CompTIA Security+ for Veterans (and the A+ / Network+ Path)

Certifications · Updated July 2026 · 13 min read

Security+ is the credential most often named when a service member asks how to turn military IT, comms or cyber work into a civilian paycheck. It is a certification, not a licence, and no licensing law requires it. What it does have is a place in the Department of Defense cyber workforce qualification system, which means a large share of defense and contractor job postings screen for it. This guide covers what the exam is, where A+ and Network+ fit, how the current DoD 8140 framework actually works, what recertification costs, and how to get the exam funded — with the active-duty and veteran funding programs kept separate, because they are separate, and because the rules differ by service in ways that cost people money.

What Security+ is, and what it is not

CompTIA Security+ is a vendor-neutral certification. It is not a licence. No federal or state licensing law requires a person to hold it before doing security work, and nobody can be fined or prosecuted for working in security without it. That is a real difference from credentials like a CDL or an electrician's licence, where a government body sets the requirement and the work is illegal without it.

What Security+ has instead is policy weight and hiring weight — and in the DoD case, the policy weight is real. DoD Manual 8140.03 requires people in cyber-workforce-coded positions to become qualified, and the department publishes work-role qualification matrices listing approved options. CompTIA states that Security+ maps to DoD 8140 work roles including cyber defense analyst, incident responder, vulnerability analyst, security control assessor, system administrator, network specialist, systems planner, IT project manager, information security manager and secure software assessor. So for a DoD-coded billet, qualification is mandatory under DoD policy — but a certification is only one of several approved routes to it, alongside education and training. On the commercial side, Security+ functions as a resume filter: many federal contractor postings will not move an application forward without it, because the contract requires it.

The practical effect: if the target is a cleared job supporting a DoD contract, the certification is effectively mandatory because DoD policy and the contract say so, not because a licensing law does. If the target is a commercial help desk or network role, Security+ is preferred, not required, and A+ or Network+ may be the better first spend.

Current version as of July 2026 is Security+ V7, exam code SY0-701. CompTIA lists its launch as 7 November 2023 and describes retirement as "usually three years after launch (estimated 2026)" — which is now. As of this writing CompTIA has not published a successor exam code. Check the version on CompTIA's Security+ page before buying a voucher or a stack of study material, because buying the wrong edition of a book two months before a version change is a common and avoidable waste.

The A+ / Network+ / Security+ ladder — which rung is actually needed

The three certifications are designed as a sequence. A+ covers hardware, operating systems and basic support. It requires two exams: Core 1 (220-1201) and Core 2 (220-1202), both V15, both launched 25 March 2025, both a maximum of 90 questions in 90 minutes, both estimated to retire in 2028. Core 1 passes at 675 and Core 2 at 700 on a 900-point scale. Network+ (N10-009, V9) is a single exam, up to 90 questions in 90 minutes, passing at 720 on a 100-900 scale, launched 20 June 2024, estimated retirement 2027. Security+ sits on top.

CompTIA's own stated recommendation for Security+ is Network+ plus two years of experience in a security or systems administrator job role. For Network+ it recommends A+ plus 9 to 12 months of hands-on experience as a junior network administrator or network support technician. These are recommendations, not gates. Nothing blocks a candidate from sitting Security+ first, and many service members do.

For most people coming out of a military IT, comms, cyber or signals job, skipping straight to Security+ is usually the right call. Time on a help desk, running a SIPR/NIPR node, managing accounts, patching, or working a defensive cyber crew already covers much of what A+ and Network+ test. Paying for three certifications to reach the one that opens doors wastes money and — for Army Soldiers — burns a fiscal-year funding slot, because a Soldier may pursue only one Credentialing Assistance education goal per fiscal year.

A+ is worth the money in two situations. First, when the military job had little or no IT content — a truck driver or an infantryman pivoting to tech has real gaps that A+ fills. Second, when the target job is desktop support rather than security, in which case A+ is the credential the hiring manager is actually looking for. Network+ is worth it when networking fundamentals are shaky, because Security+ assumes them and does not teach them.

