Boards and executives increasingly expect technology leaders to show that IT spending delivers value and that technology risk is governed, not just managed, and few credentials test that skill directly. CGEIT (Certified in the Governance of Enterprise IT) is ISACA's credential for people who direct, advise on or oversee the governance of enterprise IT. This guide covers who it is for, the four exam domains and their weights, the experience rule, costs, maintenance and a preparation plan. It is written for IT governance leads, senior security and risk managers, enterprise architects and consultants weighing CGEIT against CISM, CRISC or CISA. Exam facts come from ISACA's own CGEIT pages, checked on 24 October 2026; confirm fees and the outline on isaca.org before you book.
Key takeaways
- It is a governance credential, not a technical one. The exam tests governance frameworks, IT resources, benefits realisation and risk optimisation, the board-level view of IT.
- The exam has 150 questions across four domains. Governance of Enterprise IT carries 40%, Benefits Realization 26%, Risk Optimization 19% and IT Resources 15%.
- Experience is the real barrier. Five or more years in an advisory or oversight role supporting the governance of IT, across at least three domains, including at least one year in Domain 1, within the last ten years.
- It costs more than most ISACA exams. US$575 for members and US$760 for non-members, plus a US$50 application fee.
- Maintenance follows the standard ISACA cycle. 20 CPE hours a year, 120 over three years, and an annual maintenance fee of US$45 for members or US$85 for non-members.
Who the certification is for
ISACA states that the CGEIT exam is open to anyone with an interest in the governance of enterprise IT, but certification requires governance experience. In practice the credential suits people whose job is to decide or advise on what IT should do and whether it is delivering, rather than to run it.
| Role | Fit | What CGEIT adds |
|---|---|---|
| CIO, IT director, head of IT governance | Strong | Evidence of governance framework design, investment oversight and reporting to the board |
| CISO or head of security with board reporting duties | Good, after CISM | Broadens from security governance to whole-of-IT value and resource decisions |
| Enterprise architect or PMO lead | Good | Links architecture and portfolio decisions to enterprise objectives and benefits |
| Risk manager or GRC lead | Moderate, CRISC first | Adds strategy and benefits realisation to risk work |
| IT auditor | Moderate, CISA first | Helps audit governance itself, not only controls |
| Early-career engineer or analyst | Poor | The experience rule cannot yet be met |
Exam format and domains
The exam is computer-based and is delivered at PSI test centres worldwide or by remote proctoring. ISACA's content outline states it has 150 questions covering four job practice domains. The CGEIT pages we read do not state the exam duration, the passing score or the effective date of the current outline, so check ISACA's current candidate guide before exam day.
| Domain | Weight | Parts | Topics listed by ISACA |
|---|---|---|---|
| 1. Governance of Enterprise IT | 40% | A. Governance Framework; B. Technology Governance; C. Information Governance | Governance framework components; structures, roles and responsibilities; strategy development; legal and regulatory compliance; organisational culture; business ethics; strategy alignment; strategic planning; stakeholder analysis and engagement; communication and awareness; enterprise architecture; policies and standards; information architecture; information asset life cycle; ownership and stewardship; classification and handling |
| 2. IT Resources | 15% | A. IT Resource Planning; B. IT Resource Optimization | Sourcing strategies; capacity planning; acquisition of resources; resource life cycle and asset management; competency assessment and development; management of contracted services and relationships |
| 3. Benefits Realization | 26% | A. IT Performance and Oversight; B. Management of IT-Enabled Investments | Performance management; change management; governance monitoring and reporting; quality assurance; process improvement; business case development; investment management and reporting; performance metrics; benefit evaluation methods |
| 4. Risk Optimization | 19% | A. Risk Strategy; B. Risk Management | Risk frameworks and standards; enterprise risk management; risk appetite and tolerance; IT-enabled capabilities, processes and services; business risk, exposures and threats; risk management life cycle; risk assessment methods |
At 150 questions, Domain 1 is worth roughly 60 questions and Domain 2 roughly 22, so your study time should follow the weights. The outline also lists 38 supporting tasks, such as establishing a framework for the governance of enterprise IT, evaluating benefits realisation of IT-enabled investments, and ensuring that IT and information risk management programmes are established. A useful habit when practising: the best answer is usually the one a governance body would choose, not the one an engineer would implement.
How CGEIT relates to frameworks you already use
| CGEIT domain | NIST CSF 2.0 Govern categories | NIST SP 800-53 Rev. 5 | Related ISACA framework |
|---|---|---|---|
| 1. Governance of Enterprise IT | GV.RR Roles, Responsibilities and Authorities; GV.PO Policy | PM-11 Mission and Business Process Definition | COBIT 2019 governance and management objectives |
| 2. IT Resources | GV.SC Cybersecurity Supply Chain Risk Management; ID.AM Asset Management | PM-11 | COBIT 2019 |
| 3. Benefits Realization | GV.OV Oversight | CA-2 Control Assessments | COBIT 2019 |
| 4. Risk Optimization | GV.RM Risk Management Strategy | PM-9 Risk Management Strategy; RA-3 Risk Assessment | COBIT 2019; see also CRISC |
This mapping is NHI Mgmt Group's reading of the outline, not an ISACA mapping. COBIT 2019, ISACA's own governance framework, describes 40 governance and management objectives and uses design factors to tailor a governance system, which makes it the most natural companion text. See the COBIT 2019 Guide.
