A certification appears on the DoD 8140 qualification matrix when two conditions are satisfied. The organization issuing it holds accreditation from the ANSI National Accreditation Board under ISO/IEC 17024, and the certification scores 70 percent or better when its objectives are mapped against the knowledge, skills, abilities, and tasks assigned to a specific DCWF work role. Miss either one and the credential stays off the list, no matter how respected it is in the commercial market.
That distinction gets missed constantly, and it costs people money. Someone buys an exam because a recruiter mentioned it, then discovers the credential was never submitted for review against their work role. The DoD is not ranking certifications by quality. It is running an accreditation check and an alignment score, and those are two mechanical tests that a certification either passes or does not. Understanding how the test works tells you more about what to buy than any list of approved credentials will.
Absence from the matrix is not a verdict on a certification. Most of the time it means nobody submitted it, or it was submitted against a work role it did not fit.
What Makes a Certification DoD Approved?
DoD Manual 8140.03 took effect February 15, 2023 and cancelled the old 8570.01-M manual. It sets accreditation requirements that differ depending on what kind of qualification you are talking about, and the three pathways are held to three different standards.
| Qualification pathway | Required accreditation | Accrediting body |
|---|---|---|
| Commercial certifications | ISO/IEC 17024 | ANAB |
| Training programs | ANSI/ASTM E2659-18, Standard Practice for Certificate Issuers | ANAB |
| Academic degree programs | ABET accreditation, or NCAE designation | ABET, or the National Security Agency |
Accreditation alone gets a provider through the door. It does not put anything on the matrix. After that comes the alignment review, where the provider maps the certification or course against the DCWF knowledge, skills, abilities, and tasks for each work role it wants to be listed under. For every work role, the offering has to reach a score of 70 percent or better to be approved for use under DoDM 8140.03. A credential can clear that bar for one work role and fall short for another, which is exactly why the matrix lists credentials role by role instead of publishing one master list of good certifications.
Providers without accreditation can still apply. The DoD does not reject them outright. Their submissions may be set aside for review until the accreditation is in hand, which in practice means a certification from an unaccredited body sits in a queue rather than getting a decision.
Why Isn’t My Certification on the DoD 8140 List?
There are four realistic explanations, and only one of them reflects badly on the credential.
The issuing body may not hold ANAB accreditation under ISO/IEC 17024. Accreditation is voluntary, it costs money, and it takes anywhere from three to twelve months depending on how prepared the application materials are. Plenty of well regarded vendor certifications have never pursued it because their commercial market does not require it. The certification may be accredited but never submitted for a particular work role, since providers nominate their own offerings and choose which roles to pursue. The certification may have been submitted and scored under 70 percent against that role’s task list, which is a statement about fit rather than rigor. Or the matrix simply has a blank cell at that proficiency level, which brings up the detail that trips up the most people.
The matrices apply a cascading effect. Education, training, and certification options aligned to a higher proficiency level also qualify at the lower proficiency levels beneath them. A blank cell does not mean nothing qualifies. It means nothing was identified specifically for that level, and options from a higher level can be applied instead. Reading a blank cell as a dead end is one of the most common mistakes people make with the matrix, and it sends them shopping for a credential they may not need.
What Does ISO/IEC 17024 Accreditation Actually Test?
This is the part almost nobody explains, probably because the organizations writing about it are usually the ones advertising their own accreditation. ISO/IEC 17024 is the international standard for bodies that certify people rather than products or management systems. It does not evaluate whether a certification covers the right material. It evaluates whether the organization behind it is built to produce a defensible exam.
Accreditation requires a certification body to demonstrate that its examination is fair, valid, and reliable based on a job analysis. That phrase carries real weight. A job analysis means the exam content traces back to documented research on what people in the role actually do, rather than to whatever the subject matter experts felt like including. The standard also requires the body to be structured in a way that assures impartiality, independence, transparency, accountability, and balanced representation of stakeholders. In plain terms, the organization writing the exam has to be separated from the organization selling the training, and the people setting the passing score cannot be the people who benefit from more candidates passing.
Accreditation runs for five years, after which the body reapplies. That five year term matters when you are reading a claim on a vendor website, because accreditation is a status that can lapse rather than a permanent badge.
How Does a Certification Get Added to the Matrix?
The DoD published an approval process for certifications and training, version 1.1, on October 31, 2023. Providers register for an 8140 provider account and submit their offerings. Before nominating anything, a provider is expected to compare the certification or training exam proficiency level against the DCWF knowledge, skills, abilities, and tasks designated for the work roles it is targeting. The submission then goes through external review, and approval is granted work role by work role.
The quarterly refresh is the practical reason to check the current matrix rather than trusting a blog post, including this one, on the specifics of which credential covers which role. For that, the work role to certification map is a better starting point, and the matrix itself is the authority.
