GIAC GCIH Guide: Exam, Requirements and Preparation

The GIAC Certified Incident Handler (GCIH) is one of the most widely requested incident response credentials, yet many candidates prepare for an attack-tools course and then meet an exam about detecting, handling and defending. This guide sets out what GIAC publishes about GCIH: who it is for, the exam format, the 15 certification objectives, delivery and open book rules, prices and the four-year renewal cycle. It adds a preparation plan, readiness measures, common mistakes and where GCIH sits on a defensive career path. It is written for SOC analysts, incident responders, system administrators who act as first responders, and managers deciding whether to fund the certification. Facts are as published on giac.org, checked October 2026; GIAC states that prices can change and that the details for your own attempt are in your GIAC account, so confirm there before you register.

Key takeaways

• It is a handling certification, not a hacking one. GIAC says GCIH validates the ability to detect, respond to and resolve security incidents, which requires understanding common attack techniques, vectors and tools.
• The exam is long. One proctored exam of 106 questions in 4 hours, with a minimum passing score of 69% for exam versions released on or after 10 May 2025.
• The objectives have moved with the field. The 15 objectives now include LLM attacks and defences, AI assisted investigations, cloud credentials and web API abuse alongside the classic process, network and password material.
• Open book rewards an index. Hardcopy books and notes are allowed, electronics are not, and answered questions cannot be revisited.
• It costs $999 an attempt and renews every four years. Renewal needs 36 CPEs and a $499 fee, or renewal by exam.

Who the certification is for

GIAC classes GCIH as a practitioner certification. Its stated audience is incident handlers, incident handling team leads, system administrators, security practitioners, security architects and any security staff who act as first responders. The areas covered, in GIAC's words, are incident handling and computer crime investigation, computer and network hacker exploits, and hacker tools such as Nmap, Metasploit and Netcat. The point of the tool content is recognition: a handler who knows what scanning, exploitation frameworks and covert channels look like can spot and contain them faster.

• Strong fit: SOC analysts in tier 2 or 3, members of a CSIRT or incident response retainer team, and administrators who are first on scene when an alert fires. See the SOC Analyst Career Guide.
• Strong fit for employers: GIAC states it is an accredited ISO/IEC 17024 personnel certification body through ANAB, and the GCIH page shows DoD 8140, DORA, NIS2 and UK CSC badges. The page does not list specific DoD 8140 work roles, so confirm the mapping with the hiring or contracting organisation.
• Weaker fit: people with no operating system or networking background, who usually get more from a foundation credential first (see the GIAC GSEC Guide), and specialists who need deep host forensics, for whom the GIAC GCFA Guide is the closer match.

Exam format and domains

Format

Four hours for 106 questions is about 2 minutes 15 seconds each before breaks and hands-on items. Because answered questions are locked, the habit to build is a confident first answer, with skips held back for questions that need a long lookup in your books.

The 15 certification objectives, grouped

GIAC lists the objectives alphabetically and without weightings. The grouping below is ours, to make revision manageable; objective names are GIAC's.

Three of the 15 objectives are about passwords and credentials, and three are about web applications and APIs. Candidates from a network or SOC background often underestimate the web content; candidates from a development background often underestimate SMB, pivoting and log analysis.

Where identity fits: the credential objectives, cloud credential storage and API access abuse are identity problems. In real incidents, the handler's containment step often means rotating service account passwords, API keys and cloud access keys, not only resetting users. See the Identity Incident Response Playbook and the Credential Dumping Guide.

Prerequisites and experience

The GCIH page states no formal prerequisite and no minimum experience. GIAC says candidates can prepare through training, practical work experience, college courses or self-paced study. In practice the exam assumes you are already comfortable with:

• Networking: TCP/IP, common ports and services, and reading packet captures and firewall or proxy logs.
• Operating systems: the Windows and Linux command lines, Windows accounts and SMB shares, and where each platform logs authentication and process activity.
• Web basics: HTTP requests and responses, how a web application references objects, and how REST APIs authenticate.
• Training: GIAC links SANS Hacker Techniques and Incident Handling training in live and OnDemand formats; the justification letter on the page refers to SEC504. Training is not mandatory, but its books are the usual basis for the open book index.

Preparation plan

Treat preparation as two jobs: learning the material, and building a fast route into your printed books.

