. |
A few practical notes on these.
A+ is worth more than people give it credit for if you're transitioning from a non-IT MOS into cyber. It's often the cert that gets you into an IT job on base without prior experience — don't skip it just because it sounds basic.
CySA+ vs Security+ comes up constantly. They're not the same level. CySA+ is harder, more hands-on, and more analyst-focused. Don't take it as a first cert. (Here's the longer comparison.)
CASP+ / SecurityX is genuinely hard. If your work role requires it, budget three to four months minimum, and don't assume your Security+ knowledge will carry you far. It won't.
Funding: Stop Paying Out of Pocket
One of the stranger things I see regularly is service members and DoD civilians paying for their own CompTIA vouchers. You almost certainly don't have to.
Tuition Assistance covers CompTIA exam vouchers and study materials across most branches. The specific rules vary by branch and fiscal year, but Security+ is universally covered when it's tied to a career development path. Your Education Services Officer can pull up the current policy in about five minutes.
COOL — Credentialing Opportunities On-Line, run by each service branch — covers many certs tied to your MOS, AFSC, or rate. Army COOL, Air Force COOL, Navy COOL, Marine COOL each have their own portal and rules. CompTIA certs are well-represented on all of them.
Command-level funding is the one most people miss. A lot of commands have a professional development line item that supervisors forget about until someone asks. Ask your supervisor or training NCO, and specifically ask about end-of-fiscal-year leftover funds — that's when it's easiest to get approved.
If you're a contractor and your employer is billing the government for your labor, they almost certainly have a training budget baked into the contract. Training is often billable, so it's not even coming out of their pocket. If they won't pay for Security+ when your contract requires it, that's a flag worth paying attention to.
Studying With Operational Tempo in the Way
Studying for a cert while serving has some specific realities the generic study guides don't address.
The biggest one is discontinuity. You'll have weeks where you can grind two hours a night, and weeks where a field problem, inspection cycle, or deployment spin-up takes you entirely offline. Long timelines with short daily blocks beat short timelines with long daily blocks, because you can actually keep short daily blocks going during busy weeks.
A pattern worth calling out: the people who succeed at this tend to pick a mobile-first study method — app-based practice questions on a phone, not a laptop and a textbook at a desk. You get twelve minutes in a chow line. You get twenty minutes waiting for a vehicle. The service members I've seen pass cert exams while deployed are the ones who used those windows. The ones who failed were waiting for a quiet hour that never came.
Two more things worth saying out loud.
Tell your chain of command before you're three weeks out from the test. A good NCO or supervisor will protect study time if they know it's coming. A bad one will still screw it up. But the good ones are worth talking to.
Don't take the exam within two weeks of returning from field, deployment, or a major exercise. I've watched people blow a two-month study investment because they tested while still sleep-debted and operating on autopilot. The exam charges you around $400 and a two-week eligibility reset if you fail. Waiting fourteen days is cheap in comparison.
And take a diagnostic before you start — not after two weeks of studying. Before. Most people are wrong about which domains they're weak in. The ones who assume "Domain 1, General Security Concepts, I already know this" are often the ones who eat a domain score of 60% on the real exam.
Before You Pick a Cert
A short checklist that actually helps:
- Look up your specific work role in the DoD 8140 Qualification Matrix — not the category, the role.
- Verify with your supervisor or ESO which cert your command is tracking you for. Some commands are still organizing training around 8570 categories.
- If you have a choice, and you're not already in a network or offensive role, pick Security+. It's the least likely to leave you stranded when your role or unit changes.
- Confirm your funding path (TA, COOL, command) before you pay for anything.
- Take a diagnostic before you build a study plan, so you know where you actually stand.
The bureaucratic mess around 8140 and 8570 isn't going to get simpler any time soon. The practical answer for most people in DoD IT is the same as it's been for a decade: get Security+, keep it current, and build from there depending on where your career goes.
If you want to see where your Security+ knowledge actually lands right now, take the free Security+ diagnostic test — about twenty minutes, no signup, and you'll get a domain-level breakdown of where to focus. If you're also weighing ISC2 certs (CISSP, CCSP, SSCP) for senior DoD roles, the companion post on ISC2 and DoD 8140 covers that side of the fence.