GCCC certification: cost, exam format and training

What is the GCCC certification?

GCCC stands for GIAC Critical Controls Certification. GIAC says it validates a practitioner’s command of the CIS Critical Security Controls, which it describes as a prioritised, risk-based approach to security. The scope is the 18 controls of CIS Controls Version 8.

GCCC is not about one technical discipline. It is about running a security programme against a recognised control framework: knowing what each control asks for, how to implement it, and how to audit whether it is in place.

That is reflected in GIAC’s audience list: security professionals, auditors, CIOs and risk officers, information assurance auditors, system implementers and administrators, network security engineers, IT administrators, Department of Defense personnel and contractors, federal agencies, and security vendors and consultants. GIAC lists no prerequisites.

Source: GIAC — GIAC Critical Controls Certification (GCCC). Checked 10 October 2026.

How much does the GCCC certification cost?

GIAC’s pricing page lists a standalone GCCC certification attempt at US$999. A retake costs US$899, an attempt extension US$479, the renewal US$499 and an official practice exam US$399. GIAC offers no demo questions for GCCC.

A missed proctored appointment costs a US$175 reseating fee. All prices are in US dollars and exclude sales tax.

Training is a separate cost if you choose it: SANS lists the OnDemand version of SEC566, the course GIAC links to GCCC, at US$7,650.

Source: GIAC — Certification pricing and fees. Checked 10 October 2026.

GCCC exam format: questions, time and passing score

The GCCC exam is one proctored exam with 75 questions and a 2-hour time limit — about a minute and a half per question.

GIAC has set the passing score for the GCCC exam at 71%. GIAC states this applies to all candidates who receive the exam version released on or after 30 September 2014, and asks candidates to check their GIAC account for the format and passing score of their own attempt.

You can test remotely through ProctorU or onsite at a Pearson VUE test center. A standalone attempt gives you 120 days from activation to sit the exam.

Source: GIAC — GIAC Critical Controls Certification (GCCC). Checked 10 October 2026.

Is the GCCC exam open book?

Yes. GIAC exams are open book format: printed books and printed or handwritten notes are allowed. They are not open internet or open computer, so you cannot pull up the CIS Controls document or any file on screen.

A printed copy of the controls and safeguards with your own index is therefore one of the most useful things to bring. Material that looks like practice test or exam questions with answers is prohibited in the testing room.

Source: GIAC — Proctor program overview. Checked 10 October 2026.

What is on the GCCC exam?

GIAC publishes nineteen exam certification objectives: one on the background of the CIS Controls, standards and governance, and one for each of the 18 controls. GIAC does not publish weightings, so every control deserves attention.

• Background on CIS Controls, Standards, and Governance
• Inventory and Control of Enterprise Assets
• Inventory and Control of Software Assets
• Data Protection
• Secure Configuration of Enterprise Assets and Software
• Account Management
• Access Control Management
• Continuous Vulnerability Management
• Audit Log Management
• Email and Web Browser Protections
• Malware Defenses
• Data Recovery
• Network Infrastructure Management
• Network Monitoring and Defense
• Security Awareness and Skills Training
• Service Provider Management
• Application Software Security
• Incident Response Management
• Penetration Testing

Source: GIAC — GIAC Critical Controls Certification (GCCC). Checked 10 October 2026.

GCCC course: SANS SEC566

The course GIAC links to GCCC is SANS SEC566: Implementing and Auditing CIS Controls. SANS offers it as five days instructor-led or 30 hours self-paced, worth 30 CPEs, with the OnDemand version listed at US$7,650.

SANS recommends a basic understanding of information security concepts and SEC401: Security Essentials or equivalent knowledge before taking it.

One detail to watch: the SEC566 course overview refers to CIS Critical Security Controls v8.1, while GIAC’s GCCC page names Version 8. The course is optional — GIAC does not require training — but if you study on your own, check which version your GIAC account lists for your attempt.

Source: SANS Institute — SEC566 course page. Checked 10 October 2026.

GCCC study plan: how to pass

Take the controls in order. For each one, write down what it requires, which safeguards implement it, and what evidence an auditor would ask for. Questions on a framework exam often turn on that distinction between implementing a control and verifying it.

Build your printed index as you go, then test it under time pressure. GIAC sells an official GCCC practice exam for US$399; GIAC states that practice exams never include actual exam questions and that the practice bank is limited, so repeated tests can show the same question.

Avoid dumps. GIAC’s exam integrity policy lists any use of or reference to “exam dump” sites with actual or possible GIAC questions as misconduct, with sanctions that include revocation of previously issued GIAC certifications and bans from future GIAC programmes.

Source: GIAC — Exam integrity policy. Checked 10 October 2026.

GCCC renewal

GIAC certifications stay active when you collect 36 credits over four years. The GCCC renewal fee is US$499.

Because the CIS Controls themselves are revised over time, renewal is also a good moment to check whether GIAC has updated the GCCC objectives — GIAC states that it periodically reviews and may update certification specifications.

Source: GIAC — Certification renewal. Checked 10 October 2026.

GCCC vs GSEC

GSEC, GIAC Security Essentials, tests broad hands-on security knowledge: 106 questions in 4 hours with a 72% passing score on the version released on or after 6 April 2026. GCCC is shorter — 75 questions in 2 hours — and narrower: one framework, examined from the implementation and audit side. Both cost US$999 per standalone attempt.

SANS recommends SEC401, the GSEC course, or equivalent knowledge before SEC566. If you are new to security, that suggests building the broad base first and adding GCCC once you work with control frameworks, audits or compliance programmes.

Source: GIAC — GIAC Security Essentials (GSEC). Checked 10 October 2026.

GCCC practice questions

Certsqill’s GCCC practice questions come with an explanation for every answer option and a readiness score per domain, so you can see which controls still need work before you book the exam.

GCCC questions people ask

What is the GCCC certification?

The GIAC Critical Controls Certification, which validates command of the 18 CIS Critical Security Controls (Version 8). Source: GIAC, checked 10 October 2026.

How much does the GCCC exam cost?

US$999 for a standalone certification attempt; a retake costs US$899 and a practice exam US$399, excluding sales tax. Source: GIAC pricing, checked 10 October 2026.

How many questions are on the GCCC exam?

75 questions in one proctored exam with a 2-hour limit. Source: GIAC GCCC page, checked 10 October 2026.

What is the GCCC passing score?

71%. Source: GIAC GCCC page, checked 10 October 2026.

Is the GCCC exam open book?

Yes, for printed books and notes; no internet or stored files. Source: GIAC proctor program overview, checked 10 October 2026.

Which course prepares for the GCCC cert?

SANS SEC566: Implementing and Auditing CIS Controls — five days instructor-led or 30 hours self-paced. Optional for the exam. Source: SANS Institute, checked 10 October 2026.

Which version of the CIS Controls does GCCC cover?

GIAC’s GCCC page names the 18 controls of Version 8; the SANS SEC566 overview refers to v8.1. Check your GIAC account for your attempt. Checked 10 October 2026.

How long do I have to take the GCCC exam?

120 days from activation of a standalone attempt; an extension costs US$479. Source: GIAC, checked 10 October 2026.

How do I renew GCCC?

Collect 36 credits over four years and pay the US$499 renewal fee. Source: GIAC, checked 10 October 2026.