8140 Manual Status: Why the Review Has Taken So Long
| it careers - Josh Burnett

8140 Manual Status: Why the Review Has Taken So Long

NOTE: This blog post will be updated monthly with status updates from the DoD Cyber Workforce Update newsletter. The latest edition of the newsletter was released in July 2020.

It's been five years since DoD Directive 8140 was signed, which means the Department of Defense has also been working on the DoDD 8140 manual for that long, too. For those uninitiated, the 8140 directive outlines the professional development, training, and position requirements for every IT professional in the Department of Defense, which is about 100,000 government employees and federal contractors. Importantly, local and state governments as well as corporations look to the training structure in the 8140 — and its predecessor directives — as the gold standard for technical workforce readiness.

As with most things, the DoD considers changes to its infrastructure carefully. The 8140 directive has three separate parts:

  • The Directive: The 8140 directive establishes policy, assigns responsibilities, and delegates authority to DoD Components to develop the instructions and manual.
  • The Instructions: The 8140 instructions implement policy, including general, overarching procedures.
  • The Manual: DoDD 8140 isn't really implemented until you have the 8140 Manual. The Manual implements the Directive and/or Instructions while identifying uniform procedures for managing or operating systems and providing administrative information.

To review, first, the DoD releases a signed policy, and then instructions. Finally, they release a manual. In 2015, the Secretary of Defense signed the five-page policy. The instructions and manual have since been forthcoming.

In a previous blog post about the differences between 8140 and 8570.01-M, we wrote that the "IT training and certification requirements for 100,000 government employees and contractors changed with a stroke of a pen." That's technically true, but as evidenced by the five years between policy and manual, the process is much more arduous.

Each word, phrase, and sentence in the 8140 manual has been reviewed and signed off on by all of the requisite offices and agencies. To make things more challenging, the DoD constrains document length. Directives can be no longer than 10 pages. Instructions shall not exceed 50 pages.  Manuals don't go past 100 pages.

Since 2019, the Office of the DoD CIO has published a monthly newsletter with updates on the process. We've compiled those updates into a chronological account of the process to fully show how the manual creation and review process took five years.

DoDD 8140 Monthly Updates: 2019 to Present

The Deputy Director of Defense initially signed DoD Directive on August 11, 2015, which set into motion an overhaul of the technical workforce at the DoD. Two years later, the DoD issued a minor revision to the document and maintained the effective date.

Since that time, DoD has published 24 monthly updates to their monthly newsletter:

January 2019. In January of 2019, the DoD published an announcement requesting an informal coordination for the draft DoD 8140 Manual. It was described as establishing responsibilities and procedures for the implementation and sustainment of the DoD Cyber Workforce Qualification and Management Program. It would also document reporting requirements for cyber personnel qualification management.

The manual was sent out for a high-level unit review with responses due back by the first of March. The goal of this was to allow substantive and critical comments regarding the content at a level where affected users could impact policy as it was being developed. A pilot program was underway to explore whether including experience as a foundational qualification area should be described in the manual.

February 2019. In February 2019, the DoD sent out the Instruction for pre-coordination. The second Directive change was announced, and specific focus areas in the Manual (including qualification matrices and the governance process) were identified.

March-April 2019. Through March and April, the DoD Chief Information Officer (CIO)'s 8140 task force worked to resolve or adopt more than 200 comments and questions from stakeholders. This was done in an attempt to provide the highest quality document for senior decision makers while ensuring that any policy was accurate and actionable at the user level.

May 2019. In May of 2019, the Cyber Workforce team coordinated with the Government Accountability Office (GAO), Inspector General (IG), White House Staff (WHS), and Emergency Services Director (ESD) to identify how the various documents should be coordinated most efficiently. This coordination led to a comprehensive set of findings from the previous informal review as well as an updated timeline on approval and coordination of the 8140 Directive, Instruction, and Manual.

June 2019. By June, the Cyber Workforce team had resolved all of the questions and inputs by concerned stakeholders, resulting in a final updated draft. They announced that pre-coordination would begin in July with the goal of publishing the Instructions in 2019. (This obviously did not happen.) They also decided upon an informal review via email followed by an in-person review after the first round of comments had been returned.

July 2019. July of 2019 saw a kick-off call between the 8140 task force and various stakeholders to discuss a Training Alignment Tasker. Functionally, the Training Alignment Tasker aligned government-sponsored training courses with the work roles outlined in the DoD Cyber Workforce Framework (DCWF). The primary purpose of the tasker was to support establishing foundational qualifications described in the draft DoD 8140 Manual. The DoD completed the internal coordination phase of the 8140 manual on July 19, 2019.

