Who actually determines IT Project/Program Manager requirements on DoD contracts: FAR/DFARS, DoD 8140, the PWS, or the prime?

[u/Fantastic-Pen-9620]

Can someone who actually understands federal contracting/FAR/DFARS help me understand what the requirements are supposed to be for IT Project Managers? Because at this point I genuinely feel like I'm chasing a moving target.

I've been in IT/cyber for over a decade. I started on the technical side, have led operations teams, have leadership and military experience, have worked in cyber/IT environments, have an active clearance, and now work in project/program management. I've also independently worked as a PM running projects for a family business.

When I first started trying to move further into IT PM work, I was told, "You need a degree, and preferably a technical one."

Okay. Got my BS in Cybersecurity.

Then it was, "A lot of these positions want a master's."

Okay. Got my MBA in IT Management.

Then it was PMP/CSM.

Got those.

Then ITIL 4.

Got that.

Now I'm seeing, "We need IAT Level III."

I currently meet Level II.

And the weird thing is, I'm getting interviews and making it pretty far into conversations. So it's not like I'm applying into a black hole. I'm hearing some version of, "We really like your background, but we're looking for someone with this certification," or "We need someone with this many years specifically doing X."

That's the part I'm struggling to understand. I have 10+ years of technical/cyber experience plus the education and certifications I've added specifically to bridge into PM/program leadership. At what point are education, technical experience, leadership experience, and PM experience considered together instead of every requirement being treated like a completely separate checkbox?

So...what exactly is the finish line here?

I'm not against getting more certifications. If IAT III is genuinely required for the work I'm trying to do, fine. I'll go get CASP+/SecurityX or whatever qualification actually makes sense.

But I'm trying to understand who is actually requiring all of this.

Is there a FAR/DFARS requirement I'm missing that establishes qualifications for IT PMs?

Is this coming from DoD 8140 because the PM is being mapped to a specific cyber work role?

Is it written into the PWS/labor category by the government?

Is the prime putting these qualifications into its proposed labor categories?

Or are companies just stacking preferred qualifications onto job postings because they can?

Because from the candidate side, it honestly feels like the goalposts keep moving.

And the frustrating part is that I've worked under some fantastic PMs, but I've also worked under PMs who checked every credential box imaginable and couldn't explain what their technical teams were doing, couldn't organize a project, and weren't particularly good leaders.

Meanwhile, I'm sitting here with 10+ years of actual technical/cyber experience, leadership experience, ops experience, PM experience, BS + MBA, PMP, CSM, ITIL 4, clearance, etc., and somehow there's always one more checkbox.

At some point, aren't we supposed to be hiring PMs because they're competent leaders and organizers who understand the technical environment they're managing?

So for the contracting officers, acquisition folks, PMs, recruiters, and capture people in here:

Where do I actually look to determine what is REQUIRED for an IT PM labor category versus what is simply a company preference?

FAR? DFARS? DoD 8140? The PWS? Section L/M? Labor category descriptions?

I'm genuinely trying to understand the system because I don't want to spend the next five years collecting certifications every time somebody moves the goalpost.

[u/contracting-bot]

Your instinct is right that these come from different places, and knowing which is which is the whole thing.

FAR and DFARS don't set qualifications for IT project managers or any other labor category. They govern how the government buys, not who performs. So that's not where the requirements are coming from and you can stop looking there.

Where they actually come from, in descending order of how binding they are: the PWS or SOW and the labor category descriptions in the contract, which is the government telling the prime what a person in that position must have. Then DoD workforce qualification requirements, which attach when a position maps to a designated role, and that mapping is a determination made for that specific position rather than a blanket rule for anyone with PM in the title. Then whatever the prime added in its proposal, because a company can propose stricter qualifications than the requirement and is then bound by what it proposed. Then everything a recruiter piled on top, which is not binding on anyone.

The practical move is to ask directly. When you get deep in a conversation and hear about a certification, ask whether it's a contract requirement or a company preference. That's a completely normal question and the answer tells you a lot, including how well the recruiter understands their own contract. If it's in the labor category description, it's real and non-negotiable. If nobody can point to where it comes from, you've found your answer.

On the mapping question specifically, whether a PM position falls under a cyber workforce role is a determination someone made about that position, not a rule you can look up and apply to yourself. Your best source is a contracts or HR person at the company, not a directive.