GICSP Certification Guide: Exam, Cost and Renewal

Industrial control system teams need people who understand both a Windows domain and a safety instrumented system, and very few credentials test that combination. The GIAC Global Industrial Cyber Security Professional (GICSP) is built for that bridge: it checks whether IT, security and engineering staff share a working vocabulary for securing operational technology. This guide sets out what GIAC publishes about GICSP, the exam format and ten objectives, delivery and open book rules, prices and renewal, then adds a preparation plan and a view on where GICSP sits beside ISA/IEC 62443 certificates and GIAC's other ICS credentials. It is for OT engineers, IT and security staff moving into industrial environments, and managers deciding whether to fund it. Facts are as published on giac.org and sans.org, as checked 26 Oct 2026; GIAC states that prices can change without notice, so confirm on the linked pages before you register.

Key takeaways

It is a bridge credential. GICSP targets the overlap between IT, engineering and security in industrial control systems, not deep offensive or forensic skill.
The exam is 82 questions in 3 hours. GIAC lists one proctored exam with a minimum passing score of 71%, taken remotely through ProctorU or at a Pearson VUE centre.
There are no formal prerequisites. GIAC lists none, but the aligned SANS course expects networking, system administration and risk basics.
Budget for more than the exam. GIAC's standard attempt price is $999 (USD, excluding tax), and the aligned ICS410 course is listed at $9,230 OnDemand.
Renewal runs on a four-year cycle. Holders collect 36 CPE credits over four years and pay GIAC's renewal fee, listed at $499.

Who the certification is for

GIAC describes GICSP as covering the security of industrial systems across both IT and OT environments. Its listed audience is: ICS IT practitioners, including OT support staff; ICS security analysts, including OT security staff; security engineers; industry managers and professionals; and vendors.

Strong fit: control and automation engineers who now own cyber security for their plant; IT security engineers assigned to a site, substation or water treatment works; integrators and OEM staff who design and commission control systems.
Strong fit for employers: GIAC states it is an ANAB-accredited ISO/IEC 17024 personnel certification body, and the GICSP page shows a DoD 8140 alignment badge. Confirm the specific work role mapping with the hiring organisation, as the page gives no detail.
Weaker fit: experienced OT incident responders, who will get more from GIAC Response and Industrial Defense (GRID); and staff whose work is mainly standards conformance, for whom the ISA/IEC 62443 Certification Guide may be closer to the job.

For the wider role picture see the OT Security Engineer Career Guide, and for comparison across vendors see the Cybersecurity Certifications Guide.

Exam format and domains

Format

Item	GICSP (as published by GIAC, checked 26 Oct 2026)
Exam	1 proctored exam
Questions	82
Time limit	3 hours
Minimum passing score	71%
Attempt window	120 days from activation in your GIAC account
Delivery	Web-based and proctored: remotely through ProctorU or on site at a Pearson VUE centre; GIAC says both may not be available for every attempt, and candidates within 60 miles of a centre are expected to use it
Materials	Open book: hardcopy books, notes and an index; no electronic files, devices or internet; printed material that looks like practice or exam questions is prohibited
Navigation	Answered questions cannot be reviewed or changed; about 10 to 15 questions can be skipped, and skipped questions left unanswered are marked incorrect
Breaks	15 minutes in total, in one or two sessions; the clock resumes automatically
CyberLive	Listed on the GICSP page; GIAC describes it as hands-on, performance-based challenges in lab virtual machines with real tools

At a Pearson VUE centre GIAC asks you to arrive 15 minutes early with two valid, original IDs that match your registration; otherwise you are turned away and charged a $175 seating fee to reschedule.

The ten certification objectives

GIAC lists ten objectives without weightings. Objective names are GIAC's; the "what to master" column is our reading of the scope GIAC describes.

GIAC objective	What to master	Related NHI Mgmt Group guide
ICS overview and concepts	Industrial processes and roles, how ICS differs from IT, physical security	OT Security Guide
ICS components and architecture	Classifying assets at Purdue levels 0 to 3; using levels and zones to design a secure architecture	Network Segmentation Guide
PERA Levels 0 and 1	Sensors, actuators, controllers and safety devices, and how they are attacked	PLC Security Guide, Safety Instrumented Systems Security Guide
PERA Levels 2 and 3	HMIs, engineering workstations, historians and site servers, and how they are attacked	Identity for OT Environments Guide
Protocols, communications and compromise	TCP/IP and ICS-specific protocols, how they are compromised and defended, basic cryptography	Industrial IoT (IIoT) Security Guide
Wireless technologies and compromise	Wireless used in ICS, attacks against it, defences	IoT Security Guide
Endpoint hardening and protection	Hardening and patching Windows and Unix-style systems common in ICS	Firmware and Boot Security Guide
Threat intelligence and modelling	The ICS threat landscape and basic threat modelling	Top 10 OT Security Risks
ICS program and policy development	Building a security programme and enforceable ICS policies	IEC 62443 Guide
Risk-based disaster recovery and incident response	Measuring risk and using it to guide recovery and response	OT Incident Response Guide

"PERA" is the Purdue Enterprise Reference Architecture, the source of the Purdue levels. Expect questions that ask which level a device belongs to, what crosses a zone boundary, and why a control that is routine in IT (an automatic reboot after patching, an active scan) can be unsafe on a running process.

Prerequisites and experience

GIAC lists no formal prerequisites or experience requirement for GICSP. The aligned SANS course, ICS410: ICS/SCADA Security Essentials, states that students should have basic knowledge of networking, system administration, TCP/IP, architecture, vulnerability assessment and risk methodology, and SANS includes its ICS310 course as a starting point for newcomers.

