GCIH (GIAC Certified Incident Handler)
Incident handling is the subject of GCIH: detecting, responding to, and resolving security incidents. Candidates need an understanding of common attack techniques, vectors, and tools such as Nmap, Metasploit, and Netcat. The audience is incident handlers, team leads, system administrators, and other first responders, and SANS SEC504 is the aligned course.
Exam Details
Open-book, web-based exam, proctored remotely through ProctorU or onsite at a Pearson VUE test center. It includes CyberLive hands-on questions run in virtual machines.
Price of one certification attempt with 120 days of access. A retake after a failed attempt is $899, a 45-day extension is $479, and a practice test is $399. Prices exclude sales tax.
Requirements and Renewal
Prerequisites
None. GIAC sets no prerequisites for any certification attempt but recommends a training course first.
Renewal
Earn 36 CPEs during the four-year cycle (or retake the exam) and pay the $499 maintenance fee. Additional renewals within two years of a full-price renewal cost $249.
Exam Domains
15 domains| Domain |
|---|
| Attacking Passwords |
| Detecting Evasive and Post-Exploitation Techniques |
| Detecting Exploitation and Covert Communications Tools |
| Endpoint Attack and Pivoting |
| Exploiting Insecure Web Application References |
| Incident Response and Cyber Investigation |
| Integrating LLMs with Offensive Operations |
| Malware and AI Assisted Investigations |
| Network and Log Investigations |
| Scanning and Mapping |
| Securing Credentials and Data in the Cloud |
| SMB Security |
| Understanding Passwords |
| Web Application API Attacks |
| Web Application Injection Attacks |
DoD 8140 Work Roles
6 work rolesThe DoD 8140 Qualification Matrix V2.1 lists GCIH as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Certification Lists
Tools Covered by GCIH
Nmap
Free / CommercialNetwork discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.
Metasploit Framework
Free / CommercialPenetration testing platform and exploit database used to verify security flaws, manage payloads, and assess network posture.
Related Tool Categories
Disk and memory forensics, malware sandboxes, and incident response collection platforms.
Password hash crackers, online credential brute-forcers, and authentication testing utilities.
Intercepting HTTP proxies, security assessment toolkits, and network exploitation frameworks.
Frequently Asked Questions
What does GCIH stand for?→
GCIH stands for GIAC Certified Incident Handler. GIAC itself was previously named Global Information Assurance Certification.
How much does the GCIH exam cost?→
One GCIH certification attempt costs $999. A retake is $899 and a practice test is $399.
How many questions are on the GCIH exam?→
The exam has 106 questions and a 4-hour time limit, with a passing score of 69% for versions released on or after May 10, 2025.
What happens if you fail a GIAC exam?→
Candidates can buy a retake within 30 days after the attempt deadline and must wait 30 days before sitting again. After three failed attempts the attempt ends, and a new one cannot be bought for one year.
Sources
Exam details are checked against official GIAC pages. Fees, exam versions, and renewal rules change; confirm with GIAC before registering. GCIH is a trademark of its owner. This site is not affiliated with or endorsed by GIAC.