GIAC offers four cloud security certifications with near-identical exam formats, so the choice between them depends entirely on the job you do, and picking by name alone wastes a $999 attempt and the training that goes with it. GCLD (Cloud Security Essentials), GPCS (Public Cloud Security), GCSA (Cloud Security Automation) and GCAD (Cloud Security Architecture and Design) cover, respectively, broad cloud defence, hardening of cloud services across providers, DevSecOps and container automation, and enterprise cloud architecture. This guide compares what GIAC publishes about each: format, passing score, objectives, aligned SANS course, fees and renewal. It then gives decision guidance, a preparation plan and the career path. It is for cloud engineers, security engineers, DevOps staff, architects and managers choosing training. Facts are from giac.org, checked 27 October 2026; check current fees and your attempt details in your GIAC account before registering.
Key takeaways
- The formats are the same. All four are one proctored exam of 75 questions in 2 hours, delivered through ProctorU or Pearson VUE, with 120 days from activation to sit.
- Passing scores differ. GCLD 61%, GCAD 63%, GPCS 64% and GCSA 66%, each for exam versions released on or after a stated date.
- The scope is what separates them. GCLD is breadth, GPCS is service hardening and cloud IAM, GCSA is pipelines, Kubernetes and policy as code, and GCAD is identity, network and logging architecture at enterprise scale.
- Each aligns to a different SANS course. SEC488 (GCLD), SEC510 (GPCS), SEC540 (GCSA) and SEC549 (GCAD).
- Costs and renewal are identical. $999 attempt, $899 retake, $399 practice exam; renewal every four years with 36 CPEs or a retake.
Who the certification is for
| Certification | GIAC's stated audience (summary) | Choose it when |
|---|---|---|
| GCLD: Cloud Security Essentials | Security engineers, analysts, managers and auditors; system administrators; risk managers; anyone responsible for securing cloud | You need one broad cloud credential covering IAM, networking, logging, data, secrets and compliance |
| GPCS: Public Cloud Security | Security analysts, engineers and researchers; cloud and DevOps engineers; auditors; administrators; operations staff; anyone evaluating cloud security offerings | You harden and assess services across more than one provider: storage, serverless, application services, IAM policies, metadata services |
| GCSA: Cloud Security Automation | Developers, software architects, operations engineers, administrators, security analysts, engineers and consultants, auditors and risk managers in public cloud or DevOps | You build or secure CI/CD pipelines, infrastructure as code, Kubernetes and the software supply chain |
| GCAD: Cloud Security Architecture and Design | Anyone in cloud; cloud architects; operations, DevOps and software engineers; administrators; security analysts, engineers and consultants; auditors and risk managers | You design landing zones, cross-cloud identity, shared network services, logging and key management for a whole organisation |
Decision guidance: if you are new to cloud security, start with GCLD. If you already work in cloud and your job is mostly configuration review and hardening, GPCS. If your job is pipelines and clusters, GCSA. If you are an architect or the person who sets the guardrails every account inherits, GCAD. In small organisations one person often does all of this; GCLD then gives the best return, with GCAD as the second step. Large organisations can map each certification to a team: GCAD for the platform or cloud centre of excellence, GCSA for DevSecOps, GPCS for cloud security engineering and assessment.
For certifications beyond GIAC, see the Cybersecurity Certifications Guide, the CCSP Certification Guide and the AWS Certified Security Specialty Guide.
Exam format and domains
Format and alignment
| Item (GIAC, checked 27 October 2026) | GCLD | GPCS | GCSA | GCAD |
|---|---|---|---|---|
| Questions and time | 75 in 2 h | 75 in 2 h | 75 in 2 h | 75 in 2 h |
| Minimum passing score | 61% | 64% | 66% | 63% |
| Applies to versions released on or after | 9 April 2021 | 16 August 2021 | 29 June 2024 | 25 January 2025 |
| Number of objectives | 16 | 8 | 18 | 18 |
| Aligned SANS course | SEC488 Cloud Security Tactical Defense | SEC510 Cloud Security Engineering Controls | SEC540 (Cloud Native Security and DevSecOps Automation) | SEC549 Cloud Security Architecture |
| Badges shown on the page | ANAB, DoD 8140 | DoD 8140; tagged "AI-Focused" | ANAB, DoD 8140 | DORA, NIS2 |
All four are practitioner certifications delivered web-based and proctored, remotely through ProctorU or on site at Pearson VUE. With 75 questions in 120 minutes you have 96 seconds a question. Confirm the exact format and passing score for your attempt in the Certification Information section of your GIAC account.