What Changed in the 2026 Revision of ISO/IEC 17024?
ISO published a revised edition of ISO/IEC 17024 on April 1, 2026, replacing the 2012 version that had governed personnel certification for fourteen years. This is the standard sitting underneath DoD 8140 eligibility, so a change here eventually reaches every credential on the matrix.
The revision introduces definitions and requirements covering the use of artificial intelligence in certification processes, with provisions for transparency, human oversight, validation, and disclosure. It strengthens the language around impartiality, conflict of interest monitoring, and structural independence. It also restructures the document to align with the harmonized format used across the ISO/IEC 17000 family, updating terminology and clause numbering so the standard reads consistently alongside its siblings.
The AI provisions are the part worth watching if you sit exams. Remote proctoring and automated invigilation became normal between 2012 and now, and the 2012 edition had nothing to say about algorithmic bias in an exam room. Certification bodies will be working through what the new requirements demand of their proctoring vendors, and ANAB has already stood up transition training for certification body executives. None of this changes what is on the matrix today, and there is no indication that any currently listed credential is at risk. It does mean the accreditation claim on a vendor page will be pointing at a different edition of the standard over the next couple of years.
What This Means Before You Pay for an Exam
Start from the work role code and proficiency level in the position description, not from the certification. Anyone who has spent time around Fortune 500 IT shops and defense contractors has watched somebody buy the wrong exam because a job posting used legacy category language and nobody checked the underlying requirement. The credential that covers a System Administrator position does not necessarily cover a Cyber Defense Analyst position, and the matrix is organized to make that visible.
Check whether a certification body holds current ANAB accreditation before you assume a credential can ever appear on the matrix. If it does not, no amount of industry respect will get that certification listed. Then remember the cascading rule when you find a blank cell, because a higher proficiency option may already cover you. And if a credential you want is still absent, the useful question to ask the provider is whether they have submitted it for that work role, which is a question they can answer directly. People weighing options for contractor positions specifically should confirm the requirement in the contract language too, since acquisition regulations and DoD policy have not always moved on the same schedule.
Frequently Asked Questions About DoD 8140 Certification Approval
What makes a certification DoD 8140 approved?
Two things. The certifying body must hold ANAB accreditation under ISO/IEC 17024, and the certification must score 70 percent or better when mapped against the knowledge, skills, abilities, and tasks of a specific DCWF work role. Approval is granted per work role rather than as a blanket endorsement of the credential.
Why is my certification missing from the DoD 8140 qualification matrix?
Usually because the issuing body lacks ANAB accreditation, or because nobody submitted the credential for that particular work role. Providers nominate their own offerings and choose which roles to pursue, so absence often reflects a business decision rather than a quality judgment. It may also have scored below 70 percent against that role’s task list.
What does a blank cell in the qualification matrix mean?
It means no option was identified specifically for that proficiency level, not that nothing qualifies. The matrices apply a cascading effect, so education, training, and certification options aligned to a higher proficiency level also qualify at the levels below.
What is ISO/IEC 17024 accreditation?
It is the international standard for organizations that certify people rather than products. Accreditation requires a body to show its exam is fair, valid, and reliable based on a job analysis, and to be structured for impartiality, independence, transparency, accountability, and balanced stakeholder representation. ANAB grants it for five year terms.
How often is the DoD 8140 qualification matrix updated?
On a quarterly basis, so that newly approved qualification options are incorporated as they clear review. A credential absent from the matrix today can appear in a later refresh, which is why you should check the current version rather than a cached copy or a third party summary.
Does the 2026 revision of ISO/IEC 17024 affect DoD 8140 approved certifications?
Not immediately. ISO published the revised edition on April 1, 2026, replacing the 2012 version, and it adds requirements covering artificial intelligence in certification processes along with stronger impartiality provisions. Certification bodies will transition to the new edition over time, but no currently listed credential has been reported as affected.
Do training courses and degrees need accreditation too?
Yes, under different standards. Training programs need ANAB accreditation under ANSI/ASTM E2659-18, the Standard Practice for Certificate Issuers. Academic degree programs need ABET accreditation or an NCAE designation from the National Security Agency.
Primary sources: DoD Manual 8140.03, the DoD 8140 documents library, ANAB’s DoD cyber workforce qualification page, and ISO/IEC 17024.
CMO & Certification Guru | Training Camp
Mike McNelis is the CMO at Training Camp, where he combines a passion for technology with a hands-on approach to leadership. Beyond overseeing marketing strategy, Mike is actively involved in the technical side of the business — collaborating with clients, shaping learning solutions, and staying connected to the fast-changing world of IT and cybersecurity. He works closely with companies, government agencies, and individuals to help them achieve meaningful certification and workforce development goals.