Incident response credentials split three ways, into handling, forensics and incident leadership, and picking the wrong branch wastes a training budget on skills the role never uses. This guide compares seven credentials in one decision table: GIAC GCIH, GCFA, GCIL, GLIR and GEIR, and EC-Council ECIH and CHFI. It covers who each suits, exam formats and domains, prerequisites, preparation, cost and renewal, and where each sits on a DFIR or incident management career path. It is written for analysts choosing their next credential and for SOC and IR managers building a team development plan. All facts come from GIAC and EC-Council pages checked on 27 October 2026; formats and prices change, so confirm on the provider's site before you buy.
Key takeaways
- Handling, forensics and leadership are different jobs. GCIH and ECIH test incident handling; GCFA, GLIR, GEIR and CHFI test forensic analysis; GCIL tests running the incident and the team.
- GIAC tests hands-on skill on most of these. GCIH, GCFA, GLIR and GEIR include CyberLive performance-based items in virtual machines; GCIL is a 75-question, 2-hour exam with no CyberLive listed.
- EC-Council gates entry by experience or training. ECIH needs one year of cyber security experience to apply; CHFI needs two years for candidates who do not attend official training, plus a USD 100 application fee.
- Renewal models differ. GIAC renews every four years with 36 CPE credits and a USD 499 fee; EC-Council requires 120 ECE credits over three years and an annual USD 80 fee.
- Match platform coverage to your estate. GCFA is Windows-centred, GLIR is Linux-only, and GEIR spans Windows, Linux, macOS, containers and cloud.
Who the certification is for
| Credential | Branch | Audience named by the provider | Best fit |
|---|---|---|---|
| GIAC Certified Incident Handler (GCIH) | Handling | Incident handlers and team leads, system administrators, security architects, first responders | SOC analysts moving into IR; generalists who handle incidents part-time |
| EC-Council Certified Incident Handler (ECIH) | Handling | Mid-level to senior cyber security professionals | Responders who want a module-per-incident-type syllabus |
| GIAC Certified Forensic Analyst (GCFA) | Forensics | IR team members, threat hunters, SOC analysts, experienced forensic analysts, law enforcement, red teamers | Windows enterprise investigations, memory and timeline analysis |
| GIAC Linux Incident Responder (GLIR) | Forensics | IR team members, threat hunters, SOC analysts, forensic analysts, law enforcement | Estates dominated by Linux servers and cloud workloads |
| GIAC Enterprise Incident Response (GEIR) | Forensics at scale | IR team leads and advanced practitioners, threat hunters, enterprise detection engineers, SANS DFIR alumni | Senior responders scoping incidents across mixed platforms and cloud |
| EC-Council Computer Hacking Forensic Investigator (CHFI) | Forensics | IT and forensics professionals, DFIR practitioners | Broad forensic coverage including mobile, IoT and dark web; DoD 8140 forensic roles |
| GIAC Cyber Incident Leader (GCIL) | Leadership | Incident managers, SOC managers, IR team leads, CISOs, compliance and privacy officers, legal, HR and communications staff | People who run the incident, not the keyboard |
For the analyst role these support, see the DFIR Analyst Career Guide. For the defensive analyst credentials one step earlier, see the Blue Team Certifications Guide.
Exam format and domains
| Credential | Questions and time | Passing score | Hands-on | Aligned training |
|---|---|---|---|---|
| GCIH | 106 questions, 4 hours | 69% (versions on or after 10 May 2025) | CyberLive | SANS SEC504 (named in GIAC's justification letter) |
| GCFA | 82 questions, 3 hours | 71% (versions on or after 18 March 2023) | CyberLive | SANS FOR508 |
| GLIR | 82 questions, 3 hours | 66% (versions on or after 17 May 2025) | CyberLive | SANS FOR577 |
| GEIR | 82 questions, 3 hours | 72% (versions on or after 20 April 2024) | CyberLive | SANS FOR608 |
| GCIL | 75 questions, 2 hours | 70% (versions on or after 15 February 2025) | Not listed | SANS LDR553 |
| ECIH | 100 multiple-choice questions, 3 hours | Not stated on the page read | No | EC-Council ECIH (ECIHv3 named on the page) |
| CHFI (exam 312-49) | 150 multiple-choice questions, 4 hours | 60% to 85% depending on the exam form | No | EC-Council CHFI (v11 in the brochure name) |
GIAC exams are proctored remotely through ProctorU or onsite at Pearson VUE, must be taken within 120 days of activation, and are open book for hardcopy notes and books but not for electronic devices. EC-Council exams run on the EC-Council Exam Portal.
