Is the CGEIT worth it? Yes, if you are already managing, advising on, or overseeing the governance of IT in an enterprise, and you can evidence five years of that work across at least three of the four domains with a minimum of one year in Domain 1. For that person the answer is not close. The CGEIT is the only credential in ISACA's line that names board-level IT governance as its subject, and it is accredited under ISO/IEC 17024:2012, which is the thing procurement teams and public sector tender documents actually check.
No, if any one of three things is true: you cannot meet the experience rule yet, you want a broad security or audit credential rather than a governance one, or your employer and your local market have never heard of the acronym. All three are common. The third is more common than CGEIT holders tend to admit, because ISACA's own CGEIT page puts the holder population at 8K+, which is small next to CISA. Each of those three gets a plain answer below, along with which of our other ISACA guides fits better.
Is the CGEIT worth it if you are already in a governance role?
Yes, and the reasoning is narrower than "it looks good on a resume". The CGEIT certifies a job nothing else in the line covers. The person who sits between an IT function and a board, translating investment into value and exposure into appetite, has had no obvious credential for that work.
Three conditions have to hold, and they are conjunctive rather than a menu.
First, the work is already yours. The requirement is five or more years managing, serving in an advisory or oversight role, or otherwise supporting the governance of the IT-related contribution to an enterprise. That experience must span at least three of the four domains, include a minimum of one year in Domain 1 (Governance of Enterprise IT), and fall within the 10 years before your application. The full CGEIT experience requirement is worth reading before you spend anything.
Second, you can get it verified. ISACA's support knowledge base allows a supervisor, manager, colleague, or client to verify, though the get-CGEIT-certified page names only a supervisor or manager. If your governance work happened on a board committee or in a consulting engagement rather than under a line manager, sort that out early.
Third, the credential has to be doing a job. A named IT governance credential earns its keep in regulated sectors, public sector procurement, consulting where clients score bid teams, and organizations that have adopted COBIT. If none of that describes your situation, keep reading, because the second half of this post is for you.
One thing worth knowing before you write off the experience rule: you may sit the exam before you meet it, and you then have five years from passing in which to apply. Genuinely useful if you are, say, four years in and want the exam behind you.
On waivers, be careful. The CGEIT has no general waiver or substitution scheme of the kind CISA offers (up to three years) or CISM offers (up to two): ISACA's 2026 Certification Exam Candidate Guide states that CGEIT allows no experience waivers or substitutions. ISACA's support knowledge base says something different, that the one year of Domain 1 experience can be waived for holders of the COBIT Design and Implementation certificate. Those two ISACA pages disagree, and the get-CGEIT-certified page is silent. If a waiver is load-bearing in your plan, confirm it with ISACA before you register.
What does the CGEIT actually cost?
Money first. ISACA revises these figures, so check current amounts on its own pages before you pay.
| Line item | What it buys | Figure |
|---|---|---|
| Exam registration, per attempt | One sitting, PSI test center or online proctored | USD 575 member, USD 760 nonmember |
| Certification application | Processing your experience evidence after you pass | USD 50, one-time |
| Annual maintenance fee | Keeping the credential active, due 1 January | USD 45 member, USD 85 nonmember |
| CPE | 20 hours a year, 120 per three-year cycle | Your time |
Registration is nonrefundable and nontransferable, and it starts a six-month eligibility clock. The member and nonmember rates are USD 185 apart, which is worth checking current dues against on ISACA's membership page. Maintenance also drops to USD 25 for members and USD 50 for nonmembers once CGEIT is your third or later ISACA credential, which is where most CGEIT candidates land. The full CGEIT cost breakdown carries the extension, rescore, and retake lines.
Then the cost nobody prices: 20 CPE hours a year, for as long as you hold it, roughly half a working week. If the credential is not doing a job for you, that is the line that quietly makes it a bad purchase, not the USD 575.
Does the CGEIT carry weight with employers?
It depends on who is reading, and the honest answer has two halves.
The half that helps: accreditation. The CGEIT is accredited under ISO/IEC 17024:2012 (ANSI/ANAB, Personnel Certification #0694), the same standing as CISA, CISM and CRISC. When a tender, a framework agreement, or a public sector role requires an accredited personnel certification, that reference is what a compliance reviewer looks for. It is also a real point of difference against ISACA's newer AI credentials, which do not carry it.
The half that hurts: size. ISACA's CGEIT page states that 8K+ professionals hold the credential. Set that against the CISA population and the gap is not subtle. Scarcity cuts both ways. On a shortlist at an organization that knows what CGEIT is, being one of a small number is leverage. In a general job market, an acronym a hiring manager has not seen does no work at all, and it will not appear in recruiter keyword filters because nobody thought to add it.
We are not going to put a salary number on this page. Governance pay varies by sector, geography and seniority far more than by credential. Do the local version instead: search your own market for governance and IT oversight roles and count how many name the CGEIT. That count is your answer, and it takes twenty minutes.
Should you take the CGEIT if you cannot meet the experience rule yet?
No. This is the one place where the answer is flat.
The CGEIT is not a credential you take to get into governance work. It is one you take because you are already doing it. The questions are scenarios with BEST, MOST, FIRST and GREATEST framing, where several options are defensible and the keyed answer is the governance action a board-level professional takes first. Candidates who have not sat in those rooms pick the technically correct answer over the governance one, and technically correct is how you lose points here.
