You have 2–5 years in IT or security. You're generating value. Your employer knows you're competent. But your compensation doesn't reflect the market, your resume isn't clearing the filters at the employers you actually want, and you're not sure which cert to pursue next.
Certifications in cybersecurity aren't just credential signaling — they're a compensation lever, a federal hiring requirement, and an ATS keyword multiplier. Picking the wrong one wastes 6 months and $2,000. Picking the right one can move your salary $15,000–$30,000 and open doors that are structurally closed without them.
This is the full map.
Why Certifications Still Matter in 2026
Plenty of working professionals treat certs as bureaucratic checkboxes. In the government and defense contracting space, that framing gets you filtered out before a recruiter ever looks at your experience.
DoD 8570 / 8140 requirements. The Department of Defense Information Assurance (IA) workforce policy — originally DoD 8570, now transitioning to DoD 8140 (DCWF, the Defense Cyber Workforce Framework) — requires that all DoD employees and contractors performing IA functions hold specific baseline certifications. This isn't a preference. It's a contractual requirement. Many prime contractors list 8570/8140 compliance as a mandatory qualification in job postings. Without the right cert, your resume is eliminated regardless of your experience.
Clearance adjudication and GS grade linkage. Clearance adjudicators aren't evaluating certifications directly, but the positions that require high clearance levels are predominantly GS-12 and above — grades that have associated 8570/8140 IA category requirements baked into their job series (the 2210 IT Specialist series, for example). Certifications tied to those requirements become gatekeeping criteria embedded in the grade structure itself.
ATS keyword reality. Automated resume screening at Booz Allen, Leidos, SAIC, and most federal agencies scans for certification strings by name and exam code. "CISSP," "Security+," "GCIH" appear verbatim in job requirement fields. If they're not in your resume, you score zero on those criteria — even if you passed the exam three years ago but abbreviated it differently.
The ROI on the right cert isn't measured in resume aesthetics. It's measured in job offers cleared and salary tiers unlocked.
The Entry-Level Tier: CompTIA Security+, Network+, CySA+
Who starts here: IT professionals in helpdesk, sysadmin, or junior security analyst roles with 0–3 years of experience. Also veterans transitioning out of 25B, 17C, or 1B4X1 roles who need civilian credential validation.
CompTIA Security+ (SY0-701)
The baseline DoD 8570 IAT Level II certification. Mandatory for the broadest range of federal and contractor positions of any single exam in the field.
- Exam code: SY0-701
- Cost: $249
- Format: 90 questions maximum, 90 minutes, passing score 750/900
- Study time: 60–90 days for candidates with 1–2 years IT background; 30–45 days if you have operational security experience
- DoD 8570 value: IAT Level II, IAM Level I — qualifies for the majority of DoD IA technical roles
If you don't have Security+, get it first. Everything else in this roadmap assumes you have it.
CompTIA Network+ (N10-009)
Not a 8570 baseline cert itself, but foundational for anyone targeting network security roles. Many 8570-compliant employers require Network+ or demonstrated networking competency as a prerequisite before candidates are placed in IA technical roles.
- Exam code: N10-009
- Cost: $369
- Study time: 60–90 days
- Best for: Candidates planning to pursue GSEC, GCIH, or NSA CAE-aligned programs where network fundamentals are tested rigorously
CompTIA CySA+ (CS0-003)
The analytics-focused cert that bridges Security+ and senior-level certs. Validates SOC analyst and threat intelligence capabilities with more operational depth than Security+.
- Exam code: CS0-003
- Cost: $369
- Format: 85 questions, 165 minutes
- Study time: 60–90 days for active SOC analysts; 90–120 days if transitioning from non-analyst roles
- DoD 8570 value: IAT Level II, IAM Level I (with CE designation)
- Best for: Analysts in SOC environments targeting mid-level analyst or threat intelligence roles
Entry-tier salary reality: Security+ alone at 2–3 years experience ranges $65,000–$85,000 in most markets. Not the ceiling — the floor you need to clear the filter and negotiate from.
The Mid-Level Tier: CEH, SSCP, GIAC Certs
This tier is where salary deltas start becoming significant. Candidates who advance from entry-level CompTIA certs to this tier in 2–3 years typically see $15,000–$25,000 compensation increases.