How DoD 8140 actually works now

The old model — a table of approved baseline certifications tied to IAT and IAM levels under 8570 — is not how the department qualifies its cyber workforce anymore. The governing issuance is DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program (February 2023), sitting under DoD Directive 8140.01, Cyberspace Workforce Management (October 2020) and DoD Instruction 8140.02 (December 2021). Anyone still describing a fixed 8570 baseline matrix is working from a superseded framework.

Under 8140, positions are coded to work roles from the DoD Cyber Workforce Framework at one of three proficiency levels: Basic, Intermediate or Advanced. A position or billet is coded to a primary work role and up to two additional work roles — at most three. If a position requires more than one work role, the incumbent must meet the qualification requirements for each. Qualification comes in two parts. Foundational qualification is common across the department and can be met through an educational degree, training or a certification — a certification is one route, not the only one. Residential qualification is set by each DoD component and is specific to that command. Foundational qualifications must be fulfilled within 9 months of assignment and residential qualifications within 12 months.

The qualification matrices are organised into four categories: Foundational Qualification Options, Foundational Qualification Alternative, Residential Qualifications, and Annual Maintenance. Proficiency levels cascade — DoD calls it a waterfall effect: an option that qualifies at Advanced also qualifies at Intermediate and Basic. Components are allowed to be more stringent than the matrix and may require a combination of education, training and certification.

There is also an experience route, the Experience Qualification Process, and it is narrower than it sounds. It lets a component validate an incumbent's on-the-job cyber experience as a conditional alternative to foundational qualification — but only for work roles in the Information Technology, Cybersecurity or Cyber Enabler workforce elements; it is not authorised for contractor personnel; and it satisfies only the foundational half. Residential qualification is still required to reach "fully qualified" status, after which 20 hours of continuous professional development annually is required to keep it. It is also deliberately temporary: use of experience as a conditional alternative is set to expire in 2027 for the Cybersecurity workforce element and in 2028 for the Information Technology and Cyber Enabler elements. Anyone sitting qualified on experience alone has a deadline. Note also that the DoD 8140 pages on the Cyber Exchange that host the authoritative work-role matrices now redirect to a DoD single-sign-on login rather than loading publicly, so the only reliable answer to "does Security+ qualify me for my specific billet" comes from a unit Cyber Workforce Program Manager, not from a training vendor's blog post.

The exam, and honest prep time

SY0-701 is a maximum of 90 questions in 90 minutes, mixing multiple choice with performance-based questions that require doing something in a simulated interface rather than picking an answer. The passing score is 750 on a scale of 100 to 900. That scale is not a percentage — 750 out of 900 does not mean 83 percent correct.

The content is split across five domains: General Security Concepts at 12 percent, Threats, Vulnerabilities and Mitigations at 22 percent, Security Architecture at 18 percent, Security Operations at 28 percent, and Security Program Management and Oversight at 20 percent. Half the exam sits in Security Operations plus Threats and Mitigations, which is the part military technical experience covers best. The weakest area for most service members is the last domain — governance, risk, third-party vendor management, audit and compliance vocabulary. That is desk work most enlisted technicians never touched.

Realistic preparation depends entirely on the starting point, and anyone quoting a single number is guessing. A 25-series Soldier, a 3D0X2, an IT rating or a 17C with a few years of real hands-on time is usually studying vocabulary and exam format rather than concepts, and needs weeks rather than months. Somebody coming from a non-technical MOS is learning the subject from scratch and should plan on a multi-month effort with a structured course, not a book alone.

Two money details are worth planning around. The performance-based questions are slow to work through inside a 90-minute clock, so practise under time. And a failed attempt normally costs a second voucher. Navy COOL states that if you fail a credential exam and want to re-take it you pay for the second try without reimbursement, with a narrow exception under which the Cyberspace Workforce may be afforded additional retakes at the Navy's expense. AF COOL is harsher still: it states that a member who fails the credential exam will be required to repay the cost. Sit the exam when practice scores are consistently comfortable, not when they are borderline.

