GIAC GCIH (Certified Incident Handler) Requirements & Prerequisites
Everything you need to know before registering for the GIAC GCIH (Certified Incident Handler), eligibility, cost, format, and what to expect on exam day.
Cost
$2,499 (exam only; SANS training ~$7,000+)
Provider
GIAC / SANS Institute
Validity
4 years (renewable with CPEs)
Available
Global
Education
Check official exam requirements
Experience
3-5+ years of professional experience typically required
Specific Requirements
- GIAC does not require any certification, degree or minimum years of experience to register a GCIH attempt.
- SANS lists recommended background for SEC504: basic networking knowledge including TCP/IP and DNS, working understanding of Windows and Linux, foundational cybersecurity principles and comfort with the command line.
- Training is not mandatory. GIAC allows a standalone certification attempt without attending SEC504, though the open-book format is built around having course books to index.
- A certification attempt gives you 120 days to sit the exam, so register when you are ready to study rather than months ahead.
- You must be able to present two forms of current, original identification at check-in, and minors require GIAC's separate minor agreement.
Number of Questions
106 questions
Duration
4 hours
Question Format
Knowledge and analysis questions drawn from the 15 published exam certification objectives, CyberLive performance-based items answered inside a live virtual machine, Scenario items requiring analysis of network and log data
Passing Requirement
69% minimum, for the exam version released on or after 10 May 2025
How It Is Delivered
Proctored web-based exam, taken remotely through ProctorU or on-site at a Pearson VUE testing centre
Languages Offered
English (GIAC does not publish translated versions of the GCIH exam)
Visit the official GIAC / SANS Institute certification page
Create an account and select your exam
Choose a test center or online proctoring option
Pay the exam fee and schedule your date
- Two forms of valid ID (one government-issued with photo)
- Appointment confirmation email
- For online proctoring: webcam, microphone, clean desk, stable internet
What are the prerequisites for the GIAC GCIH (Certified Incident Handler)?
GIAC does not require any certification, degree or minimum years of experience to register a GCIH attempt.. SANS lists recommended background for SEC504: basic networking knowledge including TCP/IP and DNS, working understanding of Windows and Linux, foundational cybersecurity principles and comfort with the command line.. Training is not mandatory. GIAC allows a standalone certification attempt without attending SEC504, though the open-book format is built around having course books to index.. A certification attempt gives you 120 days to sit the exam, so register when you are ready to study rather than months ahead.. You must be able to present two forms of current, original identification at check-in, and minors require GIAC's separate minor agreement..
How much does the GIAC GCIH (Certified Incident Handler) cost?
The GIAC GCIH (Certified Incident Handler) exam costs $2,499 (exam only; SANS training ~$7,000+). This includes the exam fee only, study materials are additional.
How do I register for the GIAC GCIH (Certified Incident Handler)?
Visit the official GIAC / SANS Institute certification page → Create an account and select your exam → Choose a test center or online proctoring option → Pay the exam fee and schedule your date
What should I bring to the GIAC GCIH (Certified Incident Handler)?
Two forms of valid ID (one government-issued with photo). Appointment confirmation email. For online proctoring: webcam, microphone, clean desk, stable internet.
Ready to prepare for GIAC GCIH (Certified Incident Handler)?
Get the complete exam guide with study plan, tips, and practice questions.
View GIAC GCIH (Certified Incident Handler) Guide