CEH — Certified Ethical Hacker (312-50v13)
EC-Council's offensive security certification. High recognition among commercial employers and some DoD 8570 IA Technical / CSSP roles. Known for heavy multiple-choice exam format rather than hands-on lab assessment.
- Exam code: 312-50v13
- Cost: ~$1,199 (exam + courseware); exam-only voucher ~$500
- Study time: 60–90 days with prior penetration testing exposure
- DoD 8570 value: CSSP Analyst, CSSP Infrastructure Support
- Salary delta: $10,000–$20,000 above Security+-only profiles for offensive and hybrid security roles
- Caveat: GPEN and OSCP are more respected in pure offensive/red team contexts. CEH is strongest for DoD/contractor recognition.
SSCP — Systems Security Certified Practitioner (ISC2)
ISC2's entry-point cert, designed for practitioners who aren't yet eligible for CISSP. Shares domain overlap with CISSP and is sometimes used as an "Associate of ISC2" pathway.
- Cost: $249 (exam) + $125/year maintenance fee
- Experience required: 1 year in at least one SSCP domain
- DoD 8570 value: IAT Level II
- Best for: IT professionals targeting ISC2 credentialing trajectory with under 5 years experience; federal employees in the 2210 series pursuing structured certification path
GIAC GSEC — GIAC Security Essentials
The GIAC version of a security fundamentals cert — substantially more technical than CompTIA Security+ and more respected in technical hiring circles. Open-book, scenario-driven exam format.
- Cost: ~$2,499 (includes practice exams)
- Study time: 90–120 days; SANS SEC401 course strongly recommended
- DoD 8570 value: IAT Level II
- Salary delta: $8,000–$15,000 above Security+-only; the open-book format means employers take demonstrated technical depth more seriously
GIAC GCIH — GIAC Certified Incident Handler
The cert that matters for SOC leadership and incident response roles. Validates detection, response, and forensic triage capabilities at a working technical level.
- Cost: ~$2,499
- Study time: 90–120 days; SANS FOR508/SEC504 alignment recommended
- DoD 8570 value: IAT Level III, CSSP Incident Responder
- Salary delta: $15,000–$25,000 above Security+-only for IR-focused roles; opens senior analyst and IR team lead positions
When to pursue GIAC vs. CompTIA at this tier: If you're targeting federal employment or a clear DoD contractor track, CompTIA (CySA+, CASP+) delivers better 8570 value per dollar. If you're targeting technical cybersecurity firms, IC contractors, or private sector enterprise security teams that evaluate hands-on depth, GIAC is more differentiated.
The Senior Tier: CISSP, CISM, CASP+
Senior tier certs cross a threshold: they don't just open roles, they open salary bands that are structurally unavailable to people without them.
CISSP — Certified Information Systems Security Professional (ISC2)
The single most recognized certification in the industry for senior security roles. Required or preferred for CISO, security architect, program manager, and senior ISSO/ISSM roles at major federal agencies and defense contractors.
CISSP requirements:
- 5 years of paid, full-time work experience in at least 2 of the 8 CISSP domains
- Experience must be in information security; IT experience without security focus does not qualify
- The 8 domains (Common Body of Knowledge, 2024):
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management (IAM)
- Security Assessment and Testing
- Security Operations
- Software Development Security
- Endorsement process: After passing, you have 9 months to get endorsed by an ISC2 member in good standing who can attest to your professional experience. Your employer or a community ISC2 member can endorse you. Without endorsement, your Associate of ISC2 status doesn't advance.
Exam details:
- Cost: $749
- Format: CAT (Computerized Adaptive Testing) — 125 to 175 questions, 4 hours
- Passing score: 700/1000 (scaled)
- Study time: 4–6 months for candidates with the experience foundation; CISSP is not a cram exam
4-year shortcut: You can pass CISSP and hold Associate of ISC2 status for up to 6 years while accumulating the experience requirement. Not the fastest path, but an option if you're at 3–4 years of experience and want to start building the CISSP brand.
CISM — Certified Information Security Manager (ISACA)
The governance and management-track alternative to CISSP. Well recognized in enterprise environments, financial services, and healthcare. Valued specifically for security program management, audit, and risk roles.