What each syllabus actually covers
- GCIH: incident handling and computer crime investigation, attacker exploits, and tools such as Nmap, Metasploit and Netcat. It teaches how attacks work so handlers can recognise and contain them. See the GIAC GCIH Guide.
- ECIH: ten modules: introduction, the incident handling and response process, first response, then one module each for malware, email, network, web application, cloud, insider threat and endpoint incidents.
- GCFA: ten objectives covering volatile malicious and Windows event artefacts, enterprise IR, file system timelines, NTFS and Windows artefact analysis, memory forensics, and telling normal from malicious activity. See the GIAC GCFA Guide.
- GLIR: thirteen objectives including Linux audit and journal events, application events, evidence collection and mounting, The Sleuth Kit, memory and device profiling, timeline analysis and anti-forensics. See the Linux Forensics Guide.
- GEIR: eleven objectives spanning enterprise IR management, visibility and scoping, rapid triage at scale, detecting modern attacks with threat intelligence and hunting, and DFIR fundamentals for Linux, macOS, containers and cloud. See the Cloud Forensics Guide.
- CHFI: fifteen modules from the investigation process, disks and file systems, acquisition and anti-forensics through Windows, Linux and Mac, network, malware, web attack, dark web, cloud, email and social media, mobile and IoT forensics.
- GCIL: fifteen objectives on preparation, assessment, remediation and closure, team development and improvement, tracking, reporting and communications, plus attack types the leader must understand: cloud, credential, email, ransomware and supply chain attacks.
Prerequisites and experience
| Credential | Formal requirement | Provider guidance |
|---|---|---|
| GCIH, GCFA, GLIR, GEIR, GCIL | None listed | GIAC says practical experience, SANS training or college-level or self-paced study can build the skills |
| ECIH | 1 year of cyber security experience to apply; USD 100 non-refundable application fee (included in the fee for official training attendees) | Aimed at mid-level to senior professionals |
| CHFI | 2 years in the InfoSec domain for candidates who do not attend official training; USD 100 application fee | Basic understanding of IT and security, forensics and incident response |
EC-Council states an approved eligibility application is valid for three months, within which the exam voucher must be bought, and the voucher is then valid for one year. Processing takes about 5 to 10 working days once verifiers respond.
Preparation plan
- Pick the branch first: if you will be on the keyboard during an incident, choose handling (GCIH or ECIH); if you will be asked "what happened and when", choose forensics (GCFA, GLIR, GEIR or CHFI); if you will chair the bridge call, choose GCIL.
- Pick the platform: match the forensic credential to what your organisation runs. A cloud-heavy Linux estate gains more from GLIR or GEIR than from a Windows-centred GCFA.
- Build a lab: CyberLive items expect fluency with real tools in virtual machines. Rehearse acquisitions, memory captures and timeline builds on test images, never on live production evidence.
- Index the material: for the open-book GIAC exams, build an index of the course books; for EC-Council's multiple-choice exams, use spaced repetition on the module content.
- Practise under time: 106 questions in 4 hours (GCIH) is about 2.3 minutes per question; 150 in 4 hours (CHFI) is 1.6 minutes. GIAC practice exams cost USD 399 and use the real engine.
- Tie study to live work: after each module, review one of your organisation's past incidents or exercise reports against it. See the Incident Response Guide.
