Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about ISACA's enterprise IT governance certification as of 2026, covering the four domains of the current exam content outline, the exam format, the five-year experience requirement, career paths, how DoD 8140 applies, and how CGEIT compares to CRISC, CISM and CISA. A complete reference for anyone weighing the CGEIT or trying to understand what it covers.
CGEIT is ISACA's certification for the governance of enterprise IT. ISACA describes it as framework agnostic and the only IT governance certification for the individual.
It validates the ability to assess, design, implement and manage a governance system that keeps IT pointed at business goals. The exam isn't asking whether you can configure a control or run an audit. It asks whether the enterprise has the right structures, roles and policies to direct IT, whether IT resources and investments are producing the benefits that were promised, and whether IT risk is being optimized rather than merely listed.
The credential requires five years of governance experience across at least three of the four domains, which puts it firmly in senior territory. It is ANSI/ANAB accredited under ISO/IEC 17024:2012, and it is issued and maintained by ISACA, the same association behind CISA, CISM and CRISC.
The governance framework, technology governance and strategic alignment, and information governance. The heaviest domain at 40% of the exam.
Sourcing, capacity and acquisition, then the resource lifecycle, workforce competency and contracted services. 15% of the exam.
Performance management, governance monitoring and reporting, and the business cases and metrics behind IT-enabled investments. 26% of the exam.
Risk frameworks, enterprise risk management, appetite and tolerance, and the risk management lifecycle. 19% of the exam.
Four things that set CGEIT apart from the other ISACA credentials and from governance certificates tied to a single framework.
A manager plans, builds and runs. A governing body evaluates, directs and monitors. CGEIT is the one ISACA credential written entirely for the second job. The supporting tasks in the outline start with words like establish, evaluate, direct and ensure, and the exam asks what the framework should require, who should be accountable, and how leadership will know it is working. Technical depth won't carry you through it; judgment about the enterprise will.
ISACA describes CGEIT as framework agnostic. Enterprise architecture, policies and standards, business cases and risk appetite are tested as governance practices, not as one framework's vocabulary, so the credential holds up whether your enterprise runs on COBIT, on an ISO standard, or on a governance model it built itself.
CGEIT holders tend to sit above the GRC function rather than inside it, and the credential reads that way to hiring committees. Our guide to the best certifications for GRC careers in 2026 covers where it fits among the credentials those roles ask for.
CGEIT is a governance credential. Whether it satisfies a specific DoD Cyber Workforce Framework (DCWF) work role depends on the current DoD 8140 Approved Qualifications Matrix, which maps certifications to work roles and proficiency levels under DoD Manual 8140.03 and changes as it is revised.
Before relying on any credential for a defense position, read the current matrix for the work role and proficiency level you are being hired against. It is published at public.cyber.mil. Among ISACA credentials, CISM and CRISC are the ones most often used to meet 8140 work role requirements.
Everything you need to know about the certification, the exam structure, and how to maintain CGEIT as of September 2026.
CGEIT sits near the top of the ISACA ladder, so the next move is usually sideways rather than up: deepening one of its four domains with the ISACA credential built for that work. All three below share the CGEIT exam format, and many governance leaders hold two or three of them.
ISACA's Certified in Risk and Information Systems Control takes Domain 4 of CGEIT and makes it a whole credential: risk assessment, response and reporting, and the controls that keep risk inside tolerance. It asks for three years of experience across two or more of its four domains. See our CRISC guide.
ISACA's Certified Information Security Manager covers running the security program: governance, risk, program management and incident management. It requires five years of information security experience, three of them in management, and its exam content outline changes on November 3, 2026. See our CISM guide.
ISACA's Certified Information Systems Auditor covers information systems audit and assurance across five domains. It requires five years of IS audit, control or security experience, and it is the credential for governance leaders who want to test the framework rather than only set it. See our CISA guide.
CGEIT is almost never a first certification. Most holders arrive by way of audit, risk or security management, hold one of those ISACA credentials already, and add CGEIT when their job shifts from running a function to governing the whole of IT. From there the paths branch toward security leadership, AI governance and privacy.
Earn the function-level credential
From running IT to governing it
Two questions to answer before you commit: can you certify, and should you pursue CGEIT specifically. Here's a straight answer to both.
You can certify in full.
You have at least five years of experience managing, advising, overseeing or otherwise supporting the governance of IT's contribution to an enterprise. That experience spans at least three of the four domains, at least one year of it relates to Domain 1, Governance of Enterprise IT, and all of it was gained within the ten years before you apply. Pass the exam, submit your application and the $50 processing fee, and you hold the full CGEIT.
You can still pass now.
Sit the exam before you meet the full requirement. Once you pass, you have five years from your passing date to submit your application as you finish earning the experience. This is common for people who have run IT audit or risk for years and have recently moved into a governance role, where the Domain 1 year is the piece still accruing. The exam does not have to wait for it.
