Start with the part almost every search result buries. The CGEIT requirements gate the certification, not the exam. You may register and sit before you have the experience ISACA asks for, and you then have five years from your passing date to file the application. Plenty of qualified people talk themselves out of registering because they read the requirements page as an entry ticket. It is not.
The requirement itself is five or more years of professional experience managing, serving in an advisory or oversight role, or otherwise supporting the governance of the IT-related contribution to an enterprise. That experience has to span at least three of the four CGEIT domains, include a minimum of one year in Domain 1, and fall inside the 10 years before the date you apply. Then comes a USD 50 application processing fee, an annual maintenance fee, and 20 CPE hours a year for as long as you hold the credential. Still working out what the credential is for? What the CGEIT certification is covers that ground first.
Can you sit the CGEIT before you meet the experience requirement?
Yes. Registration and certification are two separate transactions with ISACA, and only the second one asks about your career.
The sequence that works for most candidates: sit while the material is fresh and your study runway is clear, then apply once the experience adds up. Five years from passing is a long runway for someone a year or two short. Waiting until you are certain you qualify and only then starting to study wastes the years in which you were accumulating the experience anyway.
One practical caution. Registration buys a six-month eligibility period in which to sit, so the exam clock is short even though the certification clock is long. Register when your study plan is ready, not as a motivational device. The full CGEIT bill sets out what each of those clocks costs.
What are the CGEIT requirements for experience?
Five or more years of professional experience managing, serving in an advisory or oversight role, or otherwise supporting the governance of the IT-related contribution to an enterprise.
Read that phrasing slowly, because the breadth in it is deliberate. Managing is only the first of three routes. Advisory and oversight work counts, and so does otherwise supporting governance, the clause that lets a program office lead, an internal auditor, a risk analyst, or a consultant qualify without ever having held a CIO title. Committee secretariat work, drafting the papers a board decides from, running a COBIT design workshop, reporting benefit realization to an executive sponsor: all governance support.
What does not count is doing IT well. Running a platform, shipping projects on time, managing a security team, keeping the lights on: that is management of IT rather than governance of it, and CGEIT draws the line hard in both the exam and the application. The self-test is whether your work touched a decision about enterprise direction, resourcing, benefit, or risk appetite, or executed a decision somebody else made. The first counts. The second, on its own, does not.
Which CGEIT domains does your experience have to cover?
At least three of the four, with a minimum of one year in Domain 1.
| Domain | Exam weight | Role in the experience rule |
|---|---|---|
| 1. Governance of Enterprise IT | 40% | Minimum one year, mandatory |
| 2. IT Resources | 15% | Counts toward the three-domain spread |
| 3. Benefits Realization | 26% | Counts toward the three-domain spread |
| 4. Risk Optimization | 19% | Counts toward the three-domain spread |
The three-of-four part is more generous than people expect. You are allowed to be a complete blank in one domain and still qualify, which suits candidates who never owned resourcing or never sat on the risk side.
The Domain 1 minimum is the clause that catches people, and it catches a specific type: the candidate with a deep program or risk background. Years of benefits tracking gives you Domain 3. Years in enterprise risk gives you Domain 4. Vendor and capacity work gives you Domain 2. That is three domains, five years, and an application that still fails, because none of it is Domain 1. Governance of Enterprise IT means the framework itself: the governance system, the operating model, the decision rights, the reporting line into the board. If your work has always been downstream of that structure rather than about it, find the year before you file. Map your own history against the four CGEIT domains explained on paper before you assume you are covered.
How far back can CGEIT experience go?
All of it has to fall within the 10 years preceding the application date. Work older than that does not count, however senior it was.
That window rarely bites a candidate currently in governance work. It bites two other groups: people returning to the field after a stretch somewhere else, and people who pass the exam and then sit on the result. Experience keeps aging out of the 10-year window while your five-year window to apply runs down, so a job that qualified on the day you passed may sit outside the lookback by the time you file four years later. If your qualifying years are already toward the back of the window, apply early.
What happens after you pass the exam?
Passing produces a score, not a certification. Certification is a separate application in which you evidence the experience above, it carries a one-time USD 50 application processing fee, and it must be filed within five years of your passing date. If that window closes, the pass stops supporting an application, so check with ISACA about your options rather than assuming the result keeps indefinitely. ISACA sets and revises all of this, so confirm the current fee and window on ISACA's get CGEIT certified page before you plan around them.
Who can verify your CGEIT experience?
ISACA's support knowledge base names a supervisor, manager, colleague, or client. ISACA's own get CGEIT certified page is narrower and names only a supervisor or manager. Worth knowing before you rely on the broader list, so take the question to ISACA if your only available signatory is a peer or a former client.
Practically, line the verifiers up before you file. The five years often span two or three employers, and the person who can honestly confirm what you did in 2019 may be harder to reach than the requirement makes it sound. Independent consultants should think about this earliest, since a client contact is both the most natural verifier and the most likely to have moved on.