What each objective set covers
| Topic area | GCLD | GPCS | GCSA | GCAD |
|---|---|---|---|---|
| Cloud IAM | Cloud Account Fundamentals; External Access and IAM Best Practices | Cloud Identity and Access Management; Cloud Integration and Benchmarking (SSO, long-term credentials) | Edge Identity and Authentication; Workload Security (OIDC workload identity) | Cloud Identity; Architecting Cross-Cloud Identity; Federated Access and SSO; Conditional Access Policies; Customer IAM |
| Networking | Cloud Networking Technology; Securing Cloud Networks | Accessing Cloud Services Securely (private endpoints, remote admin) | Microservice API Gateways (network policies, service mesh) | Centralizing Shared Network Services; Micro Segmentation; Managing Cloud Networks at Scale; Network Firewalls and Traffic Inspection |
| Data and keys | Discovering and Storing Sensitive Data; Using Sensitive Data | Cloud Data Protection (KMS, encryption); Securing Cloud Storage Platforms | Managing Secrets | Data Classification and Tagging; Data Security; Defending Data in the Cloud; Key Management Architecture |
| Compute, containers, serverless | Containers and Cloud Storage; Secure Compute Deployment | Securing Serverless Functions; Securing Cloud Application Service Platforms (including AI services) | Kubernetes architecture, access control, runtime and workload security; Container Lifecycle Security | Hierarchical Cloud Structures (OU and resource hierarchy) |
| Automation and supply chain | Cloud Automation; Frameworks for Built-in Security (CI/CD) | IaC; Compliance as Code; Automated Remediation; Policy Enforcement; DevOps workflow; Software Supply Chain (signing, SBOM); Configuration Management | ||
| Logging, detection, response | Cloud Logging Fundamentals; Network Security Monitoring; Attacking the Cloud and Responding to Intrusions | Multicloud and Credential Management (metadata API attacks) | Cloud Native Observability | Comprehensive Logging and Aggregation; Orchestrating Log Integrations; Incident Response in the Cloud |
| Governance and design | Risk Management and Compliance; Shared Responsibility and Threat Informed Defense; Secrets Management | Implementing Zero Trust |
Objective names are GIAC's, shortened in places; the grouping is ours.
Where identity fits: identity is the thread running through all four. GCLD and GCSA name secrets management explicitly, GPCS covers long-term credentials and instance metadata credential attacks, GCSA covers OIDC-based workload identity for pods, and GCAD devotes five objectives to identity, including service principals and cross-cloud OIDC federation. Candidates who already understand non-human identities have an advantage. See the Cloud IAM Review Checklist and the Kubernetes Security Guide.
Prerequisites and experience
None of the four pages lists a formal prerequisite; GIAC recommends practical work experience, with college courses or self-paced study as alternatives. Realistic starting points (our judgement):
- GCLD: general security knowledge and some hands-on time in AWS, Azure or Google Cloud.
- GPCS: working experience in at least one provider and familiarity with a second, since the objectives are multicloud.
- GCSA: experience with Git, a CI/CD system, infrastructure as code and kubectl.
- GCAD: experience designing or operating multi-account or multi-subscription environments, identity federation and shared networking.
Taking two in sequence is common. GCLD followed by GCAD suits someone moving from engineering into architecture; GPCS followed by GCSA suits a cloud security engineer moving towards pipelines and platform work. Because the objective sets overlap on IAM, logging and data protection, the second exam usually needs less preparation than the first, but study the second set in full rather than assuming the overlap covers it.