Recertification: the three-year clock is the real cost

CompTIA certifications expire. To remain certified you must complete the Continuing Education Program requirements within three years of earning or renewing the certification. Security+ V7 requires 50 CEUs over that window; A+ requires 20. Check CompTIA's renewal page for the current Network+ total. This is where people get caught: they treat the exam as a one-time purchase, let the clock run out, and discover the credential on their resume is dead.

There are two costs, and both are required. CEUs must be earned and submitted, and a CE fee must be paid. CompTIA is explicit that paying CE fees alone will not renew a certification — you must also complete and submit CE activities to earn CEUs. CompTIA's published CE fees are charged for a three-year period, not annually: $150 for Security+, $150 for Network+, and $75 for A+.

There are two useful shortcuts. CompTIA states that renewing your highest-level certification will automatically renew lower-level certifications — so a Security+ holder who also has A+ and Network+ maintains all three by maintaining Security+. And earning other CompTIA certifications is itself a listed route to CEUs, so a higher credential such as CySA+ can do the work instead of grinding activities.

Budget for renewal before committing. Over ten years, Security+ costs the initial voucher plus roughly three renewal cycles of fees plus whatever the CEU activities cost. Service funding may cover recertification and maintenance fees while still in uniform — Army Credentialing Assistance explicitly covers recertification and maintenance fees, and AF COOL covers recertification fees for the credential it funded — but after separation that bill is personal unless an employer picks it up. Employers in defense contracting usually will, because the contract requires the employee to stay qualified.

Paying for it: Credentialing Assistance and the GI Bill are not the same thing

Credentialing Assistance is a service program for people currently serving. The GI Bill licensing and certification benefit is a VA program used mostly after service. They have different rules, different money, different application paths, and different consequences for your future education. Mixing them up is the most common mistake in this whole subject. One warning before the numbers: "Credentialing Assistance" does not mean the same thing in every service. Check your own service's COOL site rather than assuming another branch's rules apply.

Army Credentialing Assistance funds up to $2,000 per fiscal year. CA and Tuition Assistance may both be used, but the combined use cannot exceed the $4,500 fiscal-year limit, and some pilot credentials are limited to $1,000 per fiscal year for all Soldiers regardless of component. A Soldier may pursue one CA education goal per fiscal year, subject to a lifetime credential limit and available funding. CA covers training (classroom, online or hands-on), study materials, textbooks, manuals, test fees, and recertification and maintenance fees. All CA requests are submitted through ArmyIgnitED, and this is critical: the Army states plainly that it does not reimburse any credentialing-related expenses. Paying out of pocket first and asking for the money back does not work. Get the request approved before spending anything.

The other services differ, and the differences matter. AF COOL is a Total Force enlisted program covering enlisted Air Force Specialty Codes for Active Duty Air Force and Space Force, with funding not to exceed $4,500 per lifetime per member — a lifetime cap, not an annual one. It pays for the exam, books not to exceed $500, administrative and application fees, and recertification fees for that one credential. Its conditions are easy to miss: members must hold a 5-skill level in their primary AFSC, must not have an Unfavorable Information File or be on a Control Roster, may attain only one credential at a time per category, must complete the credential while on active duty status, must submit grades within 120 days of test completion or face recoupment, and will be required to repay the cost if they fail the exam. Navy COOL funds eligible credentialing exams, recertification fees and maintenance fees, must approve funding in advance in writing, and states that the Navy's Credentials Program Office does not fund training, study materials or exam preparation materials — those are the most likely out-of-pocket costs. Navy eligibility also requires the credential to map to your rating, an assigned position, documented prior experience, or a related degree. Coast Guard Credentialing Assistance runs the opposite way from the Army's: it offers up to $4,500 per fiscal year, covers exams, recertification and maintenance fees, study materials and training courses, is authorised first come, first served until the annual funding limit is exhausted, is limited to voluntary credentials, and is reimbursement-based — you pay up front and claim afterwards through the MyCG Ed portal. The Marine Corps runs its own COOL program with its own rules.