Your background	Likely gap	What to close it with
IT or security engineer	Process control, safety systems, Purdue levels 0 and 1, why availability and safety come first	Site visits with control engineers, vendor controller documentation, the NIST SP 800-82 OT Security Guide
Control or automation engineer	Windows and Linux hardening, Active Directory, firewalls, cryptography basics	A broad security foundation such as the GIAC GSEC Guide syllabus or the CompTIA Security+ Guide
Manager or vendor staff	Hands-on protocol and endpoint detail	Lab time with packet captures of industrial protocols and a test controller

Preparation plan

The open book format rewards a good index and punishes slow lookups. A plan of 8 to 12 weeks suits most working candidates.

Weeks 1 to 2, baseline: read GIAC's ten objectives and rate yourself on each. Identify whether your gap is the IT side or the process side, using the table above.
Weeks 2 to 6, core study: work through the course material or equivalent reading. SANS lists ICS410 as six days in person or 36 hours self-paced with 15 hands-on labs, covering ICS overview, architectures and processes, communications and protocols, supervisory systems, and security governance (including ISA/IEC 62443 and NIST CSF), ending in a capture-the-flag exercise.
Weeks 4 to 8, labs: read packet captures of common industrial protocols, map a sample plant into Purdue levels and zones, and harden a Windows HMI image and a Linux historian. If you have a test controller, practise changing and auditing its configuration safely.
Weeks 6 to 9, build the index: one line per concept with book and page, plus your own tables (Purdue levels and device types, protocol names and what they carry, IR phases). Index terms you would search for, not the course's headings.
Weeks 9 to 10, practice exam: GIAC sells practice tests that simulate the engine and question style from a limited bank, never real exam questions. Take one under timed conditions, then fix the index wherever a lookup took over two minutes.
Exam week: 82 questions in 180 minutes is about 2 minutes 10 seconds each. Answer from memory first, look up only when needed, and use skips sparingly because answered questions cannot be revisited.

Cost, renewal and continuing education

Item	Price or rule (USD, excluding tax; as checked 26 Oct 2026)
Certification attempt	$999 (GIAC standard price)
Retake	$899
Attempt extension	$479
Practice exam	$399
Aligned training (optional)	SANS ICS410 OnDemand listed at $9,230; live prices vary by location
Renewal cycle	Four years; 36 CPE credits over the cycle
Renewal fee	$499 ($249 for an additional renewal within 2 years of a full-price renewal)

GIAC states that it can change prices at any time without notice. Its renewal page groups CPE sources into graduate courses, other information security training, community participation, field work experience, and ISO/IEC 17024-accredited security certifications and their training, and its FAQ refers to renewing by exam. Check your GIAC account for the current options. Because accredited certifications are a listed CPE category, a further ICS credential earned during the cycle may help; confirm how GIAC credits it before relying on that.

Where it fits on the career path

Credential	Focus	When to choose it
GICSP (GIAC)	Foundations across IT, OT and engineering	First OT security credential for engineers or IT staff; broad role in a plant or utility
GRID (GIAC)	Defence and response against ICS-specific threats	After GICSP, for monitoring, threat hunting and response roles in OT
GCIP (GIAC)	Protecting power and critical environments, linking compliance with defence	Roles in electric power and regulated critical infrastructure
ISA/IEC 62443 certificates (ISA)	Four certificates: Fundamentals, Risk Assessment, Design and Maintenance Specialist, with Expert after all four	Standards-led design, assessment and supplier conformance work; see the ISA/IEC 62443 Certification Guide

GICSP maps closely to the US NICE Framework work role "Operational Technology (OT) Cybersecurity Engineering" (DD-WRL-009), whose sample tasks include inventorying OT assets, identifying gaps in OT network architecture and assigning security level targets to zones. Decision guidance:

Small operator, one or two security people: GICSP gives the widest coverage per pound spent, then add ISA/IEC 62443 Fundamentals if you buy from integrators who quote the standard.
Large utility or manufacturer: use GICSP as the common baseline for mixed IT and engineering teams, then specialise: GRID for the SOC side, ISA/IEC 62443 Design or Risk Assessment for engineering.
Self-funded candidate: the course is the largest cost; you can self-study and buy only the attempt and a practice exam, though GIAC's question style rewards course-aligned books.

Identity is a recurring weak point in the scenarios GICSP prepares you for: shared engineering accounts, vendor remote access and unused VPN profiles. The Colonial Pipeline ransomware attack began with a legacy VPN account without MFA, and the operator chose to shut down the pipeline to contain it. See the OT Remote Access Guide.

Common failure patterns

Studying only the IT half: IT security staff often lose marks on level 0 and 1 devices and safety systems, where IT instincts give the wrong answer.
Studying only the plant half: engineers can be caught out by Windows hardening, cryptography and firewall questions.
An index built from headings: it fails under time pressure; index the words you would actually look up.
Treating it as a job licence: GICSP shows shared understanding, not authority to change a running process. Change control and the plant's safety case still govern every action.

Practitioner checklist

Confirm the current exam facts, prices and delivery options on giac.org before booking.
Rate yourself against all ten GIAC objectives and decide whether your gap is IT or process.
Decide on course or self-study, and get employer funding agreed in writing if relevant.
Book lab time with real industrial protocol captures and, if possible, a test controller.
Build your own index and Purdue level reference tables as you study.
Take a timed practice exam at least two weeks before the attempt and fix slow lookups.
Check whether Pearson VUE or remote proctoring applies to you, and prepare two matching IDs.
After passing, plan 36 CPE credits over four years, ideally through GRID, GCIP or ISA/IEC 62443 work.

GICSP Certification Guide: Exam, Prerequisites and Career Value