Cost breakdown
GCFAHow much does GIAC Certified Forensic Analyst (GCFA) cost?
The GCFA certification attempt is $999 on its own, and that is the whole exam cost if you pass first time: no application fee, no separate scheduling fee, and the proctoring is included whichever delivery you choose. Budget $999 for a self-studied attempt prepared from your own printed notes, and up to $1,499 if you add a GIAC practice test and a shelf of forensics references. The SANS course that the certification pairs with is priced separately and is many times the exam fee.
Cost breakdown
| Item | Cost | Detail |
|---|---|---|
| Exam voucher | $999 | The published US list price for one attempt at GCFA. |
| Retake | $899 | A second attempt is $899, $100 less than the first. |
| SANS training course | Varies | Optional and by far the largest cost. The certification attempt can be bought on its own. |
| GIAC practice test | $399 | A standalone certification attempt includes no practice tests. Only an attempt bought together with SANS training includes two. GIAC says the practice bank is limited and the same question can appear across practice tests, so buy one, late in preparation, and treat it as a rehearsal of the engine and the CyberLive hands-on items rather than a source of new material. |
| 45 day extension | $479 | The attempt must be completed within 120 days of activation. An extension can be bought from 30 days before the deadline until 30 days after it, and buying one cancels any exam appointment more than 24 hours away. Total access to an attempt, including every extension and retake, is capped at 570 days. |
| Missed or late-changed appointment | $175 | Cancelling or moving a proctored appointment with less than 24 hours notice, or not turning up, costs a reseating fee. The pricing page adds a 7 day extension to the attempt when the fee is paid. |
| Printed index and references | $0 to $100 | The exam is open book for printed material only, so the index you build during study goes into the room with you. Printing and binding it, and any reference books you want beside it, are the only preparation cost a self-studied attempt requires. |
| Renewal every four years | $499 | The certification maintenance fee, paid once every four years at renewal registration alongside 36 CPE credits. A second GIAC renewal within two years of a full renewal is charged at a reduced rate, which matters if you hold more than one GIAC certification. |
Exam pricing from GIAC, certification pricing ↗.
Ways to bring the cost down
Buy the attempt on its own if you already do incident response or forensics work. The certification does not require the course, and the objectives on the GIAC page are specific enough to study from: memory forensics, NTFS structures, timeline construction, Windows execution artifacts and the incident response process at enterprise scale.
Build the index as you study, not at the end. An open book exam rewards a candidate who can find the artifact table for a given question in under a minute, and the index is free to make. Printed only: no laptop, no tablet, no phone.
Use free tooling for the hands-on work. Volatility, the SANS SIFT workstation, Eric Zimmerman's tools and Plaso are all free, and the CyberLive questions put you in front of tools like these rather than asking you to describe them.
Schedule the exam inside the 120 day window and keep the appointment. An extension and a reseating fee together are more than half the price of a second attempt, and both are avoidable with a calendar entry.
If your employer will fund SANS training, ask for the bundle rather than the course alone. An attempt bought with affiliate training includes two practice tests, which the standalone attempt does not, and the work study program is the other route to the course at a fraction of the list price.
Work Study program
SANS runs a facilitator program that heavily reduces the cost of training plus a certification attempt in exchange for helping run an event.
For a good share of candidates somebody else pays this fee. The GI Bill, DoD and employer routes, with the rules each one publishes.
What a retake costs
A retake is $899, bought through the GIAC portal within 30 days of your exam deadline. Miss that window and the next attempt is a new $999 purchase with a fresh 120 days.
Every failure carries a 30 day wait before you can sit again, and buying the retake extends the deadline by 60 days, which includes the wait. A waiver can shorten the 30 days but a 14 day minimum applies to everyone.
After three failed attempts the attempt is closed and GIAC requires a year before a new one can be purchased, unless a documented waiver showing at least 30 hours of further training is accepted for one final sitting.
The minimum passing score is 71 percent, set by a psychometric study for exam versions released on or after 18 March 2023. Practice tests bought with the original attempt keep working until the extended deadline, but a retake adds no new ones.
Retake pricing from GIAC, certification pricing ↗.
What renewal costs across the full cycle
A GIAC certification is active for four years. Renewal registration opens at the two year mark, and renewing adds four years to the current expiry date rather than to the date you renew, so there is no reason to wait.
The route most holders take is 36 CPE credits over the four years plus the maintenance fee, paid at registration. Passing the current exam again is the other route and costs a full attempt.
Credits stack across certifications: a new GIAC certification or a SANS course can be applied to the CPE requirement of as many as five of your GIAC credentials, and additional renewals registered within two years of a full renewal are charged at a lower rate.
Letting it lapse means starting from a new certification attempt at full price, so the four year calendar entry is worth setting on the day you pass.
Cycle length: 4 years. GIAC states a certification is active for four years and requires renewal every four years, with renewal registration enabled at the 2-year mark before the expiration date. Renewing adds 4 years to the current expiration date rather than to the date of renewal. The CPE route asks for 36 credits over four years, and GIAC lists the certification maintenance fee as a non-refundable $499 payment due once every four years at the time of registration.
Typical preparation budget
Preparation for GCFA can genuinely cost nothing. The realistic range people spend is $0 to $500, and the top of that range buys convenience rather than a better chance of passing.
Our questions, explanations, and cheat sheets are free, and the explanation is never paywalled. That is the part of a paid practice set you are actually buying, so it is the part we do not charge for.
The cheapest way to avoid the $899 line on this page is to be ready before you book. Free GCFA practice questions with a full explanation on every answer.
Keep reading
- GCFA practice questions
Free sample questions with the full explanation on every answer.
- Free GCFA practice test
10 original questions, playable now. No account, no card.
- GCFA exam format
How many questions, how long, what the items look like, and how long it stays valid.
- GCFA passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is GCFA?
An honest difficulty read from the format, the clock and the weights.
- GCFA guide
Who it is for, study plans by experience level, and whether it is worth it.
Practice GCFA for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free GCFA questions