The VA route is separate, and it spends something you cannot get back. Under the GI Bill, VA pays no more than $2,000 per test, covers only tests approved for the GI Bill, and will pay for as many tests as you want as long as you have remaining entitlement and use your benefits within your time limit — including a test you failed and a retest for recertification. Using it consumes GI Bill entitlement: VA charges entitlement based on the amount it paid you back, prorated rather than a full month per test, but it is entitlement gone that is then not available for a degree. Prep courses are covered only under the Post-9/11 GI Bill (Chapter 33) and Survivors' and Dependents' Educational Assistance (Chapter 35); Montgomery GI Bill Chapters 30 and 1606 cover the test only. VA will not pay fees or costs related to getting the actual licence or certification document. And VA reimburses after the fact: you pay first, then claim. For a test fee, the form is VA Form 22-0803, Request for Reimbursement of Licensing or Certification Test Fees. For a prep course, it is a different form — VA Form 22-10272. Filing the wrong one delays the money. That reimbursement model is the opposite of how Army CA works, which is exactly why the two get confused.

How to avoid getting ripped off

This credential market attracts predatory sellers, for a simple reason: veterans and service members arrive holding government money, and the sellers know the caps. Watch for training companies that price a Security+ bootcamp at suspiciously close to a funding limit — $2,000 for Army Credentialing Assistance, $4,500 for AF COOL lifetime or Coast Guard CA per year, $2,000 for a GI Bill test payment. Pricing that tracks the benefit rather than the cost of delivery is a signal about who the product was built for.

Be sceptical of guaranteed-pass claims. No provider controls CompTIA's scoring. A guarantee is usually a promise of a free re-sit, which is worth less than it sounds and is often loaded with conditions — and it does not protect you from a service rule that makes you repay a failed exam. Be equally sceptical of week-long "accelerated" camps sold to people with no IT background. They work for experienced technicians who need exam framing. They do not turn a beginner into a passing candidate, and the failure gets blamed on the student.

Do not use exam dumps. Sites selling "real exam questions" are selling stolen content. Using them violates CompTIA's candidate agreement and puts the certification at risk of being revoked — and a revoked certification is worse than no certification when a security clearance and a background investigation are involved. It also produces people who pass an exam and then cannot do the job, which is precisely the reputation that hurts veteran candidates as a group.

Practical defence. First, price the direct route before buying anything bundled: an exam voucher plus a mainstream self-study course is the cheapest honest path, and voucher prices come straight from CompTIA's own store. Second, for Army Credentialing Assistance, work through an Army CA counsellor and an approved vendor before any money moves; for Navy COOL and AF COOL, get written authorisation before you register or schedule anything. Third, ask any provider for its refund policy in writing and what happens if the exam version changes mid-course. Fourth, remember what the certification is for — passing the test is the point only if the underlying skill is real, because the interview and the first ninety days on the job will test the skill, not the certificate.

Sources

Every figure above is drawn from these official sources. Benefit rates and thresholds change — check the current official page before you act.

• CompTIA — Security+ certification
• CompTIA — Network+ certification
• CompTIA — A+ Core 1 V15 (220-1201)
• CompTIA — A+ Core 2 V15 (220-1202)
• CompTIA — Renewing Security+ (50 CEUs)
• CompTIA — Renewing A+ (20 CEUs)
• CompTIA — Renewing Network+
• CompTIA — Continuing Education Program FAQ
• CompTIA — Continuing Education Renewal Fees
• DoD CIO Workforce Innovation Directorate — DoD 8140 Matrix & Repository SOP v1.1 (19 April 2024)
• DoD CIO Workforce Innovation Directorate — DoD 8140 Experience Qualification Process v1.1 (16 December 2024)
• Army COOL — Costs and Funding
• Army COOL — Credentialing Assistance
• Navy COOL — Costs and Funding
• Coast Guard COOL — Costs and Funding
• MyAirForceBenefits — Air Force Credentialing Opportunities On-Line (AF COOL)
• VA — Licensing and certification tests (GI Bill)