New DoD 8140 Memo Puts Contractors on the Clock: What Changed and What to Do Now
If your company provides cyber support to the Department of War under any contract, a memo signed on May 27, 2026 just made your workforce qualifications a contract compliance issue, not a someday problem.
Here is what the memo says, what changed underneath it earlier this year, and the practical steps training managers and contract PMs should be taking right now.
What the Memo Actually Says
On May 27, 2026, the Department of War Chief Information Officer issued a memorandum to senior Pentagon leadership, combatant commands, and defense agency directors titled “Implementation of Department of War Cyberspace Workforce Policy Requirements for Contractors.”
The core directive is one sentence long and it has teeth: DoW Components must ensure that cyber workforce personnel, including contract support, meet the qualification requirements for their specific DCWF work roles, and must update contracts accordingly.
Translation: if your people touch DoW cyber work, their qualifications are about to be written into your contract by work role. Not by the old 8570 IAT/IAM levels. By DCWF work role and proficiency level.
How long do you have? The memo itself does not publish a hard deadline. Industry analysis, including SANS, points to an 18-month compliance window, and the memo notes that detailed implementation guidance is under development. But here is the part contractors should not miss: your real deadline is not a date on a policy calendar. It is whenever your contracting officer updates your contract to specify DCWF work roles, and the memo explicitly directs components to do exactly that. For some contracts that will happen at the next modification or recompete. For others it could be much sooner.
8570 Is Officially Dead
Two quieter changes earlier in 2026 set this memo up, and most contractors missed them:
DFARS Class Deviation 39. Pursuant to Executive Order 14192, the Under Secretary of War for Acquisition and Sustainment signed class deviation 39 in January 2026, removing references to DoD Directive 8140.01, DoD 8570.01-M, and DFARS clause 252.239-7001. The deviation took effect February 1, 2026.
DoDM 8140.03 cancels 8570.01-M. The manual that governed contractor IA certification requirements for nearly two decades is gone. If your compliance posture, your proposals, or your position descriptions still reference 8570 baseline certifications or clause 252.239-7001, they reference documents that no longer exist.
Why This Hits Contractors Harder Than Government Personnel
Government civilians newly assigned to a cyber work role get a grace period to achieve foundational qualification. Contractors do not. Under DoDM 8140.03, contract personnel must meet foundational qualification requirements at the commencement of cyberspace work. There is no ramp-up window. The person you propose on a task order needs to be qualified for their DCWF work role on day one.
That changes the math on staffing, proposals, and bench development:
- You cannot win the work first and certify people second.
- Contracting officers will increasingly specify requirements by DCWF work role and proficiency level, not legacy 8570 categories.
- A bench of people qualified across multiple work roles is now a direct competitive advantage in capture.
What Training Managers Should Do This Quarter
1. Map your people to DCWF work roles. Every person performing cyber work on a DoW contract needs an assigned work role (individuals can hold up to three). If you have not done this mapping, it is the prerequisite for everything else.
2. Run a gap assessment. For each work role, compare current certifications and training against the 8140 qualification matrix. Identify who qualifies today, who is one cert away, and who needs a development plan.
3. Audit your contract language. Anything citing 8570.01-M or DFARS 252.239-7001 is stale. Expect modifications referencing DCWF work roles and raise it with your COs before they raise it with you.
4. Get ahead of recompetes. If a recompete is coming in the next 12–18 months, assume the new solicitation specifies DCWF work roles. Qualify your incumbents now.
5. Watch for the implementation guidance. The memo states detailed implementation guidance is under development. The components that move before it drops will be compliant on day one. The ones that wait will be scrambling.
How IT Dojo Helps
IT Dojo has supported DoD components, federal agencies, and defense contractors through workforce certification mandates since the original 8570 rollout. We deliver the certification training that satisfies DoD 8140 foundational qualification requirements — including certifications like Security+, CISSP, and CISM — mapped to your team’s specific DCWF work roles, delivered on-site or live online, on your schedule.
Start with our free DoD 8140 Work Role and Certification Mapping Guide, which maps every DCWF work role to its qualifying certifications, then talk to us about closing your gaps before your contracts get updated.
Request a Quote
Need a gap assessment or a training plan for your contract team? Contact IT Dojo for a quote.
Contact Nick Webb, Director of Operations, for a no-obligation quote on any DoD 8140 certification course:
- Phone: 757-216-3656
- Email: nick@itdojo.com
- Website: itdojo.com/contact
IT Dojo, Inc. is a Virginia Beach-based training provider serving DoD components, federal agencies, and government contractors for over 20 years.