DoD 8140 workforce readiness. ISACA-accredited training.
Built for
Build a qualified cyber workforce for U.S. defense contracts. Start with DCWF work-role mapping, then choose live CISA and CISM cohorts or other ISACA training on request, with official courseware and an APMG-accredited instructor.
DoD 8140 is a separate workforce program; the July CMMC Phase II suspension does not suspend it. Qualification depends on work role, proficiency and contract requirements. Map your team.
The workforce mission continues.
The July 13 CMMC notice suspends Phase II implementation. It does not suspend the separate DoD 8140 workforce qualification program. Plan training around your coded work roles and contract requirements.
CISA and CISM are starting points, not the whole catalog. Ask VIS about CRISC, CGEIT, CDPSE, CCOA, CCAK, COBIT 2019, AAIA and AAISM for your team. Course selection follows the role; not every course is an approved qualification for every role.
Start with your people and positions
- Map positions to DCWF work roles and proficiency levels.
- Review accepted qualifications and component-specific requirements.
- Choose training and retain qualification and development records.
Credentialed people are a cyber risk control
An understaffed security team or a missing skill is a risk, the same as a missing patch. CISA builds the audit judgment that tests whether controls really work. CISM builds the management discipline that runs the security program and the incident response.
of cybersecurity teams are understaffed.
of organizations have unfilled cybersecurity positions.
of enterprises train non-security staff into security roles, down from 41% a year earlier.
Source: ISACA, State of Cybersecurity 2025 press release, 29 September 2025. Read how leaders use training to cut cyber risk.
Two ISACA certifications, front and center
Both courses run as small live cohorts in the evening, Eastern time, with every session recorded. One price list for both.
CISA training
For IT auditors, internal audit, compliance staff and control assessors who sign off on evidence.
- All five CISA domains, weighted to ISACA's exam content outline
- Qualifies for DCWF work role 612, Security Control Assessor
- Official ISACA Training Kit with every seat
- Next cohort
- Dates announced soon
- Sessions
- 5:00–7:30 PM Eastern, live online, recorded
- Price
- $1,199 training, or $1,749 with the ISACA exam voucher
CISM training
For security managers, ISSMs, CISOs and vCISOs who run the program and answer for incidents.
- All four CISM domains, weighted to ISACA's exam content outline
- Qualifies for DCWF work role 722, Information Systems Security Manager
- Official ISACA Training Kit with every seat
- Next cohort
- Dates announced soon
- Sessions
- 5:00–7:30 PM Eastern, live online, recorded
- Price
- $1,199 training, or $1,749 with the ISACA exam voucher
Not sure which comes first? Read CISA vs CISM, or see the full cohort schedule and prices.
Do the work. If you don't pass, we pay the retake fee.
Pass Assurance is our share of the risk. It is not a promise that you will pass: it is a promise that if you follow the study plan and the exam still goes against you, the retake costs you nothing.
- Attend at least 90% of live sessions, or watch any missed session's recording within 7 days.
- Complete every assignment and both full-length practice exams.
- Score at least 75% on the final practice exam before you book.
- Sit the exam within 90 days of the last session, and send us your score report within 14 days of the result.
What we pay
Your ISACA exam registration fee for one retake of the course's own exam: currently US$575 for ISACA members and US$760 for non-members.
One funded retake per student. ISACA sets its fees and retake rules; figures checked 4 November 2026.
CISA and CISM qualify your people for DoD 8140 work roles
ISACA's CISA and CISM became approved DoD 8140 qualifications in May 2024. Under DoD Manual 8140.03 each cyber position is coded to a DCWF work role and proficiency level, and CISA and CISM are listed options for roles such as 612 and 722.
| DCWF work role | CISA | CISM |
|---|---|---|
| 722 Information Systems Security Manager | — | IntermediateAdvanced |
| 612 Security Control Assessor | IntermediateAdvanced | Advanced |
CISM is also listed for six more work roles. Your contract and position coding decide what applies; see the full table and sources.
CISA & CISM for DoD 8140 Workforce Readiness Assessment
Train your team, fast
Private CISA and CISM cohorts for one organization, on your schedule, with purchase-order invoicing and the completion and CPE records your contracting officer or prime will ask for.
- RequestTell us the certification, headcount and dates.
- Scoping callWithin 2 business days.
- Syllabus & scheduleWithin 5 business days.