CGEIT maps to governance, strategy and IT leadership roles across the private sector, government and advisory firms. These are the six titles where the credential shows up most often in postings and on the resumes of the people who hold it.
Owns the governance framework: the structures, roles, policies and standards that decide how IT decisions get made and who is accountable for them. The role CGEIT was written for, and the one where postings most often name it.
Answers to the board for whether IT is delivering on the enterprise strategy. CGEIT covers the evaluate, direct and monitor work that separates governing IT from running it, which is the part of the CIO job that gets people promoted into it.
Builds and defends the business cases for IT-enabled investments, then tracks whether the benefits show up. Domain 3 of the outline is this job description, from investment management and reporting to benefit evaluation methods.
Decides what the enterprise builds, buys or outsources, plans capacity, and manages the contracted services and relationships that result. Domain 2 covers sourcing strategies and contracted services by name.
Assesses a client's governance against a framework, finds the gaps, and helps leadership close them. Advisory firms hire for this work, and CGEIT is the credential that signals the candidate has done it rather than read about it.
Sets IT risk appetite and tolerance with the enterprise risk function and makes sure IT processes line up with legal and regulatory obligations. Domain 4 covers the risk strategy and frameworks this role lives in.
Four ISACA credentials that get shortlisted together. They share an issuer, an exam format and a maintenance cycle, and they split on what the work is and how many years of it you need. Here's how they line up.
| CGEIT | CRISC | CISM | CISA | |
|---|---|---|---|---|
| Issuer | ISACA | ISACA | ISACA | ISACA |
| Focus | Governance of enterprise IT | IT and enterprise risk, controls | Security management and governance | Information systems audit |
| Domains | 4 | 4 | 4 | 5 |
| Exam Format | 150 questions, 4 hours | 150 questions, 4 hours | 150 questions, 4 hours | 150 questions, 4 hours |
| Experience | 5 yrs governance across 3+ domains | 3 yrs across 2+ domains | 5 yrs infosec, 3 in management | 5 yrs IS audit, control, or security |
| Passing Score | 450 / 800 | 450 / 800 | 450 / 800 | 450 / 800 |
| Exam Cost | $575 member / $760 non-member | $575 member / $760 non-member | $575 member / $760 non-member | $575 member / $760 non-member |
| Renewal | 120 CPEs over 3 years | 120 CPEs over 3 years | 120 CPEs over 3 years | 120 CPEs over 3 years |
| DoD 8140 Approved | Check current matrix | Yes (check current matrix for roles) | Yes (Advanced) | Yes (Advanced) |
| Best For | CIOs, IT governance and strategy leaders | IT risk managers, GRC and controls professionals | Security managers and governance leads | IT auditors and assurance pros |
Pricing and renewal details vary by region and membership status. The CISM exam content outline changes on November 3, 2026; see our note on testing before or after that date. Many governance leaders hold more than one of these credentials, and ISACA lowers the annual maintenance fee for a member's third and later certifications.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Training Camp is an award-winning ISACA Elite+ Training Partner. Our official ISACA CGEIT boot camp covers all four domains of the current outline over three days, with your exam voucher, official ISACA courseware, and a free retake included. It runs live online and in person, and at select locations you can sit the exam on site when class ends.
The ISACA credential family, GRC career context, industry demand, neighboring certifications, AI in governance, and CPE rules for CGEIT candidates.
Where CGEIT sits among CISA, CISM, CRISC and the newer ISACA credentials, who each one is built for, and how the experience rules, exam formats and maintenance cycles compare. Start here if you are choosing between them.
Governance, risk and compliance hiring rewards a small set of credentials. How CGEIT stacks up against them for people who want to run the governance function rather than work inside it.
Banks and their regulators care about IT governance more than most industries. Which ISACA credentials show up in financial services postings, and where CGEIT earns its keep in that sector.
CRISC is the ISACA credential most often held alongside CGEIT, and Domain 4 of the CGEIT outline overlaps with it. A sober look at what CRISC costs, what it returns, and who should hold both.
Most CGEIT holders arrived by way of audit or security management. How to pick the ISACA credential that fits where you are now, and how each one sets up the governance work later.
AI systems are landing in the governance framework whether the framework was ready or not. What that means for the people who set IT policy, evaluate investments and report to the board.
ISACA wants 120 CPE hours every three years with a 20-hour annual floor. Here is how that compares with ISC2, CompTIA and the other bodies, and how to earn hours that count toward more than one credential.
The CGEIT exam content outline is organized into four domains, each carrying its own weight on the exam. Click any domain for what it covers.
The heaviest domain by a wide margin. It covers the governance framework itself, meaning its components, organizational structures, roles and responsibilities, strategy development, legal and regulatory compliance, organizational culture and business ethics, and then technology governance, which is how IT strategy is aligned with enterprise objectives through strategic planning, stakeholder engagement, communication and awareness, enterprise architecture, and policies and standards. It closes with information governance: information architecture, the information asset lifecycle, ownership and stewardship, and classification and handling.
