The four CGEIT domains are Governance of Enterprise IT at 40%, IT Resources at 15%, Benefits Realization at 26%, and Risk Optimization at 19%. Those names and weights come from ISACA's CGEIT Examination Content Outline effective 2020, the outline in force for the 2026 exam. Your 150 questions are sampled against that blueprint across the 4-hour sitting.
Read those numbers again, because they are lopsided in a way most candidates ignore. Domain 1 and Domain 3 together are 66% of the exam and Domain 2 is 15%, so a candidate who divides study time into four equal blocks spends a quarter of the effort on a sixth of the paper. That is a wide miss on a credential that costs a full registration fee to retake.
What are the four CGEIT domains and their weights?
| # | Domain | Weight | Roughly, of 150 items |
|---|---|---|---|
| 1 | Governance of Enterprise IT | 40% | about 60 |
| 2 | IT Resources | 15% | about 23 |
| 3 | Benefits Realization | 26% | about 39 |
| 4 | Risk Optimization | 19% | about 28 |
The item counts are arithmetic on the published weights rather than an ISACA-published per-domain count, so treat them as a planning aid. The weights themselves are exact.
One point of housekeeping before the detail. The 2020 outline is current with no successor announced, but ISACA refreshes job practices every three to four years and this one is six years old. Check the CGEIT Exam Content Outline page on isaca.org before you build a schedule around these weights, rather than trusting any page, this one included, to be right in six months.
What does Domain 1, Governance of Enterprise IT, cover?
Forty percent, split into three sub-areas. 1A Governance Framework is the design work: the components a framework needs, the structures and roles that run it, how strategy development plugs into it, how legal and regulatory compliance becomes a governance outcome rather than a checkbox, and how culture and business ethics decide whether any of it is lived or merely documented.
1B Technology Governance is the alignment work: keeping governance strategy pointed at enterprise objectives, evaluating and directing strategic planning, engaging stakeholders, running communication and awareness, folding enterprise architecture into planning, and setting policies and standards. 1C Information Governance treats information as a governed asset in its own right, through information architecture, the asset lifecycle, ownership and stewardship, and classification and handling.
What the exam actually asks here is a repeating question in different clothes: who is accountable, and what should the governance body do first. The reliable instinct is to establish structure, accountability, or a repeatable process before reaching for a specific control or tool. COBIT 2019's split between governance and management is the spine of the whole domain, and ISO/IEC 38500's Evaluate, Direct, Monitor model supplies the vocabulary.
This domain is the exam. Forty percent of the paper, and the only domain ISACA singles out in the certification experience rule, which wants a minimum of one year of Domain 1 work inside the five-year total. If you master one thing, master telling a governance action apart from a management action. That single distinction disqualifies wrong options across all four domains.
What does Domain 2, IT Resources, cover?
Fifteen percent, two sub-areas, and the shortest section in this post for a reason. 2A IT Resource Planning covers sourcing strategies, capacity planning, and acquisition. 2B IT Resource Optimization covers the resource lifecycle and asset management, competency assessment and development, and the management of contracted services and relationships.
The exam's angle on all six subtopics is close to a single idea: you can outsource the work, never the governance. Expect stems where a function has moved to a provider, an SLA is being missed, or the enterprise leans hard on one vendor, and the keyed answer keeps enterprise accountability where it started. Skills and capacity get the same treatment, as governed enterprise resources rather than things each manager sorts out locally.
So this is the worst place to spend a first study week. Not because it is unimportant, but because it is cheap: one principle plus six subtopic labels covers most of what the exam does with it, and roughly 23 items is not where a marginal score is won or lost. Learn it properly, learn it late, and do not let it eat time Domain 1 needs.
What does Domain 3, Benefits Realization, cover?
Twenty-six percent, and the domain candidates most often underestimate because the title sounds like finance. 3A IT Performance and Oversight covers performance management, change management, governance monitoring and reporting, quality assurance, and process improvement. 3B Management of IT-Enabled Investments covers business case development and evaluation, investment management and reporting, performance metrics, and benefit evaluation methods including TCO, ROI, NPV, and payback.
The recurring test here is whether value was actually realized, not whether it was forecast, approved, or reported on a slide. An investment with a glowing business case that nobody tracked after launch is a governance failure, and the questions are built to see whether you know that. The other half of the domain is oversight discipline: monitoring that leads to a decision, and reporting a board can act on rather than raw metrics.
Put Domain 3 next to Domain 1 and you are looking at 66% of the paper, which is the pairing that should shape your calendar. It is also where technically strong candidates lose points, because a delivery-minded professional picks the option that gets the project done while the exam wants the option that proves the benefit landed. If your background is engineering or delivery rather than portfolio oversight, this is your weak spot, and how hard the CGEIT exam is goes further into why that mindset gap costs more than any content gap.
What does Domain 4, Risk Optimization, cover?
Nineteen percent, two sub-areas. 4A Risk Strategy covers risk frameworks and standards, enterprise risk management, and risk appetite and tolerance. 4B Risk Management covers IT-enabled capabilities, processes and services, business risk with its exposures and threats, the risk lifecycle, and risk assessment methods.
