GCFA — GIAC Certified Forensic Analyst
GIAC's advanced digital-forensics and incident-response credential, examined in three hours over 82 questions and normally taken alongside the six-day SANS FOR508 course.
Type: CertificationWorking practitionersLaw enforcement & investigators
Offered by GIAC (Global Information Assurance Certification)
The facts
- Cost
- $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR508 course is listed separately at $8,780; SANS bundles an attempt with a course purchase but does not publish the bundled add-on price as static text.Figure read 2026-09-12 from www.giac.org/pricing
- Prerequisites
- None published. GIAC's page describes practical experience as helpful for mastering the material, not as an entry requirement.
- Format
- One proctored exam, remote or at a test centre. 82 questions, 3 hours, 71% to pass, delivered in GIAC's CyberLive format — performance-based tasks in a live lab environment rather than only multiple choice.
- Length
- Exam only; the attempt must be completed within 120 days of activation. The paired FOR508 course is six days instructor-led or about 36 hours self-paced.
- Renewal
- Four-year cycle. 36 CPE credits plus a $499 renewal fee; additional renewals within two years of a full-price renewal are $249.
- Accreditation
- GIAC states it is an active accredited ISO/IEC 17024 personnel certification body through ANAB. The GCFA page also displays DoD 8140 alignment.
- Who it suits
- A working incident responder or enterprise DFIR analyst whose employer will fund training, or a Work Study applicant willing to compete for a discounted place.
- Audience
- Working practitioners · Law enforcement & investigators
Strengths
- The most widely recognised DFIR credential in enterprise incident response — if a job posting names one forensics certification, it is often this one.
- ISO/IEC 17024 accreditation through ANAB is a real, checkable quality signal that most vendor certifications in this field do not carry.
- The CyberLive format tests work performed in a live lab rather than recall alone, which is a meaningfully harder thing to pass without the underlying skill.
- The associated FOR508 course is genuinely current on enterprise-scale intrusion and threat-hunting technique, which is where most commercial DFIR work now sits.
Limitations
- Cost is the honest headline: the course plus attempt lands near $9,800 at list price, which prices out anyone without an employer budget or a Work Study place.
- It is oriented to enterprise intrusion response, not to the criminal-casework and courtroom-testimony side of forensics — IACIS CFCE or ISFCE CCE map closer to that.
- The credential does not certify that you have ever produced a defensible report or survived a Daubert challenge; it certifies an exam performance on a date.
- Renewal is a recurring $499 plus 36 CPE credits every four years, which is a real ongoing cost that first-time buyers routinely fail to budget for.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.