GNFA — GIAC Network Forensic Analyst
GIAC's network-forensics credential, covering packet and flow analysis, protocol reconstruction and log-based investigation, paired with the SANS FOR572 network forensics course.
Type: CertificationWorking practitioners
Offered by GIAC (Global Information Assurance Certification)
The facts
- Cost
- $999 for the certification attempt on its own ($899 for a retake). The paired SANS FOR572 course is priced on its SANS course page; we could not resolve that page at the time of writing, so treat the course figure as unconfirmed and check SANS directly.Figure read 2026-09-12 from www.giac.org/pricing
- Prerequisites
- None published.
- Format
- One web-based proctored exam, remotely proctored or at a Pearson VUE centre. 66 questions, 3 hours, 70% to pass.
- Length
- Exam only. The paired FOR572 course is a six-day SANS course.
- Renewal
- Four-year cycle. 36 CPE credits plus a $499 renewal fee; additional renewals within two years of a full-price renewal are $249.
- Accreditation
- GIAC states it is an active accredited ISO/IEC 17024 personnel certification body through ANAB.
- Who it suits
- An established DFIR practitioner adding network evidence to an existing endpoint skill set, usually as a second or third GIAC certification.
- Audience
- Working practitioners
Strengths
- Network evidence is the half of an intrusion investigation that endpoint-focused credentials leave out, and almost nobody else certifies it specifically.
- Directly useful in cases where the endpoints are gone, wiped or unavailable and the only surviving record is traffic and logs.
- Same ANAB/ISO 17024 accreditation as the rest of the GIAC family.
Limitations
- Narrow. On its own it does not qualify anyone to run a disk or mobile examination, and it is a poor first certification.
- We could not verify the current FOR572 course price from the SANS course page, so the full cost of the usual course-plus-exam route is unconfirmed here.
- Network forensics work is concentrated in larger enterprises and consultancies; in smaller civil practice there may be very little of it to bill.
- Recurring $499 renewal every four years.
Sources
Costs, prerequisites and exam formats in this field change often, and several providers price by region, cohort or employer agreement. Every figure on this page carries the date it was read and a link to the page it was read from. Confirm current terms with the provider before you spend anything.