- Cost: $575 (ISACA members) / $760 (non-members)
- Experience required: 5 years in information security management
- Format: 150 questions, 4 hours
- Best for: Candidates tracking toward GRC, security management, or CISO paths in commercial or regulated industries
CASP+ — CompTIA Advanced Security Practitioner (CAS-004)
CompTIA's hands-on advanced certification. Not management-focused — it's a practitioner cert aimed at senior security engineers and architects who want to stay technical while advancing in seniority.
- Exam code: CAS-004
- Cost: $512
- Format: 90 questions, 165 minutes; includes performance-based questions
- DoD 8570 value: IAT Level III, IAM Level II, IASAE Level I and II — one of the most versatile 8570 certs available
- Best for: Candidates who want senior 8570 compliance without pursuing CISSP; also DoD civilian employees and contractors in technical architecture roles
DoD 8570/8140 Matrix — Which Certs Qualify for Which IA Roles
The table below maps the primary IA workforce categories to their required baseline certifications under DoD 8570.01-M. The 8140 transition is ongoing; these baselines remain in effect for active contract requirements.
| IA Role Category | Level I | Level II | Level III |
|---|---|---|---|
| IAT (Technical) | A+ CE, Network+ CE, SSCP | Security+ CE, CySA+, SSCP, GSEC | CISA, GCIH, GCED, CISSP (or Assoc.), CASP+ CE |
| IAM (Management) | CAP, Cloud+, GSLC, Security+ CE | CASP+ CE, CISSP, CISM, GSLC | CISM, GSLC, CISSP (or Assoc.) |
| IASAE (Architect/Engineer) | CISSP, CASP+ CE, CSSLP | CISSP, CASP+ CE, CSSLP | CISSP, CSSLP |
| CSSP Analyst | CEH, CySA+, GCIA, GCIH | CEH, CySA+, GCIA, GCIH | GCFA, GREM |
| CSSP IR | CEH, CySA+, GCIH, GCFA | CEH, CySA+, GCIH, GCFA | — |
| CSSP Infrastructure Support | CEH, SSCP, CySA+, Security+ CE | Same as Level I + CISSP | — |
Key takeaway: CASP+ and CISSP are the most versatile certs for contractors needing broad 8570 coverage. CISSP satisfies IAT III, IAM II, IAM III, IASAE I, IASAE II, and IASAE III — no other single cert covers that range.
Federal/Contractor Cert Premium Table — Salary Impact by Clearance + Cert
These ranges reflect 2025–2026 market data from ISC2 Cybersecurity Workforce Study, ISACA State of Cybersecurity, and CompTIA annual salary survey, filtered for U.S. federal/contractor roles.
| Profile | Annual Salary Range |
|---|---|
| Security+ only, 2–3 yrs, no clearance | $65,000–$85,000 |
| Security+ only, 2–3 yrs, Secret | $75,000–$95,000 |
| Security+ only, 2–3 yrs, TS/SCI | $90,000–$115,000 |
| CySA+ or GCIH, 3–5 yrs, Secret | $85,000–$110,000 |
| CySA+ or GCIH, 3–5 yrs, TS/SCI | $105,000–$130,000 |
| CISSP, 5+ yrs, no clearance | $110,000–$140,000 |
| CISSP, 5+ yrs, Secret | $120,000–$155,000 |
| CISSP, 5+ yrs, TS/SCI | $140,000–$180,000 |
| CISSP, 5+ yrs, TS/SCI + CI Poly | $160,000–$200,000 |
| CISSP + CISM, 7+ yrs, TS/SCI | $170,000–$220,000 |
The clearance premium is real and additive. Moving from uncleared to TS/SCI typically adds $20,000–$40,000 to CISSP-level compensation. The CI poly premium adds another $15,000–$30,000 on top of that — because it eliminates the investigation timeline entirely and puts you in an extremely thin candidate pool.
For federal civilian employees on the GS scale: CISSP typically enables GS-13 placement (Step 1 in Washington-Baltimore-Arlington locality: $122,530 in 2025). CISSP + CISM + senior management experience supports GS-14 ($144,128) and GS-15 ($169,500) consideration.
Building a Study Plan: 90-Day Security+ and 6-Month CISSP
90-Day Security+ (SY0-701) Plan
Prerequisites assumed: 1–2 years IT experience, basic networking concepts. If you're starting from zero, add 4 weeks.