- KickoffWithin 15 business days.
Other ISACA certifications, when you need them
CISA and CISM run on a public schedule. Every other ISACA credential is delivered on request: as a private cohort for your team, or as a public cohort once enough people sign up.
See the on-request catalog- CRISC: risk and information systems control
- CGEIT: governance of enterprise IT
- CDPSE: data privacy solutions engineering
- CCOA: cybersecurity operations analyst
- CCAK: cloud auditing knowledge
- COBIT 2019
- AAIA: advanced in AI audit
- AAISM: advanced in AI security management
VIS also runs its own career-track exam prep for CompTIA and ISC2 certifications. That prep is built by VIS; it is not official courseware from those organizations.
We build compliance into your environment — not onto paper.
NIST 800-171 Implementation
Implement the applicable NIST SP 800-171 Rev. 2 requirements, protect CUI and maintain evidence for your self-assessment. Keep CMMC as a long-term readiness goal.
Build your security baseline →SPRS Score Defense
Your self-assessment should match reality. Validate each scored requirement against technical evidence and remediate gaps to help mitigate False Claims Act risk.
Review your score and evidence →Peripolos
Brilliant at the Basics for defense suppliers, starting with a free First Article Check against CISA's Known Exploited Vulnerabilities catalog.
Peripolos packages →FedRAMP 20x
Readiness and Key Security Indicator engineering for cloud service providers, with VIS as an advisor, not an assessor.
FedRAMP 20x readiness →Your contract is the starting point for 2027 planning.
An election result does not amend an existing contract. Where DFARS 252.204-7012 applies, covered defense information still needs safeguards. The July Phase II suspension expressly preserves those obligations.
Before a 2027 option, renewal or new bid, review your actual clauses, current assessment records and prime-contractor flowdowns. Eligibility depends on the solicitation and contract; there is no universal 2027 renewal deadline.
Read the 2027 planning briefFalse Claims Act risk mitigation starts with evidence.
Knowingly misrepresenting cybersecurity practices can create civil False Claims Act exposure. VIS engineers the controls, validates scoring evidence and documents gaps so your self-assessment reflects the environment you operate.
Technical substantiation supports your compliance and counsel review; it does not provide legal immunity or replace legal advice.
Reviewed November 11, 2026. Sources: July 13 suspension notice; DFARS Part 204; DOJ Cyber Fraud.
CISA, CISM, DoD 8140 & VIS Questions
Is VIS an ISACA Accredited Training Organization?
Yes. Virtual Infrastructure Services LLC (VIS) is an ISACA Accredited Training Organization in Kendall Park, New Jersey. Its CISA and CISM courses are taught live online and built on ISACA's official training materials.
Should I take CISA or CISM first?
Take CISA first if your work is auditing or assessing controls and evidence. Take CISM first if you manage a security program, a team or incident response. Many security leaders hold both; the order follows the job you do now.
Is CISM approved for DoD 8140?
Yes. ISACA announced in May 2024 that CISA and CISM are approved DoD 8140 qualifications. CISM is listed for work role 722, Information Systems Security Manager, at the Intermediate and Advanced levels, and CISA for work role 612, Security Control Assessor, at the Intermediate and Advanced levels.
How much does CISA or CISM training cost at VIS?
A seat costs $1,199 for live training with the official ISACA Training Kit, or $1,749 with the ISACA exam voucher included. Teams of three or more can ask for group pricing and a purchase-order invoice.
What happens if I fail the CISA or CISM exam?
ISACA lets you retake the exam, and each attempt costs the full registration fee. With Pass Assurance, if you met the study-plan conditions and did not pass on your first attempt, VIS pays the fee for one retake.
How fast can you train our team?
For a private cohort we aim to hold a scoping call within 2 business days, send a syllabus and schedule within 5 business days, and start within 15 business days of your request.
Does VIS still help with CMMC?
Yes. VIS leads with NIST SP 800-171 implementation and evidence-backed SPRS score defense today, while maintaining long-term CMMC readiness and optional C3PAO preparation. The July 13, 2026 Phase II suspension leaves Phase I self-assessments and applicable DFARS safeguards in place. Review your specific contract requirements.
What is Peripolos?
Peripolos is VIS's product and service line for the Brilliant at the Basics practices, starting with a free First Article Check against CISA's Known Exploited Vulnerabilities catalog.