August 2019. In August of 2019, the DoD 8140 Directive entered the WHS pre-coordination phase, where it underwent a thorough editorial review in preparation for formal coordination. All stakeholder reviews were completed on the 8140 Instructions.

September 2019. The DoD Cyber Workforce followed up on the work roles outlined in the DCWF. Specifically, they identified and drafted terminal learning objectives (TLOs) for each work role. These completed TLOs provided the DoD with a joint resource to support cyber training across all services, standardizing training requirements and ensuring alignment with eventual the 8140 Directive, Instruction, and Manual. That, in turn, supported the DoD Qualification and Management Program, which uses training as one option for baseline qualification.

By the end of September, the Directive was in formal coordination at the principal level. The Cyber Workforce assured stakeholders that the content senior leaders were seeing was consistent with the version they reviewed four months earlier. The DoD 8140 Instruction was in internal coordination with the Chief Information Officer, which is responsible for the DCWF. At this point, the Manual was in its final draft.

November 2019. In November, the task force announced that they were still awaiting Directive comments from a few remaining Components but didn't identify which had yet to be received. There appeared to be some tension as the Cyber Workforce team took the opportunity of the official newsletter to remind the tardy parties that their delays rippled out to push back the publication date. "As a reminder, each delay pushes our proposed publication dates further to the right," they wrote. The 8140 Instruction began Principal-level coordination in mid-November after completing an internal CIO review.

December 2019. The last month of 2019 saw positive movement on both the Directive and Instruction. The former had entered pre-signature review, which preceded an official legal review, while the latter had moved to the DoD CIO front office for review prior to beginning formal coordination.  Stakeholder feedback was still being incorporated into the Manual's qualification matrix.

In December, the CIO was primarily focused on leveraging DoD enterprise data tools to support long-term workforce reporting and analytics. Importantly, these reporting resources would integrate 8140 Qualification and FCWAA-mandated work role codes into existing personnel and manpower management systems. The task force clarified that until that was a reality, DoDD 8570 Manual remained in effect and reiterated that Components should continue to verify their compliance using whatever tools necessary.

January 2020. The beginning of 2020 saw the 8140 Directive complete a pre-signature review and begin formal coordination for stakeholder review. Meanwhile, the draft Manual continued working its way through the final stages of informal coordination.

February 2020. In February of 2020, the Directive began a Legal Sufficiency Review (LSR) while the DoD CIO team reviewed stakeholder comments on the Instruction. The team completed the draft qualification matrix in the Manual and sent it out to stakeholders for input.

March 2020. The Directive was still in Legal Sufficiency Review in March 2020. In the March newsletter, the task force reported that three Components had not concurred with various portions of the Instruction, and the CIO team was working to resolve those. They sent out updated recommendations for concurrence. Meanwhile, the task force began incorporating stakeholder feedback into the qualification matrix, and the Cyber Workforce team was working to update the Manual accordingly.

April 2020. The Directive remained in Legal Sufficiency Review in April 2020. However, the Instruction received concurrence from one of the four components after the previous month's edits and continued through the Formal Coordination stage. After the Instruction passed, it would head into the WHS Pre-Signature Review. Finally, the Manual entered the Informal Coordination stage as the CIO worked with the components to finalize the Qualification Program.

May 2020. In May 2020, the Directive passed LSR and went to the DoD General Counsel for signature. Two more components signed off on the Instruction, leaving one holdout, which prevented the task force from sending Instruction to the White House Staff for review. Qualification Program inputs from stakeholders were finalized and the Manual underwent a final review before beginning Formal Coordination.

June 2020. In June, the Directive was still awaiting signature from General Counsel, which will be followed by a Security Review. The WHS was in the process of conducting a pre-signature review on the Instruction. The Manual had paused momentarily as the task force received Component comments.

July 2020. No update to the Manual. In July, the DoD Cyber Workforce update highlighted the DCWF tool.

Where is the 8140 Manual Now?

August 2020. After coordinating comments and updating the manual, the task force will send a draft of the Manual to White House Staff for review. A draft of the 8140 manual will simultaneously be sent to the DoD CIO Office for further coordination.



Ultimate Security Cert Guide

A 62-page guide to every Palo Alto, Offensive Security, (ISC)2, Check Point, CompTIA, and Cisco certification, and how they fit into your career.

I have read and understood the privacy policy, and am able to consent to it.