Are there CGEIT experience waivers?
CGEIT has no general waiver or substitution scheme, and that is a real difference inside ISACA's own line.
This is how the 2026 Certification Exam Candidate Guide summarizes it across the line:
| Credential | Experience waivers |
|---|---|
| CISA | Available for a maximum of three years |
| CISM | Available for a maximum of two years |
| CRISC | No experience waivers or substitutions |
| CGEIT | No experience waivers or substitutions, though see the exception below |
If you are used to the CISA route, where degrees and other credentials can knock years off, or the CISM route with its two-year ceiling, reset your expectations. The CGEIT five years is meant to be five years of actual governance work.
Now the part that has to be reported honestly: ISACA's own pages do not agree with each other.
The Candidate Guide table above states "No experience waivers or substitutions." ISACA's support knowledge base article "What are the requirements to become CGEIT certified?", live on support.isaca.org, says the one year of Domain 1 experience "can be waived for those who hold the COBIT Design and Implementation certificate." The get CGEIT certified page addresses waivers nowhere at all.
We are not going to resolve that for you, and you should be suspicious of any site that does. Both documents are ISACA's, both are current, and they say different things about the same rule.
If you do not hold the COBIT Design and Implementation certificate, the answer is the same under either reading: no waiver, five years, one of them in Domain 1. If you do hold it, and the Domain 1 year is the only thing between you and an application, get ISACA's answer in writing, in a form you can point at later, rather than from a table on a blog. Including this one.
What does it cost to keep the CGEIT?
Money once a year and hours all year.
The money is the annual maintenance fee: USD 45 for ISACA members and USD 85 for nonmembers, due on 1 January for each year you hold the credential, dropping to USD 25 and USD 50 if the CGEIT is your third or later ISACA credential. Confirm the current amounts on ISACA's certification maintenance page, and see the CGEIT cost breakdown for how the rest of the bill fits together.
The hours are continuing professional education: a minimum of 20 CPE hours every year and 120 hours across each three-year reporting period. The annual minimum is the one people trip over, because 120 across three years looks like something you can back-load and the 20-a-year floor says otherwise. Keep your supporting records for 12 months past the end of the reporting cycle, since ISACA audits a sample of holders and the documentation is your problem, not your employer's.
What should you do if you are short on experience?
Sit the exam anyway, in our opinion, provided you can genuinely prepare for it. You get five years to close the gap, the material is easier to hold onto when you are studying it against work you are currently doing, and a pass in hand tends to change the kind of work you get offered, which is often how the missing Domain 1 year arrives in the first place.
Preparing is the condition attached to that advice. CGEIT is an executive judgment exam, and how hard the CGEIT exam is takes that apart properly. Our CGEIT study guide covers all four domains in plain English at their 40/15/26/19 weights, with a full-length 150-question practice exam where every option is explained. For a runway, the 12-week CGEIT study plan is a workable shape.
One last piece of housekeeping. Write your experience up domain by domain now, while you remember the detail, rather than the week you apply. Five years of governance work described from memory reads thin. The same five years mapped against Domain 1 through Domain 4, with dates, roles, and a named verifier for each, reads like what it is.
FAQ
What are the CGEIT experience requirements?
Five or more years of professional experience managing, serving in an advisory or oversight role, or otherwise supporting the governance of the IT-related contribution to an enterprise. That experience must cover at least three of the four CGEIT domains, include a minimum of one year in Domain 1, and fall within the 10 years before your application date. Confirm the wording on ISACA's get CGEIT certified page.
Can I take the CGEIT exam without five years of experience?
Yes. The experience rule applies to certification rather than exam registration, so you can sit first and apply once you qualify. You have five years from your passing date to file, along with the USD 50 processing fee.
Does CGEIT have experience waivers like CISA and CISM?
There is no general waiver or substitution scheme, unlike CISA at up to three years and CISM at up to two. ISACA's pages are inconsistent on one narrow point: the Candidate Guide says CGEIT has no waivers or substitutions, while its support knowledge base says the one year of Domain 1 experience can be waived for holders of the COBIT Design and Implementation certificate. Ask ISACA before relying on either version.
Who can sign off my CGEIT experience?
ISACA's support knowledge base lists a supervisor, manager, colleague, or client; the get CGEIT certified page names only a supervisor or manager. Line your verifiers up before you file, particularly for roles at previous employers, and check the list with ISACA if your only signatory is a peer or a client.
How many CPE hours does the CGEIT need each year?
A minimum of 20 annually and 120 across each three-year reporting period, alongside an annual maintenance fee of USD 45 for members or USD 85 for nonmembers, due 1 January. Keep supporting records for 12 months after the reporting cycle ends, because ISACA audits a sample of certification holders.
Looking for a plain-English CGEIT guide? ISACA CGEIT: Simply Certified Study Guide covers all four domains at their 40/15/26/19 weights, with a full-length 150-question practice exam, every answer explained.
Simply Certified is an independent publisher. CGEIT and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.