There is also the arithmetic. Even if you passed today, the certification arrives only when the five years arrive. Paying USD 575 or USD 760 now buys you a score you cannot cash until the qualifying years are on the page, and you have five years from passing in which to file.
Take the CISA or the CRISC instead, and take it now. The CISA fits if your work touches audit, controls and assurance, and its experience rule allows substitutions the CGEIT does not. The CRISC fits if you are heading toward risk and control ownership, and it maps onto the CGEIT's Domain 4 when you come back to governance later. Either puts an accredited ISACA credential on your record years earlier.
Is the CGEIT the right choice for a broad security or audit credential?
No, and this is the mistake that costs people a registration fee.
The CGEIT is narrow on purpose. Domain 1 (Governance of Enterprise IT) is 40% and Domain 3 (Benefits Realization) is 26%, so two thirds of the exam is governance design and value delivery. IT Resources takes 15% and Risk Optimization 19%. There is no security operations content, no audit methodology, no control testing.
Here is the catalog map, plainly. IT audit, take the CISA. Security management, take the CISM. IT risk, take the CRISC. Privacy, take the CDPSE. Board-level IT governance and value delivery, take the CGEIT. If you are torn between the first two, our CISA versus CISM comparison settles it faster than a forum thread will, and what the CISM covers is the place to start if security leadership is the target.
Nobody needs all five. People who collect ISACA credentials for their own sake end up paying five maintenance fees and doing 20 CPE hours a year for credentials nobody asked them for.
Does the age of the exam outline change the answer?
It affects your timing more than your decision, and it deserves an honest paragraph in place of a rumor.
The CGEIT Exam Content Outline effective 2020 is the current one, with four domains at 40/15/26/19, and it is what the 2026 exam is built on. ISACA refreshes job practices periodically across its certifications, and no successor outline for CGEIT is announced. Be skeptical of anyone who claims to know when one is coming. If you are sitting in the next few months this is a non-issue; on a long runway, check ISACA's CGEIT Exam Content Outline page before you build a schedule around specific weights.
What does it take to pass, and is that the hard part?
The sitting is 150 multiple-choice questions in 4 hours, scored on a scale from 200 to 800 with 450 to pass, offered in English and Chinese Simplified at PSI test centers or online with a remote proctor and no country excluded. ISACA publishes no CGEIT pass rate, so treat any number you see quoted as invented.
It is a short syllabus that produces a hard exam, which is an unusual combination. Experienced practitioners usually know the material. What catches them is the ranking judgment: three defensible options and one a governance professional would take first. How hard the CGEIT exam is takes that apart, and the four domains explained shows where the questions sit.
That is where preparation earns its money. Our CGEIT study guide is built around the decision logic rather than around definitions, covering the four domains at their 40/15/26/19 weights with a full-length 150-question practice exam where every option is explained, including the wrong ones. For a runway shape, our 12-week CGEIT study plan works for someone already doing the job.
So what is the verdict on the CGEIT?
Take it if you are already in a governance, advisory or oversight role, you can evidence five years across three of the four domains with a year in Domain 1, and you work somewhere that recognizes the credential or bids for work requiring an accredited one. In that case it is the sharpest thing you can put next to your name, precisely because so few people have it.
Skip it if you are trying to break into governance rather than certify what you already do, if you want broad security or audit coverage, or if you searched your market and found nobody asking for it. Take the CISA or the CRISC instead and revisit the CGEIT when the experience is real. Still working out what the credential is? Start with what the CGEIT certification is.
FAQ
Is the CGEIT worth it for someone new to IT governance?
No. The certification requires five or more years of governance, advisory or oversight experience spanning at least three of the four domains, with a minimum of one year in Domain 1, and the exam itself tests executive judgment rather than recall. You can sit the exam before meeting the experience rule, but the credential only arrives once the experience does. The CISA or the CRISC is the better first ISACA credential.
How much does the CGEIT cost in total?
Registration is USD 575 for ISACA members and USD 760 for nonmembers per attempt, nonrefundable, plus a one-time USD 50 certification application fee after you pass. After that it is an annual maintenance fee of USD 45 for members or USD 85 for nonmembers, dropping to USD 25 or USD 50 once CGEIT is your third or later ISACA credential, plus 20 CPE hours a year. Confirm current figures on ISACA's own pages before you pay.
How many people hold the CGEIT?
ISACA's CGEIT page states 8K+ professionals hold the credential, which makes it much smaller than CISA. That works in your favor on a shortlist for a governance role and against you in a general job market where hiring managers may not recognize the acronym. Check job listings in your own sector and geography before you commit.
Is the CGEIT accredited?
Yes. The CGEIT is accredited under ISO/IEC 17024:2012 (ANSI/ANAB, Personnel Certification #0694), the same standing as CISA, CISM and CRISC, and unlike ISACA's newer AI credentials. That accreditation is what matters for public sector requirements and procurement processes that specify an accredited personnel certification.
Is the 2020 exam content outline still current?
Yes. The CGEIT Exam Content Outline effective 2020, with four domains at 40/15/26/19, is current for the 2026 exam and no successor is announced. ISACA refreshes its job practices periodically, so if you are planning a long study runway, confirm the outline on ISACA's CGEIT Exam Content Outline page before you build a schedule around specific domain weights.
Looking for a plain-English CGEIT guide? ISACA CGEIT: Simply Certified Study Guide covers all four domains at their 40/15/26/19 weights, with a full-length 150-question practice exam, every answer explained.
Simply Certified is an independent publisher. CGEIT and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.