- GCCC has 75 questions, a 2-hour limit, and a 71% passing score.
- The exam maps to CIS Controls v8 across 19 published objectives, not just 18 controls.
- Registration costs $999; retakes are $899; renewal after 4 years costs $499 or 36 CPEs.
- Only hardcopy references are allowed - no electronic files or internet access during the test.
Exam Snapshot: The Numbers You Must Memorize
Before you touch a single practice question, lock in the raw mechanics of the GIAC Critical Controls Certification exam. These numbers show up in scheduling decisions, budget planning, and pacing strategy on test day - get them wrong and you'll misjudge your prep timeline. This cheat sheet exists to compress everything from the full GCCC Study Guide 2026: How to Pass on Your First Attempt into a single scannable reference.
That works out to under 100 seconds per question on average, which is tighter than many candidates expect walking in. For a deeper breakdown of what the passing threshold actually means in raw question terms, see GCCC Passing Score 2026: Exactly What You Need to Pass.
All 19 GCCC Domains at a Glance
GIAC publishes 19 certification objectives for GCCC. Eighteen map directly to the CIS Critical Security Controls; the 19th covers background, standards, and governance context. Memorizing the domain list - and roughly what each one tests - is the fastest way to triage your study time.
| # | Domain | Core Focus |
|---|---|---|
| 1 | Access Control Management | Least privilege, access revocation, credential lifecycle |
| 2 | Account Management | Inventory of accounts, unique credentials, dormant accounts |
| 3 | Application Software Security | Secure SDLC, code review, vulnerability handling |
| 4 | Audit Log Management | Log retention, centralized collection, review cadence |
| 5 | Background on CIS Controls, Standards, and Governance | Framework history, implementation groups, governance mapping |
| 6 | Continuous Vulnerability Management | Scanning cadence, remediation timelines, risk rating |
| 7 | Data Protection | Classification, encryption, data flow mapping |
| 8 | Data Recovery | Backup testing, recovery objectives, isolation of backups |
| 9 | Email and Web Browser Protections | DNS filtering, browser hardening, anti-phishing controls |
| 10 | Incident Response Management | IR plans, roles, tabletop exercises, reporting |
| 11 | Inventory and Control of Enterprise Assets | Asset discovery, DHCP logging, unauthorized device detection |
| 12 | Inventory and Control of Software Assets | Allowlisting, unauthorized software removal |
| 13 | Malware Defenses | Anti-malware deployment, automatic updates, behavior analysis |
| 14 | Network Infrastructure Management | Secure network architecture, firmware updates, segmentation |
| 15 | Network Monitoring and Defense | NIDS/NIPS, traffic filtering, DNS query logging |
| 16 | Penetration Testing | Test scoping, remediation validation, program management |
| 17 | Secure Configuration of Enterprise Assets and Software | Hardened baselines, automatic session locking |
| 18 | Security Awareness and Skills Training | Role-based training, phishing simulations, program metrics |
| 19 | Service Provider Management | Third-party risk, service provider inventory, contract requirements |
For a walkthrough of how these domains typically get weighted on the actual exam and how question difficulty varies between them, read GCCC Exam Domains 2026: Complete Guide to All 19 Content Areas.
Registration, Fees, and Attempt Window
GIAC (the certifying body behind GCCC) structures pricing and scheduling differently than vendor-neutral certs like CompTIA. Know these figures cold before you register.
Fee Structure
Budget for these costs when planning your certification timeline:
- Certification attempt: $999
- Retake attempt: $899
- GIAC practice exam: $399
- Renewal fee (every 4 years): $499
Once you register, the clock starts on a 120-day attempt window - this is not the same as a testing appointment date. You need to schedule and sit for the exam somewhere inside that window, so don't register before you have a realistic study plan in place. A full cost breakdown, including how the practice exam fits into total spend, is available in GCCC Certification Cost 2026: Complete Pricing Breakdown.
Key Takeaway
Don't start your 120-day window until your reference materials are tabbed and organized - the clock doesn't pause for scheduling delays or index-building.
If you're still confirming whether you meet baseline eligibility before spending $999, check GCCC Requirements 2026: Eligibility, Prerequisites & How to Qualify - GIAC doesn't mandate prerequisite courses, but understanding recommended background helps you gauge readiness.
Open-Book Rules: What You Can and Can't Bring
GCCC is open book, but only for hardcopy references. This single fact changes your entire prep strategy compared to closed-book certs.
- Allowed: Printed books, printed notes, printed CIS Controls documentation, a physical index you build yourself.
- Not allowed: Laptops, tablets, phones, any electronic files, internet access, or materials that resemble actual exam questions (including brain-dump content).
Because you can't search a PDF during the test, the real skill being tested is indexing speed - how fast you can flip to the right page for each of the 19 domains under time pressure. Candidates who build a tabbed, domain-by-domain index during study sessions consistently move faster than those who try to memorize everything cold.
