What Is GFACT?

GFACT Overview: The Basics

GFACT stands for GIAC Foundational Cybersecurity Technologies, and it's the entry point certification in the GIAC catalog, issued by Global Information Assurance Certification, an ANAB-accredited ISO/IEC 17024 personnel certification body affiliated with the SANS Institute. Where most GIAC certifications assume you already have hands-on security experience, GFACT is deliberately built for the beginning of that journey - before the specialized offensive, defensive, or forensic tracks even make sense.

The exam itself is a single proctored test: 75 questions, a 2-hour time limit, and a minimum passing score of 71 percent for all versions released on or after July 24, 2021. That passing bar was set through a formal psychometric standard-setting study, not an arbitrary round number, which matters when you're deciding how much margin to build into your prep. For a full breakdown of how that score was calculated and what it means for your study target, see the GFACT Passing Score 2026 guide.

Who GFACT Is Actually Built For

GIAC explicitly positions GFACT for career changers, students, new IT and cybersecurity hires, business professionals adjacent to security work, self-driven learners, and participants in re-skilling programs. There are no prerequisites - no required degree, no mandated work history, no earlier certification you must hold first. That's unusual in a field where most respected credentials expect you to already know the terrain.

This matters practically: if you're coming from a help desk role, a non-technical IT job, or a completely different industry, GFACT doesn't ask you to fake experience you don't have. It's designed to certify that you understand the foundational technology stack - hardware, operating systems, networking, basic programming logic, and core security concepts - that every later specialization builds on. If you're still unsure whether you meet the bar (spoiler: there isn't one), the GFACT Requirements 2026 guide walks through eligibility in detail.

The Nine GFACT Domains

GIAC publishes nine official Certification Objectives and Outcome Statements, and the exam content is organized into nine corresponding domains. Unlike more advanced GIAC exams that dive deep into one specialty, GFACT is intentionally broad - it's testing whether you have a working foundation across the technologies that underpin cybersecurity work.

Because the exam pulls from all nine areas without heavily weighting any single one, uneven prep is the most common way candidates lose points. For a domain-by-domain study allocation strategy, the GFACT Exam Domains 2026 guide goes deeper than what fits here.

Exam Format, Fees, and Logistics

All GIAC exams, including GFACT, are web-based and must be proctored - either remotely through ProctorU or onsite through Pearson VUE. Once your attempt is activated, you have 120 days to sit the exam, which is a generous window compared to some certification bodies but still worth tracking on a calendar rather than relying on memory.

A few logistics catch people off guard:

• Missing a scheduled proctored appointment triggers a $175 reseating fee plus only a 7-day extension - not a full reset of your window.
• Retaking a failed attempt costs $199, separate from the original $399 attempt fee.
• If you need more time within your access period, an attempt extension is also $199.

The exam question format itself is standard multiple-choice, delivered within the 2-hour limit. Notably, GFACT is not a CyberLive exam - meaning you won't be working in a live virtual environment during the test - even though the associated training course is built around hands-on labs. That distinction trips up candidates who assume the exam mirrors the lab-heavy course experience. For scheduling specifics and how to plan around the 120-day window, see GFACT Exam Dates 2026.

SEC275 and How Training Connects to the Exam

GFACT's associated training course is SANS SEC275: Foundations, authored by SANS CTO James Lyne. The course is built around hands-on labs in Linux, encryption, and programming - even though, as noted above, the certification exam itself is not a live-environment CyberLive test. The lab work exists to build muscle memory and conceptual understanding that then gets assessed through traditional exam questions rather than a live simulated environment.

This is a meaningful design choice worth understanding before you register: SEC275 teaches through doing, but GFACT tests through knowing. That means candidates who take the course still need to translate hands-on lab experience into the kind of recall and reasoning that a multiple-choice format demands. If you're weighing whether to take the formal course or self-study from other materials, GFACT Training covers what SEC275 includes and how it compares to independent study paths.

Sequencing this way front-loads the conceptual domains (Security Concepts, Hardware) that quietly support every other domain, so later topics like Exploitation & Mitigation make more sense once the fundamentals are locked in. For a more detailed week-by-week plan with resource recommendations, the GFACT Study Guide 2026 is the deeper resource.

Renewal, CPEs, and Keeping GFACT Active

GFACT certification is valid for four years from the date it's earned. To renew, you need 36 CPE credits accumulated within that active four-year window, plus the $199 renewal fee - or alternatively, you can simply retake the current version of the exam.

A detail many candidates miss: work experience earns CPE credit at a rate of 1 CPE per month, capped at 12 CPEs per year. That means work experience alone can't fully cover the 36-CPE renewal requirement across four years without supplementing through other qualifying activities like training, conferences, or additional certifications.

Another detail worth flagging clearly: renewed certifications extend four years from the current expiration date, not from the date you actually complete the renewal. Renewing early doesn't cost you time. Conversely, GIAC lists no grace period after expiration - so if your four years run out before renewal is complete, the certification lapses rather than entering a buffer period.

Where GFACT Fits in a Career Path

GFACT maps to DoD 8140 directives and NIST NICE work roles, which gives it concrete relevance for candidates targeting government, defense-adjacent, or federal contracting positions where credential mapping to these frameworks matters for role eligibility. Outside of that specific context, GFACT functions primarily as evidence that you understand the technical building blocks employers assume you already have when you walk into a junior security or IT role.

It's not a specialist credential - it won't, by itself, qualify you for a penetration testing or incident response position the way GIAC's more advanced certifications do. Its value is foundational: it signals that you can read a network diagram, navigate Linux and Windows environments, understand basic exploitation and mitigation concepts, and reason through simple code logic. That's the baseline many hiring managers otherwise have to assess through lengthy technical interviews. For a closer look at where GFACT holders actually land roles, see GFACT Jobs, and for whether the investment pays off relative to the $399 attempt cost, the Is the GFACT Certification Worth It? ROI Analysis covers that tradeoff directly. Earnings expectations at this entry level are addressed more specifically in the GFACT Salary Guide 2026.

Getting Started Without Wasting Time

If you're deciding how to begin, the practical sequence looks like this: confirm the nine domains against your current knowledge gaps, decide whether SEC275 or self-study fits your budget and timeline, register your attempt, and build a study plan around your weakest domains rather than a generic checklist. Because there are no prerequisites, the biggest barrier to starting isn't eligibility - it's simply committing to a study cadence that covers all nine domains rather than the two or three that feel most familiar.

Running through realistic practice questions is one of the more reliable ways to find out which domains actually need attention versus which ones just feel unfamiliar. You can start testing your current knowledge with practice questions modeled on the real exam format at GFACT Exam Prep before committing to a full study schedule. It's also worth keeping a condensed reference nearby during the final review stretch - the GFACT Cheat Sheet 2026 compresses the must-know facts from all nine domains onto a single page.

For a broader look at how GFACT sits relative to pass outcomes and what the exam data actually shows once you're deep into prep, the GFACT Pass Rate 2026 breakdown is a useful companion once you've got your study plan underway. And if you land here after searching variations of the term itself, related explainers like GFACT Meaning, What Does GFACT Stand For?, and GFACT Certification cover the same credential from slightly different angles.

FAQ