1. Plan the window (before activation): the attempt must be completed within 120 days of activation. GIAC recommends scheduling the proctored appointment at least one month ahead; slots are first come, first served.
2. Baseline (week 1): score yourself red, amber or green on each of the 15 objectives. Mark the newer AI and cloud credential objectives separately, since older study notes and second-hand books may not cover them.
3. Study by incident phase (weeks 2 to 6): work through the material in the order a handler meets it: preparation and process, scanning, initial access, credential attacks, lateral movement and pivoting, persistence and evasion, then investigation and recovery. Tie each tool you study to the log entries or network traffic it leaves.
4. Labs (alongside study): run every lab in an isolated environment you are authorised to use. Practise reading the output of scanners and the traces of exploitation tools from the defender's side: logs, process trees, SMB sessions and outbound connections. The CyberLive format means hands-on familiarity matters.
5. Build the index (alongside study): record each tool, option, port, event type and concept with book and page number, sorted alphabetically. Write it yourself; indexing is revision.
6. First practice exam (week 7): GIAC practice exams simulate the real test engine; the bank is limited, so questions can repeat, and they never contain real exam questions. Sit it under real conditions with only printed materials and log each slow lookup.
7. Fix gaps (weeks 8 to 9): restudy objectives where you guessed, improve index entries that failed, and drill answering without looking things up.
8. Second practice exam and sit (weeks 10 to 11): sit the second practice exam about a week before the real one. For Pearson VUE, bring two original, current IDs whose names match your appointment and arrive 15 minutes early; for ProctorU, check the technical requirements GIAC links.

If you fail: GIAC lists a retake at $899. The pages checked did not state a waiting period before a retake, so check your GIAC account. GIAC also publishes a procedure for contesting exam results.

Small vs large organisations: in a small team, the GCIH holder may be the whole incident response capability, so pair the certification with a written plan (see the Incident Response Plan Template). Large SOCs often make GCIH a tier 2 expectation; budget for the four-year renewal from the start and use the discounted renewal rate for staff holding several GIAC certifications.

Measuring readiness

• Practice scores: both practice exams comfortably above 69%, not on the line.
• Lookup rate: fewer than one question in five needing the index, each lookup under a minute.
• Pace: all 106 questions completed with at least 30 minutes left for skipped items.
• Objective coverage: all 15 objectives amber or green before booking, including the LLM and cloud credential ones.
• Lab confidence: able to explain, for each major tool in the material, what a defender would see in logs or traffic.

Cost, renewal and continuing education

GIAC orders are non-refundable once access is granted, and GIAC reserves the right to change prices without notice. SANS training is priced separately and is usually the larger cost.

CPE categories and caps

If a certification has already expired, GIAC asks holders to contact it about options. Real incident work counts only up to the 12 CPE work experience cap, so plan another source, such as training or a new certification.

Common failure patterns

• Studying old material: second-hand notes that predate the AI, cloud credential and API objectives leave gaps the current exam tests.
• Learning tools without the defender's view: the objectives are about detecting and defending, so knowing a tool's options without knowing its traces costs marks.
• Relying on the books: at just over two minutes per question, a candidate who looks up everything runs out of time.
• Burning skips early: skips are limited and answered questions are locked, so skipping freely in the first hour leaves nothing for later.
• Letting the window lapse: 120 days passes quickly alongside on-call work; an extension costs $479.
• Proctoring slips: mismatched ID names or a cancellation inside 24 hours trigger the $175 reseating fee.

Where it fits on the career path

GCIH is usually taken after a foundation credential and a year or more in operations or a SOC, and is a common requirement for incident responder and senior analyst roles.

• Before it: the GIAC GSEC Guide, the CompTIA Security+ Guide or, for analysts, the CompTIA CySA+ Guide.
• After it, deeper response: host and memory forensics with the GIAC GCFA Guide, and malware analysis with the GIAC GREM Guide.
• After it, hands-on extension: GIAC's pricing page lists GX-IH, priced at $499 for holders of an active GCIH and $1,299 without one.
• Across to offence: the GIAC GPEN Guide for those moving into penetration testing.
• Roles and comparisons: the Blue Team Certifications Guide, the DFIR Analyst Career Guide and the Cybersecurity Certifications Guide.

GIAC does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates.

Practitioner checklist

• Confirm the passing score, exam version and price in your GIAC account before you activate.
• Book the proctored appointment at least a month ahead and well inside the 120-day window.
• Map yourself against all 15 objectives, with extra attention to the AI, cloud credential and web API ones.
• For every tool you study, note what it looks like in logs, traffic and process data.
• Build your own index with book and page references while you study.
• Sit both practice exams under real conditions: printed materials only, timed, no going back.
• Check ID names, arrival time and the 24-hour cancellation rule for your delivery option.
• After passing, diarise the four-year expiry, log 36 CPEs within the category caps, and register renewal in the two-year window.

Standards and references

• GIAC: GIAC Certified Incident Handler (GCIH)
• GIAC: Certification Pricing
• GIAC: Proctored Exams
• GIAC: Renewal Knowledge Base
• GIAC: Certification Renewal

Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Incident Response Guide · Digital Forensics (DFIR) Guide · GIAC GCFA Guide · SOC Guide