8140.study
← All certifications

GIAC Certified Incident Handler (GCIH)

GIAC

Validates a practitioner's ability to detect, respond to, and resolve computer security incidents using a wide range of essential security skills, including understanding common attack techniques, vectors, and tools.

We have a course for this

Built from this exam's published objectives. The first module is free.

GIAC GCIH

Advanced · 21 hrs

Baseline certification levels

This certification satisfies these DoD baseline levels — the IAT / IAM / IASAE / CSSP requirement many contracts still state. It's a separate question from the 8140 work roles above, and there is no official mapping between the two.

IAT Level IIICSSP AnalystCSSP Incident Responder

What this qualifies you for

Listed specifically for 5 work roles — up to Advanced proficiency. Because options cascade downward, a cert listed at Advanced also satisfies Intermediate and Basic for that role.

441Network Operations (NETOPS) SpecialistPlans, implements, and operates network services/systems, to include hardware and virtual environments.Intermediate531Cyber Defense Incident ResponderInvestigates, analyzes, and responds to cyber incidents within the network environment or enclave.Intermediate541Vulnerability Assessment AnalystPerforms assessments of systems and networks within the NE or enclave and identifies where those systems/networks deviate from acceptable configurations, enclave policy, or local policy. Measures effectiveness of defense-in-depth architecture against known vulnerabilities.Intermediate722Information Systems Security Manager (ISSM)Responsible for the cybersecurity of a program, organization, system, or enclave.Advanced723Communications Security (COMSEC) ManagerManages the Communications Security (COMSEC) resources of an organization (CNSSI No. 4009).Advanced
Also listed for 14 Cyberspace Enablers roles — but so is every other certification

The Enablers matrix isn’t role-differentiated: the same certification options are listed for all 14 roles at every proficiency level. We verified that across all 14. So this is true, and it carries no information about this credential specifically — which is why it isn’t in the count above.

211 Forensics Analyst221 Cyber Crime Investigator711 Cyber Instructional Curriculum Developer712 Cyber Instructor731 Cyber Legal Advisor732 Privacy Compliance Manager751 Cyber Workforce Developer and Manager752 Cyber Policy and Strategy Planner801 Program Manager802 IT Project Manager803 Product Support Manager804 IT Investment/Portfolio Manager805 IT Program Auditor901 Executive Cyber Leader

Renewal

4year cycle36CPE per cycle

Certification renewal, USD 499

This is the issuer’s clock. 8140 runs a second one — 20 hours of CPD a year, at every proficiency level, which applies even if you hold no certification at all. How that works

GIAC publishes objective areas without percentage weights; all domain weights are 0 by design. GCIH is a CyberLive (hands-on) certification. The 69% minimum passing score applies to the exam version released on or after May 10, 2025; older versions may differ. GCIH objective areas reflect the current SEC504-aligned version and include AI/LLM-related objectives added in recent revisions.

Source: GIAC - GCIH certification page · dated 2026-07-17 · checked 2026-07-17

Verifying it

GIAC publishes a lookup a third party can use without your involvement.

Name or GIAC number

Issuer lookupTrack this credential

GIAC publishes objective areas without percentage weights; all domain weights are 0 by design. GCIH is a CyberLive (hands-on) certification. The 69% minimum passing score applies to the exam version released on or after May 10, 2025; older versions may differ. GCIH objective areas reflect the current SEC504-aligned version and include AI/LLM-related objectives added in recent revisions.

Source: GIAC - GCIH certification page · dated 2026-07-17 · checked 2026-07-17

Exam blueprint

Verified against GIAC’s published outline.

GCIH

Current

106 questions · 4 hours · passing score 69%

Attacking Passwords
Detecting Evasive and Post-Exploitation Techniques
Detecting Exploitation and Covert Communications Tools
Endpoint Attack and Pivoting
Exploiting Insecure Web Application References
Incident Response and Cyber Investigation
Integrating LLMs with Offensive Operations
Malware and AI Assisted Investigations
Network and Log Investigations
Scanning and Mapping
Securing Credentials and Data in the Cloud
SMB Security
Understanding Passwords
Web Application API Attacks
Web Application Injection Attacks

GIAC publishes objective areas without percentage weightings, so none are shown.

GIAC publishes objective areas without percentage weights; all domain weights are 0 by design. GCIH is a CyberLive (hands-on) certification. The 69% minimum passing score applies to the exam version released on or after May 10, 2025; older versions may differ. GCIH objective areas reflect the current SEC504-aligned version and include AI/LLM-related objectives added in recent revisions.

Source: GIAC - GCIH certification page · dated 2026-07-17 · checked 2026-07-17