What is CGEIT certification? Certified in the Governance of Enterprise IT is ISACA's credential for people who govern enterprise IT rather than run it. The exam is 150 multiple-choice questions in 4 hours across four domains, scored from 200 to 800 with 450 required to pass, and it costs USD 575 for ISACA members and USD 760 for nonmembers, sat through PSI at a test center or at home with a remote proctor.
The more useful answer is where it sits. CGEIT is neither a technical exam nor a management one. The questions ask what a board or an executive committee should evaluate, direct, and monitor, not what an engineer should configure or a manager should schedule. That is why Domain 1, Governance of Enterprise IT, carries 40% of the paper on its own, why COBIT 2019 runs through nearly every item, and why certification demands five or more years of governance experience. ISACA's CGEIT page puts the holder count at 8K+: a small, senior credential rather than an entry point.
Who is CGEIT actually for?
People who already sit in an advisory, oversight, or governance seat: IT governance and GRC leads, CIOs and deputy CIOs, IT directors accountable to a board, enterprise architects with a governance remit, audit and risk leaders who moved from doing the work to overseeing it, framework consultants, and portfolio leads who decide which IT-enabled investments get funded.
You can read the intended seat straight off the outline. The 38 supporting tasks behind the four domains run on a small set of verbs: evaluate, direct, monitor, ensure, establish, align. Not build, not implement, not operate. That is someone who sets the frame other people work inside, then holds them to it.
Who it is not for, said plainly: someone who wants a governance credential in order to move into governance work. If governance is a direction rather than a current responsibility, CISA or CRISC will get you further sooner.
What are the four CGEIT domains?
Every question maps to one of four. Under the CGEIT Exam Content Outline effective 2020, the published weights are:
| Domain | Weight |
|---|---|
| 1. Governance of Enterprise IT | 40% |
| 2. IT Resources | 15% |
| 3. Benefits Realization | 26% |
| 4. Risk Optimization | 19% |
Domain 1 is the governance framework itself: structures and roles, strategy development, regulatory alignment, culture and ethics, architecture, policies and standards. Domain 3 is business cases, investment management, performance metrics, and whether the value you promised the board arrived. Domain 2 is sourcing, capacity, the resource lifecycle, and contracted services. Domain 4 is risk frameworks, appetite and tolerance, and the risk lifecycle as a governance concern rather than a practitioner one.
Between them, Domains 1 and 3 take two thirds of the paper, and that distribution is an argument about what governance is: mostly designing the system and proving the value, with resources and risk as supporting acts. Plan your reading the same way, and see CGEIT domains explained for what sits inside each one.
Why does COBIT 2019 matter so much?
Because it is the spine of the exam, not a topic within it. COBIT 2019 is ISACA's framework for the enterprise governance of information and technology, and the CGEIT outline is shaped around its logic.
The distinction that earns the most marks is governance versus management: the EDM domain, where you evaluate, direct, and monitor, against APO, BAI, DSS, and MEA, where work gets planned, built, delivered, and measured. Above that sit the 40 governance and management objectives, the six governance system principles, the three governance framework principles, and the 11 design factors used to tailor a governance system. ISO/IEC 38500 supplies the same evaluate, direct, monitor model from the standards side.
If you cannot say which side of that line an activity falls on, fix that first: a large share of the hardest items turn on it.
What is the CGEIT exam format and how is it scored?
150 multiple-choice questions in a 4-hour session. That is 96 seconds an item: generous on a definition and tight on a three-paragraph board scenario. One stem, four options, one best answer.
Scoring is scaled. Your performance converts to a number between 200 and 800, and 450 passes. A scaled score is not a percentage, so do not convert it into one, and no published figure tells you how many items you need correct. Domain-level results come back for information only, because the pass decision rests on your total correct items across the whole paper. No per-domain bar, and no reason to leave anything blank.
ISACA does not publish CGEIT pass rates, so any figure you find quoted was estimated by somebody without access to the data, which is what how hard is the CGEIT exam works through instead. CGEIT is offered in English and Chinese Simplified only, and remote proctor chat is in English whichever language you sit in.
Is the CGEIT outline current?
The Exam Content Outline effective 2020 is what your exam is written against today, and ISACA has announced no successor.
The caveat most pages leave out is the age. ISACA refreshes its job practices every three to four years, and this outline is now six years old. Nothing is scheduled and we will not predict a change, but check the CGEIT Exam Content Outline page before you build a schedule around the 40/15/26/19 weights.
What does the CGEIT cost?
USD 575 for ISACA members and USD 760 for nonmembers, per attempt, nonrefundable and nontransferable. Certification after you pass costs a further USD 50 as a one-time application processing fee.
Registration opens a six-month eligibility period in which to schedule and sit, extendable once by six months at USD 75, so the window is real rather than decorative. You get four attempts per rolling 12 months and every one costs the full fee again. The two rates are USD 185 apart, which is the figure to weigh against ISACA's current dues before deciding whether to join. The rest of the bill is in CGEIT exam cost and fees.