Week 1–2: Threats, Attacks, and Vulnerabilities (Domain 1)
- Complete Professor Messer SY0-701 free video course (Threats and Vulnerabilities sections)
- Darril Gibson or Mike Chapple study guide: Chapters 1–4
- Daily Anki flashcard deck for attack type definitions
- Practice questions: 25/day via PocketPrep or ExamCompass
Week 3–4: Architecture and Infrastructure (Domain 2)
- Professor Messer: Architecture and Design modules
- Lab work: Set up a pfSense firewall in a VM, configure basic firewall rules
- Chapple study guide: Chapters 5–8
- Practice questions: 30/day
Week 5–6: Implementation (Domain 3)
- Focus on PKI, wireless protocols, and identity management
- TryHackMe: Pre-Security and CompTIA pathways (free tier)
- Practice questions: 40/day; track weak areas by domain
Week 7–8: Operations and Incident Response (Domain 4)
- IR methodology, forensics basics, monitoring tools
- Professor Messer: Operations sections
- Full practice exam 1 (target 75%+); review every missed question
Week 9–10: Governance, Risk, Compliance (Domain 5)
- Policies, regulations (HIPAA, PCI-DSS, SOX, FISMA), risk frameworks
- Chapple study guide: Chapters 15–19
- Full practice exam 2 (target 80%+)
Week 11–12: Final Prep
- Two full timed mock exams per week
- Performance-based question (PBQ) drill — CompTIA sample PBQs
- Review all flagged weak domains
- Schedule and sit the exam by day 90
Cost estimate: $249 exam + ~$30–60 study materials (books + PocketPrep subscription). Total under $320.
6-Month CISSP Plan
Prerequisites: CISSP requires demonstrable experience — study before you have the experience foundation is premature. This plan assumes 4+ years in security with genuine coverage of at least 2 domains.
Month 1: Domains 1–2 (Security and Risk Management, Asset Security)
- Primary text: ISC2 Official Study Guide (Mike Chapple / David Seidl)
- Read one chapter per day; take end-of-chapter practice questions
- Create a master notes document — concepts only, no memorization
- Study time: 1–1.5 hours/day, 6 days/week
Month 2: Domains 3–4 (Architecture and Engineering, Network Security)
- These are the most technical domains for most candidates — slow down here
- Supplement with NIST SP 800-27 and NIST SP 800-14 for architecture concepts
- Cross-reference with Kelly Handerhan (Cybrary) video series for Architecture
- Weekly practice quiz: 50 questions per domain, log weak sub-topics
Month 3: Domains 5–6 (IAM, Security Assessment and Testing)
- IAM is high-weight on the exam; focus on authentication protocols, SSO, federation
- Domain 6: audit methodologies, penetration testing integration, software testing types
- Begin "11th Hour CISSP" by Eric Conrad as secondary reference
- Full domain practice test (200 questions) at end of month: target 70%+
Month 4: Domains 7–8 (Security Operations, Software Development Security)
- Domain 7: IR, DR/BCP, forensics, physical security — most candidates underweight this
- Domain 8: SDLC, DevSecOps, secure coding concepts
- Timed full-length practice exam (175 questions, 4 hours): target 75%+
- Log every missed question by domain; build targeted review list
Month 5: Weakness Remediation + Advanced Practice
- Dedicate 3 weeks to your bottom 2 performing domains
- Luke Ahmed "How to Think Like a Manager" study approach — critical for CISSP's managerial question framing
- Two full timed exams per week; review every question regardless of correct/incorrect answer
- Eric Conrad "11th Hour" cover-to-cover final read
Month 6: Final Prep + Endorsement Prep
- Final 4 weeks: 100 practice questions daily
- Work through CompTIA/ISC2 official practice tests
- Identify and contact potential ISC2 endorser (hiring manager, senior colleague, or community sponsor)
- Schedule exam for week 3 or 4 of month 6
- After passing: initiate endorsement process within 30 days
Cost estimate: $749 exam + ~$80 study guide + optional Boson ExamSim ($90). Total under $950. If you add a SANS course, budget $5,000–$7,000 — it's not required, but it accelerates candidates who struggle with self-directed study.