Cost, renewal and continuing education
| Item | GIAC (GCIH, GCFA, GLIR, GEIR, GCIL) | EC-Council (ECIH, CHFI) |
|---|---|---|
| Exam attempt | USD 999 standard certification attempt; retake USD 899 | Exam fee not listed separately on the pages read; sold with training |
| Training | SANS courses priced per event (separate from the attempt) | ECIH from USD 999 on-demand or USD 1,399 live online; CHFI from USD 1,699 on-demand, USD 2,499 live online, USD 3,299 in person |
| Application fee | None stated | USD 100, non-refundable |
| Renewal cycle | Four years | Three years |
| Continuing education | 36 CPE credits over four years, or renew by exam | 120 ECE credits over three years, registered by 1 February each year |
| Fees to stay certified | USD 499 every four years (USD 249 for additional certifications renewed within two years) | USD 80 per year |
| Lapse | Contact GIAC for options | Suspension with 12 months to catch up, then revocation and re-examination |
A team holding several GIAC credentials benefits from the reduced additional renewal fee; a team holding one EC-Council credential each pays a predictable annual fee. Model both over five years before choosing a standard for the team.
Where it fits on the career path
| Stage | Typical next credential | Why |
|---|---|---|
| SOC analyst (Tier 1 to 2) | GCIH or ECIH | Formalises triage, containment and the handling process |
| Incident responder | GCFA, GLIR or CHFI | Adds evidence handling and artefact analysis |
| Senior or lead responder | GEIR | Scoping and triage across mixed platforms at enterprise scale |
| IR manager or SOC manager | GCIL | Team, process, communications and reporting during incidents |
| Public sector or defence forensic roles | CHFI | EC-Council lists DoD 8140 DCWF work roles 211 Forensics Analyst, 212 Cyber Defense Forensics Analyst and 221 Cyber Crime Investigator |
Small teams and large teams: in a small organisation one or two people handle, investigate and lead every incident, so a single broad credential (GCIH or ECIH) plus external forensic support through a retainer usually beats sending one person deep into forensics. In a larger organisation with a dedicated IR function, spread credentials across the team: handling for the on-call rota, at least two forensic specialists matched to the main platforms, GEIR for the lead responder, and GCIL for the incident manager and deputies. Avoid every responder holding the same certificate, which leaves gaps in exactly the areas a serious incident tests. See the Incident Response Retainer Buyer's Guide.
Where identity fits: GCIL lists credential attacks and GEIR covers cloud response, and in practice many modern incidents turn on stolen tokens, abused service accounts and leaked API keys rather than malware. Responders should be able to revoke sessions and rotate machine credentials as part of containment. See the Identity Incident Response Playbook.
For the full certification landscape, see the Cybersecurity Certifications Guide.
Practitioner checklist
- Decide whether the role needs handling, forensics or incident leadership before comparing credentials.
- Match the forensic credential to your platforms: Windows (GCFA), Linux (GLIR), mixed and cloud (GEIR), broad coverage (CHFI).
- Confirm the exam version and passing score in your GIAC account, or the current version with EC-Council, before studying.
- Check EC-Council eligibility early: one year for ECIH, two years for CHFI without official training.
- Build a lab with test images and rehearse acquisition and timeline work before any CyberLive exam.
- Model five-year cost including renewal: USD 499 per four years (GIAC) against USD 80 per year (EC-Council).
- Log CPE or ECE credits as you earn them; EC-Council requires registration by 1 February each year.
- Add identity containment skills (session revocation, credential rotation) to any IR development plan.
Standards and references
- GIAC: Certified Incident Handler (GCIH)
- GIAC: Certified Forensic Analyst (GCFA)
- GIAC: Enterprise Incident Response (GEIR)
- GIAC: Linux Incident Responder (GLIR)
- GIAC: Cyber Incident Leader (GCIL)
- EC-Council: Certified Incident Handler (ECIH)
- EC-Council: Computer Hacking Forensic Investigator (CHFI)
- EC-Council: ECE Policy
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · DFIR Analyst Career Guide · Digital Forensics (DFIR) Guide · Incident Response Guide