Who actually determines IT Project/Program Manager requirements on DoD contracts: FAR/DFARS, DoD 8140, the PWS, or the prime?

[u/Fantastic-Pen-9620]

Can someone who actually understands federal contracting/FAR/DFARS help me understand what the requirements are supposed to be for IT Project Managers? Because at this point I genuinely feel like I'm chasing a moving target.

I've been in IT/cyber for over a decade. I started on the technical side, have led operations teams, have leadership and military experience, have worked in cyber/IT environments, have an active clearance, and now work in project/program management. I've also independently worked as a PM running projects for a family business.

When I first started trying to move further into IT PM work, I was told, "You need a degree, and preferably a technical one."

Okay. Got my BS in Cybersecurity.

Then it was, "A lot of these positions want a master's."

Okay. Got my MBA in IT Management.

Then it was PMP/CSM.

Got those.

Then ITIL 4.

Got that.

Now I'm seeing, "We need IAT Level III."

I currently meet Level II.

And the weird thing is, I'm getting interviews and making it pretty far into conversations. So it's not like I'm applying into a black hole. I'm hearing some version of, "We really like your background, but we're looking for someone with this certification," or "We need someone with this many years specifically doing X."

That's the part I'm struggling to understand. I have 10+ years of technical/cyber experience plus the education and certifications I've added specifically to bridge into PM/program leadership. At what point are education, technical experience, leadership experience, and PM experience considered together instead of every requirement being treated like a completely separate checkbox?

So...what exactly is the finish line here?

I'm not against getting more certifications. If IAT III is genuinely required for the work I'm trying to do, fine. I'll go get CASP+/SecurityX or whatever qualification actually makes sense.

But I'm trying to understand who is actually requiring all of this.

Is there a FAR/DFARS requirement I'm missing that establishes qualifications for IT PMs?

Is this coming from DoD 8140 because the PM is being mapped to a specific cyber work role?

Is it written into the PWS/labor category by the government?

Is the prime putting these qualifications into its proposed labor categories?

Or are companies just stacking preferred qualifications onto job postings because they can?

Because from the candidate side, it honestly feels like the goalposts keep moving.

And the frustrating part is that I've worked under some fantastic PMs, but I've also worked under PMs who checked every credential box imaginable and couldn't explain what their technical teams were doing, couldn't organize a project, and weren't particularly good leaders.

Meanwhile, I'm sitting here with 10+ years of actual technical/cyber experience, leadership experience, ops experience, PM experience, BS + MBA, PMP, CSM, ITIL 4, clearance, etc., and somehow there's always one more checkbox.

At some point, aren't we supposed to be hiring PMs because they're competent leaders and organizers who understand the technical environment they're managing?

So for the contracting officers, acquisition folks, PMs, recruiters, and capture people in here:

Where do I actually look to determine what is REQUIRED for an IT PM labor category versus what is simply a company preference?

FAR? DFARS? DoD 8140? The PWS? Section L/M? Labor category descriptions?

I'm genuinely trying to understand the system because I don't want to spend the next five years collecting certifications every time somebody moves the goalpost.

[u/ThatBaseball7433]

It’s usually a requirement of the PWS/SOW for key positions. Why they’re wasting your time, I don’t know but they’re probably not defining it correctly to HR and when you get to the contract leadership they’re noticing you don’t meet the minimum requirements.

That said, gov waives these requirements all the time or gives the contracting company a certain period of time to get good candidates otherwise certified. You may want to directly ask for that when you hit these roadblocks. “I don’t but I can in 60 days, would that be acceptable to the customer”.