The smallest domain, and the one about people, money and assets. IT resource planning covers sourcing strategies, resource capacity planning and the acquisition of resources, while IT resource optimization covers the IT resource lifecycle and asset management, assessing and developing the competencies of the workforce, and managing contracted services and the relationships behind them.
The domain about whether the enterprise got what it paid for. IT performance and oversight covers performance management, change management, governance monitoring, governance reporting, quality assurance, and process development and improvement, while management of IT-enabled investments covers building and evaluating the business case, investment management and reporting, performance metrics, and the methods used to evaluate whether promised benefits arrived.
Risk at the governance level rather than the assessment level. Risk strategy covers risk frameworks and standards, enterprise risk management, and risk appetite and risk tolerance, while risk management covers IT-enabled capabilities, processes and services, business risk, exposures and threats, the risk management lifecycle, and risk assessment methods.
Domains and weights reflect the ISACA CGEIT Exam Content Outline effective 2020, which is the outline in use as of September 2026 and the one the 2026 ISACA Exam Candidate Guide describes. ISACA has not announced a replacement.
The questions candidates ask most often when researching the Certified in the Governance of Enterprise IT certification.
CGEIT is ISACA's certification for the governance of enterprise IT. It validates the ability to design, implement and manage a governance system that keeps IT aligned with business goals, allocates IT resources sensibly, delivers measurable benefits from IT investments, and keeps IT risk inside what the enterprise will accept. ISACA describes it as framework agnostic and the only IT governance certification for the individual.
CGEIT fits people who direct, advise on or oversee how IT is governed: CIOs and IT directors, IT governance and strategy managers, IT portfolio and investment managers, governance consultants, and senior audit or risk professionals moving into governance. It isn't an entry-level certification, and it isn't a technical one. If you manage security operations or risk assessments day to day, CISM or CRISC is usually the closer fit.
As of September 2026 the CGEIT exam costs $575 for ISACA members and $760 for non-members. Once you pass and apply for certification there is a one-time $50 application processing fee, and the certification then carries an annual maintenance fee of $45 for members or $85 for non-members. ISACA reduces the maintenance fee to $25 and $50 for your third and later ISACA certifications.
The CGEIT exam is 150 multiple-choice questions over four hours (240 minutes). The questions ask what a governance leader should do, so several answers can look reasonable and you're picking the one a governing body should choose. Scores are scaled from 200 to 800 and you need 450 to pass. It's delivered at PSI test centers or online with a remote proctor, and it's offered in English and Chinese Simplified.
CGEIT requires a minimum of five years of experience managing, advising, overseeing or otherwise supporting the governance of IT's contribution to an enterprise. That experience has to span at least three of the four domains, at least one year of it has to relate to Domain 1, Governance of Enterprise IT, and all of it has to have been gained within the ten years before you apply.
Yes. You can sit and pass the exam first, then submit your certification application once you meet the experience requirement. ISACA gives you five years from your passing date to apply, so the exam never has to wait on your resume.
The four CGEIT domains are Governance of Enterprise IT at 40 percent, IT Resources at 15 percent, Benefits Realization at 26 percent, and Risk Optimization at 19 percent. Domain 1 alone is two fifths of the exam, and together with Benefits Realization it accounts for about two thirds of the questions.
CGEIT is maintained on a three-year cycle. You earn 120 Continuing Professional Education (CPE) hours across the cycle, with a minimum of 20 hours each year, pay the annual maintenance fee to ISACA by January 1, and agree to follow the ISACA Code of Professional Ethics.
CGEIT is a governance credential, and whether it satisfies a specific DoD Cyber Workforce Framework (DCWF) work role depends on the current DoD 8140 Approved Qualifications Matrix. Check the matrix at public.cyber.mil for the work role and proficiency level you're being hired against rather than assuming. Among ISACA credentials, CISM and CRISC are the ones most often used to meet 8140 requirements.
All four come from ISACA and share the same exam format: 150 questions, four hours, 450 out of 800 to pass. CGEIT covers the governance of enterprise IT as a whole, CRISC covers IT risk and controls, CISM covers running the security program as a manager, and CISA covers information systems audit and assurance. CGEIT, CISM and CISA each ask for five years of experience while CRISC asks for three.
No change is announced. The CGEIT exam content outline took effect in 2020 and is still the current outline according to the 2026 ISACA Exam Candidate Guide. This page describes that outline, and exams taken today test it.
For people who set or oversee how IT is governed, CGEIT remains the only certification aimed squarely at that work in 2026. It is ANSI/ANAB accredited under ISO/IEC 17024:2012, it carries the ISACA name that boards and audit committees already know, and it is framework agnostic, so it holds up whether your enterprise runs on COBIT or on a governance model of its own. It's less useful for people who want a hands-on technical track or who don't yet work near the governance layer.
Tell us where you are, from weighing the certification to working out funding or planning training for a governance or leadership team, and we'll help you map out the right path.