What is the CGEIT experience requirement?
Five or more years of professional experience managing, serving in an advisory or oversight role, or otherwise supporting the governance of the IT-related contribution to an enterprise. That experience has to span at least three of the four CGEIT domains, with a minimum of one year in Domain 1, and all of it must fall within the 10 years preceding your application date. Once you pass, you have five years to apply.
The useful part is that you may sit the exam before you meet any of it, because the rule gates certification rather than the exam.
Do not plan around a waiver, though. CGEIT has no general waiver or substitution scheme of the kind CISA offers, at up to three years, or CISM, at up to two, and ISACA's own documents disagree about one narrow exception for holders of the COBIT Design and Implementation certificate. That is a thing to settle with ISACA rather than with a blog. CGEIT requirements and experience sets out both versions, what qualifies, and who is allowed to verify it.
Is CGEIT accredited, and what does upkeep involve?
CGEIT is accredited under ISO/IEC 17024:2012 (ANSI/ANAB, Personnel Certification #0694), the same standing as CISA, CISM, and CRISC, which matters where procurement rules name an accredited certification rather than vendor training.
Upkeep is an annual maintenance fee of USD 45 for members and USD 85 for nonmembers, due 1 January, dropping to USD 25 and USD 50 if CGEIT is your third or later ISACA credential, plus 20 CPE hours a year and 120 across each three-year reporting period. Not onerous, but permanent.
What does the exam actually test?
The thesis that should shape your preparation: CGEIT rewards the oversight decision over the correct action.
Stems are executive scenarios framed with BEST, MOST, FIRST, or GREATEST, and on a well-written item all four options are things a competent professional might do. Your job is to pick the one a board-level professional does first: usually the option that establishes accountability, aligns the decision with enterprise objectives, or gets the right body to evaluate and direct, rather than the one that fixes the immediate problem. Candidates from delivery backgrounds lose marks here consistently, because the instinct to solve is the instinct being tested against.
This is why explained practice matters more here than on a recall-heavy exam. Knowing the framework is not the same as knowing how ISACA ranks four reasonable governance responses. The ISACA CGEIT: Simply Certified Study Guide is built around that ranking problem, covering the four domains at their 40/15/26/19 weights with a full-length 150-question practice exam where every option is explained. To see the logic argued item by item, read CGEIT practice questions; for a paced schedule, the 12-week CGEIT study plan.
Where does CGEIT sit against the rest of the ISACA line?
Four credentials, four seats at the same table. CISA is assurance: examine what was built, report whether it holds. CISM is program ownership: security with a budget, a team, and a mandate. CRISC is the risk practitioner: size exposure, choose responses, report against appetite. CGEIT is the seat above all three, where the question is whether the enterprise's whole IT governance system is fit for purpose and delivering value.
It is also the smallest of the four by holder count, and the five-year, three-domain rule keeps it that way on purpose.
Our opinion: sit CGEIT if the framework is already yours to defend, meaning you present to a board or steering committee, own the investment prioritization process, or are the person others escalate governance questions to. Not as a first ISACA credential. Whether it earns its keep in your role is answered in is the CGEIT worth it.
FAQ
How many questions is the CGEIT exam and how long is it?
150 multiple-choice questions in a single 4-hour session, roughly 96 seconds per question. Delivery is through PSI at a test center or online with a remote proctor, and the exam is offered in English and Chinese Simplified only. Confirm the logistics on ISACA's CGEIT page before you book.
What score do you need to pass the CGEIT?
450 on a scaled range of 200 to 800. Because the score is scaled, there is no official percentage equivalent and you should not convert it into one. Domain-level results are reported for information only, so the pass decision rests on your total correct items across the whole paper. ISACA does not publish CGEIT pass rates.
Can I take the CGEIT exam before I have five years of experience?
Yes. The exam and the certification application are separate steps, so you can sit and pass while the experience accrues, then apply within five years of passing. What you cannot do is shorten the requirement in any general way, since CGEIT has no broad waiver or substitution scheme. ISACA's own pages differ on one narrow exception involving the COBIT Design and Implementation certificate, so confirm your position with ISACA.
How much does the CGEIT cost in total?
USD 575 for members or USD 760 for nonmembers per attempt, nonrefundable, plus a one-time USD 50 application processing fee when you apply for certification, then an annual maintenance fee of USD 45 for members or USD 85 for nonmembers alongside the CPE requirement. Confirm current amounts on ISACA's own pages.
Is the CGEIT exam content outline changing?
ISACA has announced nothing. The Exam Content Outline effective 2020 is current, with domains weighted 40/15/26/19. Job practices do get refreshed periodically, so check the CGEIT Exam Content Outline page before committing to a long study schedule.
Looking for a plain-English CGEIT guide? ISACA CGEIT: Simply Certified Study Guide covers all four domains at their 40/15/26/19 weights, with a full-length 150-question practice exam, every answer explained.
Simply Certified is an independent publisher. CGEIT and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.