Prerequisites and experience
- Years: five or more years of professional work experience managing, serving in an advisory or oversight role, or otherwise supporting the governance of the IT-related contribution to an enterprise.
- Breadth: the experience must span at least three of the four CGEIT domains.
- Domain 1 minimum: at least one year must relate to Domain 1, Governance of Enterprise IT.
- Recency: the experience must fall within the ten years before your application date.
- Verification: your supervisor or manager verifies the experience on the application.
- Waivers: ISACA's application page does not mention any experience waivers or substitutions, so do not plan on one.
- Timing: you may sit the exam before you have the experience and apply within five years of passing, paying the one-time US$50 application processing fee after scores are released.
The most common gap is Domain 1. Running IT operations well is not the same as governing IT: evidence such as chairing an architecture board, writing IT policy, owning a governance framework or reporting to an executive committee is what counts. Document it as you go, with dates and the domain each piece of work supports.
Preparation plan
- Check eligibility first: list your governance work against the four domains and confirm you can show three, including a year of Domain 1, inside the last ten years. If not, plan the exam for when you will.
- Register and book: registration is continuous and eligibility lasts six months. Pay in full, then book from 48 hours after payment and up to 90 days ahead. Rescheduling is free if done at least 48 hours before the appointment. Use the name on your government-issued ID.
- Baseline: take ISACA's free practice quiz and score yourself against each topic in the outline.
- Domain 1 (40%), weeks 1 to 4: governance framework components, roles, strategy alignment, enterprise architecture, policies and information governance. Read COBIT 2019 introductory material alongside the CGEIT Review Manual (ISACA lists the 8th edition).
- Domain 3 (26%), weeks 5 to 6: business cases, investment management, benefit evaluation and governance reporting. Practise writing benefit metrics for a real project.
- Domain 4 (19%), week 7: risk appetite and tolerance, enterprise risk management and assessment methods. See the CRISC Certification Guide for overlap.
- Domain 2 (15%), week 8: sourcing, capacity planning, asset life cycle, competency and supplier management. See the Third-Party Risk Management Guide.
- Question practice, weeks 9 to 10: ISACA sells a 300-question bank as a six-month subscription. Review every wrong answer against the outline topic and ask which answer a board would choose.
- Before the day: confirm duration and ID rules in the current candidate guide, and test your setup if sitting remotely. Residents of India, Mainland China and Hong Kong must sit at a test centre.
Cost, renewal and continuing education
| Item | ISACA member | Non-member |
|---|---|---|
| Exam registration | US$575 | US$760 |
| Application processing fee (one-time) | US$50 | US$50 |
| Annual maintenance fee | US$45 | US$85 |
| Third and later ISACA certification maintenance | US$25 each | US$50 each |
| Minimum CPE | 20 hours a year, 120 over three years | Same |
- Fee due date: the maintenance fee is due by 1 January each year and covers renewal for that calendar year.
- CPE reporting: CPE earned through ISACA is pre-loaded and must be applied in MyISACA; CPE from chapters and other providers must be self-reported.
- Audit: ISACA randomly audits holders, who must provide documentation for all activities reported for a given year. Failing to comply leads to revocation, so keep evidence for 12 months after the end of each three-year cycle.
- Ethics: holders must adhere to ISACA's Code of Professional Ethics and CPE policy.
The membership decision is simple arithmetic: the exam saving alone is US$185, and the annual fee saving is US$40, so compare that with current ISACA membership dues before registering.
Where it fits on the career path
CGEIT typically comes later than CISA, CISM or CRISC. It is the credential that says you can govern technology as a business asset, which suits people moving into CIO, chief digital officer, head of governance or board advisory roles.
| Credential | Focus | Choose it when |
|---|---|---|
| CGEIT | Governance of all enterprise IT: strategy, resources, value, risk | You advise on or oversee IT investment and governance at executive level |
| CISM | Information security management | You run or lead a security programme. See the CISM Certification Guide |
| CRISC | IT risk identification, assessment and response | Your job is the risk register and control ownership |
| CISA | IS audit, control and assurance | You audit or assure IT. See the CISA Certification Guide |
| CDPSE | Privacy engineering and data protection by design | You build privacy into systems. See the CDPSE Certification Guide |
Information governance is one of Domain 1's three parts, and AI raises the same questions of ownership, value and risk at board level. Governance professionals adding AI oversight should read the AI Governance Guide; identity governance, including who owns service accounts and machine credentials, is a common place where IT governance decisions become concrete.
Practitioner checklist
- Map your last ten years of work to the four domains and confirm three domains plus one year of Domain 1.
- Line up a supervisor or manager who can verify that experience.
- Download the current content outline and note the date you checked it.
- Check duration, scoring and ID rules in the current ISACA candidate guide.
- Allocate study time by weight: 40% Domain 1, 26% Domain 3, 19% Domain 4, 15% Domain 2.
- Read COBIT 2019 introductory material alongside the review manual.
- Book inside the six-month eligibility window and apply within five years of passing.
- Set up CPE tracking for 20 hours a year and keep evidence for audit.
Standards and references
- ISACA: CGEIT Certification
- ISACA: CGEIT Exam Content Outline
- ISACA: How to Get CGEIT Certified
- ISACA: How to Maintain CGEIT
- ISACA: CGEIT Exam
- ISACA: COBIT
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · COBIT 2019 Guide · CRISC Certification Guide · AI Governance Guide · Cybersecurity Careers Guide