Overview
Understand DoD IAT Levels I, II, and III — what each level means and which baseline certifications qualify personnel for information assurance technical roles.
On this page · 7 sections
If you work in DoD information assurance, the "IAT levels" define much of your certification path. Understanding what each level means — and which certifications qualify you — is essential for staying compliant and advancing. Here's a clear breakdown.
What IAT means
IAT stands for Information Assurance Technical — the technical workforce category for personnel who operate and maintain the security of DoD information systems. (It sits alongside IAM, the management category, and IASAE, the architecture and engineering category.) Within IAT, roles are organized into three levels of increasing responsibility and environment complexity.
These categories originated under DoD 8570 and remain widely used reference points as the workforce operates under DoD 8140. The core idea: your role and its environment determine your level, and your level determines which certifications qualify you.
IAT Level I
Who it's for: Personnel working on computing environments — typically at the entry technical level, supporting and maintaining systems in a smaller or more contained environment.
Common qualifying certifications have historically included foundational credentials such as CompTIA A+ and CompTIA Network+, among others approved for the level. Level I establishes that you have the baseline technical competence to work securely on DoD systems.
IAT Level II
Who it's for: Personnel working in network environments with broader responsibility — the level a large share of DoD technical practitioners occupy.
The signature certification here is CompTIA Security+, one of the most widely held qualifying certifications across the DoD. Other credentials (such as certain CySA+ and vendor security certifications) also map to Level II depending on the approved list. Level II is the workhorse tier, and Security+ is the certification most people associate with DoD cyber qualification.
IAT Level III
Who it's for: Personnel working in enclave or advanced environments with the highest technical responsibility.
Qualifying certifications are more advanced, historically including credentials such as CASP+ (SecurityX), CISSP, and similar higher-level certifications. Level III reflects senior technical expertise and the ability to secure complex, high-stakes environments.
How to know your level
Your IAT level is determined by your assigned role and the environment you work in, as defined by your command or contract — not by personal choice. If you're unsure, your security manager or contract requirements will specify the level (and therefore the certifications) your position requires.
Planning your certification path
A practical progression for many IAT professionals mirrors the levels:
- Foundational certs (A+, Network+) — qualify for Level I and build fundamentals.
- Security+ — qualify for the common Level II roles.
- Advanced certs (CASP+, CISSP) — qualify for Level III and senior responsibility.
This ladder also happens to be a strong general cybersecurity career path, so meeting DoD requirements and advancing your career often align neatly.
Keep it current and confirm specifics
Approved certification lists and requirements are updated over time, and implementation varies by component and contract. Always confirm the current approved certifications for your specific level and role, and keep your certifications renewed — a lapsed credential doesn't qualify you.
Understanding the IAT levels turns a confusing compliance requirement into a clear roadmap: identify your level, earn the qualifying certification, and advance as your responsibilities grow.
Get your team IAT-qualified with Force7 — explore government & military training or request a quote.