GIAC Critical Controls Certification (GCCC) icon

GIAC Critical Controls Certification (GCCC)

Practitioner Certification

The GIAC Critical Controls Certification (GCCC) certification is based on the CIS Critical Security Controls, a prioritized, risk-based approach to security. This certification ensures that candidates have the knowledge and skills to implement and execute the CIS Critical Controls recommended by the Center for Internet Security, and perform audits based on the standard.

Areas Covered

  • Background, purpose, and implementation of the CIS Critical Security Controls and related security standards; auditing principles
  • Inventory and control of enterprise assets; inventory and control of software assets; data protection; secure configuration of enterprise assets and software; account management
  • Access control management; continuous vulnerability management; audit log management; email and web browser protections; malware defenses; data recovery; Network infrastructure management
  • Network monitoring and defense; security awareness and skills training; service provider management; application software security; incident response management; penetration testing

Who is GCCC for?

  • Security professionals, auditors, CIOs, and risk officers
  • Information assurance auditors
  • System implementers or administrators
  • Network security engineers
  • IT administrators
  • Department of Defense (DoD) personnel or contractors
  • Federal agencies or clients
  • Security vendors and consultants

Exam Format

  • 1 proctored exam
  • 75 questions
  • 2 hours
  • Minimum passing score of 71%

Delivery

NOTE: All GIAC Certification exams are web-based and required to be proctored. There are two proctoring options: remote proctoring through ProctorU, and onsite proctoring through PearsonVUE. Click here for more information.

GIAC certification attempts will be activated in your GIAC account after your application has been approved and according to the terms of your purchase. Details on delivery will be provided along with your registration confirmation upon payment. You will receive an email notification when your certification attempt has been activated in your account. You will have 120 days from the date of activation to complete your certification attempt.

Exam Certification Objectives & Outcome Statements

  • v8 Access Control Management
    The candidate will be familiar with processes and tools used create, assign, manage, and revoke access credentials and privileges for user, administrator, and service accounts for enterprise assets and software.
  • v8 Account Management
    The candidate will be familiar with processes and tools used to assign and manage authorization to credentials for accounts to enterprise assets and software.
  • v8 Application Software Security
    The candidate will be familiar with the processes and tools to manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.
  • v8 Audit Log Management
    The candidate will be familiar with the processes and tools used to collect, alert, review, and retain audit logs to help detect, understand, and recover from an attack.
  • v8 Background on CIS Controls, Standards, and Governance
    The candidate will be familiar with the background, history, and purpose of the CIS Controls, notable Security Standards, and Security Program Governance. The GIAC Critical Controls Certification exam is aligned with the current release, CIS Controls V8.0.
  • v8 Continuous Vulnerability Management
    The candidate will be familiar with the processes and tools used to continuously assess, track vulnerabilities on all enterprise assets, and remediate them, and to monitor sources for new threat and vulnerability information.
  • v8 Data Protection
    The candidate will be familiar with the processes and technical controls to identify, classify, securely handle, retain, and dispose of data.
  • v8 Data Recovery
    The candidate will be familiar with processes and tools used to establish and maintain data recovery practices to restore in-scope enterprise assets to a pre-incident and trusted state.
  • v8 Email and Web Browser Protections
    The candidate will be familiar with the processes and tools used to defend email and web based internet traffic from threats intending to manipulate human behavior through direct engagement.
  • v8 Incident Response Management
    The candidate will be familiar with process and tools to establish a program to develop and maintain an incident response capability to prepare, detect, and quickly respond to an attack.
  • v8 Inventory and Control of Enterprise Assets
    The candidate will be familiar with the processes and tools used to actively account for and manage the inventory of enterprise assets and all associated data throughout their life cycles.
  • v8 Inventory and Control of Software Assets
    The candidate will be familiar with the processes and tools used to actively manage all software on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.
  • v8 Malware Defenses
    The candidate will be familiar with the processes and tools used to prevent or control the installation, spread, and execution of malicious applications on enterprise assets.
  • v8 Network Infrastructure Management
    The candidate will be familiar with processes and tools used to establish, implement, and actively manage network devices, in order to prevent attackers from exploiting vulnerable network services and access points.
  • v8 Network Monitoring and Defense
    The candidate will be familiar with the processes and tools that establish and maintain comprehensive network monitoring and defense against security threats across the enterprise’s network infrastructure and user base.
  • v8 Penetration Testing
    The candidate will be familiar with process and tools used to test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls, and simulating the objectives and actions of an attacker.
  • v8 Secure Configuration of Enterprise Assets and Software
    The candidate will be familiar with the processes and tools to establish and maintain the secure configuration of enterprise assets and software.
  • v8 Security Awareness and Skills Training
    The candidate will be familiar with processes to establish and maintain a security awareness program to increase the workforce's security consciousness and skills in order to reduce cybersecurity risks to the enterprise.
  • v8 Service Provider Management
    The candidate will be familiar with processes to evaluate service providers who hold sensitive data, or are responsible for an enterprise’s critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately.

Other Resources

  • Training is available in a variety of modalities including live training and OnDemand.
  • Practical work experience can help ensure that you have mastered the skills necessary for certification
  • College level courses or self paced study through another program or materials may meet the needs for mastery.
  • Get information about the procedure to contest exam results.

Practice Tests

  • These tests are a simulation of the real exam allowing you to become familiar with the test engine and style of questions.
  • Practice exams are a gauge to determine if your preparation methods are sufficient.
  • The practice bank questions are limited so you may encounter the same question on practice tests when multiple practice tests are purchased.
  • Practice exams never include actual exam questions.
  • Purchase a GCCC practice test here.
  • GIAC recommends leveraging additional study methods for test preparation.

Find Affiliate Training

Explore affiliate training options to prepare for your GIAC certification exam.