High-Yield Topics Inside Each Control
Not every sub-topic within a domain carries equal weight in practice. Based on how CIS Controls v8 is structured, a few specific areas tend to generate more scenario-based questions than others.
Access Control Management & Account Management
Expect scenario questions distinguishing account inventory from access authorization - GIAC often tests whether you know which control governs dormant accounts versus which governs privilege assignment.
- Difference between unique passwords and MFA safeguards
- Timing requirements for revoking access after role change
Audit Log Management & Network Monitoring and Defense
These two domains overlap conceptually, so questions frequently ask you to identify which safeguard belongs to logging versus active monitoring/defense.
- Centralized log collection vs. local log retention
- DNS query logging as a detection mechanism
Data Protection & Data Recovery
Candidates often confuse encryption-at-rest safeguards (Data Protection) with backup isolation requirements (Data Recovery). Know which domain owns which safeguard.
- Data classification schemes and handling rules
- Backup testing frequency and offline/air-gapped copies
Inventory and Control of Enterprise Assets & Software Assets
These two "inventory" domains are frequently paired in questions asking you to spot unauthorized hardware versus unauthorized software.
- Active discovery tools vs. passive discovery methods
- Allowlisting approaches for authorized software
If you want a candid assessment of how these overlapping domains contribute to overall exam difficulty, see How Hard Is the GCCC Exam? Complete Difficulty Guide 2026. And for context on how other candidates have historically performed across these domain clusters, review GCCC Pass Rate 2026: What the Data Shows.
Final-Week Review Plan Mapped to Domains
In the last stretch before your test date, generic review techniques only help if they're anchored to specific GCCC domains. Here's a compressed four-week structure that assigns domain clusters to specific weeks rather than treating "study" as one undifferentiated block.
Foundational & Inventory Domains
- Background on CIS Controls, Standards, and Governance
- Inventory and Control of Enterprise Assets
- Inventory and Control of Software Assets
Access, Accounts, and Configuration
- Access Control Management
- Account Management
- Secure Configuration of Enterprise Assets and Software
Data, Detection, and Response
- Data Protection and Data Recovery
- Audit Log Management and Network Monitoring and Defense
- Incident Response Management
Third-Party, Training, and Full-Length Practice
- Service Provider Management and Security Awareness and Skills Training
- Penetration Testing and Malware Defenses
- Full timed practice run under 2-hour, 75-question conditions
This is a compressed reference, not a full methodology - for a complete week-by-week plan with daily tasks, cross-reference GCCC Study Guide 2026: How to Pass on Your First Attempt.
Renewal and CPE Facts
GCCC certification is valid for four years. Before it expires, you have two paths to keep it active:
- Earn 36 CPEs (Continuing Professional Experience credits) within the four-year cycle, or
- Retake the current exam version
Either path also requires paying the $499 renewal fee. Because CIS Controls versions evolve (the current alignment is v8), retaking the exam as your renewal method also has the side benefit of updating your knowledge to whatever framework version is current at that time.
Who Hires GCCC Holders
GCCC is built around implementing and auditing the CIS Critical Security Controls, so it tends to matter most in roles that are directly responsible for control implementation, security architecture, or compliance auditing against a controls framework - rather than purely offensive roles. Government contractors, critical infrastructure operators, and organizations undergoing CIS-based compliance audits are common employers of GCCC holders.
If you're weighing whether the credential fits your career trajectory, two resources go deeper than this cheat sheet allows: GCCC Salary Guide 2026: Complete Earnings Analysis covers compensation context, and Is the GCCC Certification Worth It? Complete ROI Analysis 2026 weighs the certification against its cost and renewal obligations. You can also browse current openings referencing the credential through GCCC Jobs.
For newcomers still getting oriented on terminology, foundational explainers like What Is GCCC?, GCCC Meaning, What Does GCCC Stand For?, and What Is GCCC Certification? cover the basics this cheat sheet assumes you already know. Formal preparation options are outlined in GCCC Training, and scheduling specifics - including how testing windows line up with GIAC's calendar - are detailed in GCCC Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Before your test day, run a handful of realistic practice questions on our GCCC practice test platform to confirm your index actually works under timed conditions - it's a better readiness check than re-reading notes. You can also revisit this page any time; bookmark this cheat sheet for a quick pre-exam refresh, and use the practice test homepage to schedule additional timed drills as your date approaches.
FAQ
The GCCC exam has 75 questions with a 2-hour time limit, and you need a 71% score to pass.
No. GCCC is open book for hardcopy references only. Electronic files, internet access, and any materials resembling exam questions are prohibited.
You receive a 120-day attempt window from the time of registration to schedule and complete the exam.
The current GCCC exam is aligned with CIS Controls v8, spanning 19 published certification objectives.
Beyond the initial $999 attempt, renewal every four years costs $499 and requires either 36 CPEs or a retake of the exam.