Skip to content
CertGPS
Career path

Cybersecurity Without a Degree: What Federal Hiring Rules, DoD 8140 and ISC2 Actually Require

Where a degree is and isn't required in security: OPM's skills-based hiring rules, the DoD 8140 qualification matrix, ISC2 experience waivers, and a route around them.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

Cybersecurity Without a Degree: What Federal Hiring Rules, DoD 8140 and ISC2 Actually Require

Some of the clearest answers on degrees come from employers that publish their hiring rules. The US Office of Personnel Management (OPM) now tells federal agencies to drop unnecessary degree requirements, and its standard for IT specialists already accepts experience in place of education. Under DoD 8140, a degree is one of three ways to show foundational knowledge. A missing degree still costs you something, but mostly in experience waivers and in private employers' postings.

What the Bureau of Labor Statistics says about entrants

The Bureau of Labor Statistics (BLS) describes the usual information security analyst as someone with a bachelor's degree in a computer science field, and it says many have worked in an IT department first. It also says that "some workers enter the occupation with a high school diploma and relevant industry training and certifications." It also says many employers prefer candidates who hold a security certification.

BLS does publish educational attainment for workers aged 25 and older. Its 2023–24 table puts information security analysts at 0.9% with less than high school, 4.7% with a high school diploma and 14.0% with some college but no degree. Adding those categories gives 19.6% without a post-secondary degree; another 8.4% hold an associate's degree. These are the qualifications of existing workers, not the requirements in job advertisements. Treat each posting's wording as the rule for that job.

Federal hiring has moved to skills

Executive Order 13932, signed June 26, 2020, ordered agencies to replace degree-based hiring with skills- and competency-based hiring. The Chance to Compete Act of 2024 (Public Law 118-188) wrote technical assessments into law. And OPM's Merit Hiring Plan of May 29, 2025 lists "eliminating unnecessary degree requirements" among its four key elements. It also told agencies to stop using self-assessment questionnaires for rating and ranking by September 30, 2025, with exceptions for GS-01 through GS-04 and seasonal positions. Questionnaires can still screen eligibility and qualifications. The plan calls for at least one technical or alternative assessment before sending a list of eligible candidates to the hiring manager. The options include structured resume reviews, structured interviews and work samples.

The qualification standard for the IT Management series (2210) already allowed this. It's the federal IT series, and one of the four occupations the DoD 8140 FAQ recognizes as cyber work. It lets applicants qualify through the education section or the experience section. At the entry grades, OPM says the experience can be "paid or unpaid experience and/or completion of specific, intensive training (for example, IT certification)". Above that, what counts is specialized experience at the next lower grade, described in your resume in enough detail for a subject matter expert to rate it. In April 2026 OPM began consolidating occupational series and said it aims to "reduce unnecessary reliance on educational credentials".

DoD 8140: three ways to show knowledge

The Defense Department's qualification program covers service members, DoD civilians and contractor employees in cyber work. Its published sample matrix splits qualification into parts. The foundational part, a demonstration of knowledge, can be met by education, by training or by a personnel certification, each listed as an option at every proficiency level, with experience as a conditional alternative. On-the-job qualification is always required, and the sample matrix specifies continuous development of more than 20 hours a year or the certification requirement. The current foundational matrix, version 2.1, took effect on September 19, 2025.

For someone without a degree, the certification option is the one you control. CompTIA maps Security+ to 8140 work roles including cyber defense analyst, incident responder and system administrator, and ISC2 lists CC and SSCP as approved under DoDM 8140.03. One detail affects contractors in particular: the department's FAQ says DoD components should not pay for contractors to obtain or keep required certifications. A contractor employer may pay; check the contract and employer policy rather than assuming the department will fund your certification.

Where a missing degree costs you time

ISC2's experience rules are the clearest case. The CISSP needs five years of cumulative full-time work in two or more of its eight domains, and a degree in computer science, IT or a related field can satisfy up to one of them. So can a credential from ISC2's approved list, which includes Security+, CySA+, SSCP and CCNA. A non-graduate with Security+ can claim the same one-year reduction a graduate gets, for a $439 exam. ISC2 explicitly limits the waiver to one year; a degree and a listed credential cannot be combined for two.

The SSCP is less forgiving. It needs one year of experience, and the degree waiver applies only to a cybersecurity program or ISC2's preapproved majors, such as computer science or information technology. No certificate stands in for that year. Without it you can pass the exam and become an Associate of ISC2, with two years to earn the experience.

A route that doesn't depend on a diploma

Stage one is a certification that counts under DoD 8140. Security+ is the default because of its work role mapping. CompTIA lists the voucher at $439, and SY0-801 is expected to launch on or around November 17, 2026; English SY0-701 remains available until June 11, 2027. If you're unsure security suits you, ISC2's CC costs $199.

Stage two is a job that produces documented experience. BLS says computer support roles can be open to people with a high school diploma plus IT certifications, and our route from no experience covers that move. Registered apprenticeships are another way in; our post-bootcamp guide explains how they work. Keep a dated record of the security tasks you do, because federal resumes, ISC2 endorsements and 8140 reviews all ask for it.

Stage three is evidence a skills-based assessment can test. Write up investigations and fixes the way a work sample would be scored: the problem, what you did and the result. A lab-graded credential helps here; our self-taught guide compares them. You're ready for federal and contractor applications once you can describe a year of specialized work task by task.

Our view

For a non-graduate, the federal government and its contractors are now the most predictable employers in security, because their rules are published and the rules point to skills. We'd apply there alongside private employers rather than after them. Hold Security+ for the 8140 mapping and the CISSP waiver, and document everything. After that, experience requirements will set your pace more than the missing degree does.

Sources