Anchoring is the skill being tested. A response is judged against appetite and tolerance, not against how uncomfortable the risk feels, and IT risk has to be expressed in business terms before a board can decide anything with it. Transfer, by contract or insurance, never removes enterprise accountability. Confusing appetite with tolerance is the most reliable way to lose an otherwise winnable item here.
A warning for risk people. If you already hold CRISC or work in risk, this domain reads as familiar and you will be tempted to over-study it because it is comfortable. Resist. CGEIT wants the board's framing of risk, not the practitioner's, and 19% is a poor return on a week you enjoyed. If you have never done governance-level risk work, the appetite and tolerance material is worth a dedicated evening, because it underpins the keyed answer in more Domain 4 items than any other concept.
How do the 38 CGEIT Supporting Tasks relate to the domains?
Underneath the four domains and their nine sub-areas, the outline lists 38 Supporting Tasks: granular statements of what a CGEIT-level professional is expected to do, carrying scope the sub-area labels miss on their own, such as shared-services alignment, prioritization of IT initiatives, and managing investments across their economic lifecycle. The list is front-loaded in the same direction as the weights, governance framework and strategic planning tasks making much the largest block. ISACA does not tag each task to a domain, so read the sequence rather than trying to score it.
The tasks are more useful for their verbs than for the list. They repeat Evaluate, Direct, Monitor, Ensure, Establish, and Align, and that vocabulary is not decoration. Evaluate, Direct, Monitor is ISO/IEC 38500's governance model and COBIT 2019's governance domain, sitting above the management domains that plan, build, run, and assess. Ensure and Establish are oversight verbs too: you make certain a process exists and works, you do not execute it.
That tells you the cognitive level the exam tests. Not one of the 38 tasks asks you to define or describe anything. So when a stem offers a technically correct action a manager would perform alongside a duller option about establishing accountability or monitoring against objectives, the second is usually keyed. Reading the task verbs once is worth more than memorizing all 38 statements.
Do the CGEIT domain weights decide whether you pass?
No, and this is the misreading a weights post invites, so it is worth being blunt. Your result is a scaled score from 200 to 800, with 450 to pass, calculated from the total items you answered correctly across the whole paper. There is no per-domain bar.
Domain-level results arrive alongside the score as feedback on where you were stronger and weaker. You cannot fail CGEIT because of Domain 2, and a strong Domain 1 performance genuinely does carry a weaker Domain 4. The weights decide how you allocate study time, not how the pass decision is made.
One thing not to do with the pass mark: do not convert 450 out of 800 into a percentage. Scaled scores are not percentages of items correct, and the arithmetic produces a number that means nothing.
How should you split study time across the CGEIT domains?
Start with Domain 1 and Domain 3 and give them the majority of your calendar. They share the COBIT 2019 vocabulary, and Domain 3's oversight material makes far more sense once Domain 1's framework material is in place. Domain 4 comes next. Domain 2 goes last, in a short concentrated block, where its 15% belongs.
Weighted coverage is also what to look for in your material, which is why our CGEIT study guide follows the 40/15/26/19 split rather than giving each domain an equal chapter, with a full-length 150-question practice exam weighted the same way. Whatever you study from, check the page count follows the blueprint. Plenty of material does not.
Then convert the weights into practice rather than reading. The exam is scenario-driven, with BEST, MOST, FIRST, and GREATEST framing where several options are defensible, so the domains tell you which decision patterns to rehearse most. Our 12-week CGEIT study plan lays that out week by week, and if you are still deciding whether the credential fits your role, start with what the CGEIT certification is.
FAQ
How many domains does the CGEIT exam have?
Four, under the Exam Content Outline effective 2020: Governance of Enterprise IT at 40%, IT Resources at 15%, Benefits Realization at 26%, and Risk Optimization at 19%. The exam moved from five domains to four in 2020. Confirm the outline on ISACA's CGEIT Exam Content Outline page before planning around them.
Which CGEIT domain is the most heavily weighted?
Domain 1, Governance of Enterprise IT, at 40%. It is the largest by a wide margin, the one ISACA's certification experience rule singles out with a minimum of one year, and the source of the governance-versus-management distinction that decides questions in the other three. Domain 1 plus Domain 3 accounts for 66% of the paper.
Do you have to pass each CGEIT domain separately?
No. The pass decision rests on one scaled score from 200 to 800, with 450 required, based on total items correct across the whole exam. Domain-level results are reported for information only and create no individual bars to clear.
How many questions are there per CGEIT domain?
ISACA publishes the weights, not a per-domain item count. Applying the percentages to 150 questions gives roughly 60 items for Domain 1, 23 for Domain 2, 39 for Domain 3, and 28 for Domain 4. Use that for planning and treat it as an estimate rather than a fixed structure.
Looking for a plain-English CGEIT guide? ISACA CGEIT: Simply Certified Study Guide covers all four domains at their 40/15/26/19 weights, with a full-length 150-question practice exam, every answer explained.
Simply Certified is an independent publisher. CGEIT and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.