Preparation plan
- Choose using your job, not the title: list the last ten pieces of cloud work you did and map them to the topic table above.
- Set up accounts (week 1): use isolated free-tier or sandbox accounts in at least two providers; never practise in production. Turn on control plane logging first.
- Labs by objective (weeks 2 to 7): GCLD: build a small environment end to end and review it. GPCS: misconfigure and fix storage, serverless and IAM policies, and test instance metadata protections. GCSA: build a pipeline with IaC scanning, image signing, SBOM generation and an admission controller. GCAD: design an organisation hierarchy, central logging, shared network services and cross-cloud federation.
- Index (alongside): build your own sorted index with page references.
- Practice exams (weeks 8 and 10): timed at 96 seconds a question.
- Book and sit: book the proctored slot early inside the 120-day window, and clean up lab resources to avoid unexpected cloud bills.
Measuring readiness
- Practice scores at least 10 points above the passing mark for your exam.
- Lab coverage: one working build or fix per objective.
- Pace: finishing with 15 minutes to spare.
- Workplace value: after passing, count misconfigurations closed or guardrails added in your own environment over the next quarter.
Cost, renewal and continuing education
| Item | All four (GIAC, USD excluding tax, checked 27 October 2026) |
|---|---|
| Certification attempt | $999 |
| Exam retake | $899 |
| Attempt extension | $479 |
| Practice exam | $399 |
| Missed proctored appointment | $175 reseating fee with a 7-day extension |
| Renewal | Every four years: 36 CPEs or retake; $499, or $249 for each further renewal within two years of a full-price one |
| CPE caps | GIAC/SANS affiliated programmes up to 36 CPEs across up to 5 certifications; other categories capped at 12 to 36 CPEs across up to 3 certifications |
A candidate holding two or more cloud GIACs can count one SANS course's CPEs towards several renewals and align expiry dates for the $249 rate. Check current fees before booking.
Common failure patterns
- Choosing GCLD when you are already senior: it is breadth, and an experienced engineer gains more from GPCS, GCSA or GCAD.
- Taking GCSA without Kubernetes: five objectives are container orchestration.
- Taking GCAD as a single-account engineer: its objectives assume organisation-wide hierarchies, shared VPCs and cross-cloud identity.
- Studying one provider for GPCS: its objectives are explicitly multicloud.
- Underestimating identity: it appears in every objective set, and candidates who revise it only as user sign-in miss service principals, workload identity and long-term keys.
Where it fits on the career path
| Stage | GIAC cloud step | Other credentials often paired |
|---|---|---|
| Entering cloud security | GCLD | CCSK, provider associate certifications |
| Cloud security engineer | GPCS | AWS Security Specialty, Azure security engineer |
| DevSecOps engineer | GCSA | CKS |
| Cloud security architect | GCAD | CCSP, GDSA |
- See the CCSK Certification Guide, the Certified Kubernetes Security Specialist (CKS) Guide and the GIAC Defensible Security Architect Guide.
- For the work itself: the Cloud Security Guide and the DevSecOps Guide.
GIAC does not publish pass rates or salary figures on the pages checked.
Practitioner checklist
- Map your last ten pieces of cloud work to the topic table before choosing.
- Confirm the current passing score and exam version in your GIAC account.
- Use isolated sandbox accounts in at least two providers, with logging on.
- Build or fix one thing per objective, including identity and secrets controls.
- Build your own index and practise at 96 seconds a question.
- Book early inside the 120-day window.
- Tear down lab resources after each session.
- Plan renewals together if you hold more than one GIAC.
Standards and references
- GIAC: GIAC Cloud Security Essentials (GCLD)
- GIAC: GIAC Public Cloud Security (GPCS)
- GIAC: GIAC Cloud Security Automation (GCSA)
- GIAC: GIAC Cloud Security Architecture and Design (GCAD)
- GIAC: Certification Pricing
- GIAC: How to Renew
- GIAC: CPE Information
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Cloud Security Guide · CCSP Certification Guide · Cloud IAM Review Checklist · DevSecOps Guide