Skip to content
CertGPS

Certified in the Governance of Enterprise IT

Recognizes enterprise IT governance leaders, covering frameworks, investment benefits, resources and risk, after five verified years in governance roles

ExpertISACA

The exam

Exam cost
$760
Study time
6-12 months
Passing score
450 (scaled 200–800)
Valid for
3-year CPE cycle, renewed annually

Before you book

  • Required: five years managing, advising or overseeing the governance of IT within the 10 years before applying
  • At least one year defining, establishing or managing an IT governance framework (Domain 1), waivable with the COBIT Design and Implementation certificate
  • Further experience in two or more of Domains 2 to 4; no other waivers or substitutions

What it covers

Security domains

Skills

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

Study guide

Last updated

CGEIT Study Guide: Governance Experience, the 2020 Outline and Whether It Pays

CGEIT recognizes people who govern IT at the enterprise level: they set the governance framework, decide which IT investments go ahead and check whether those investments delivered. ISACA still offers it, at the same price as its other core exams, but it gets less attention than the rest. The content outline dates from 2020, ISACA lists no online review course for it, and you can sit it only in English or Simplified Chinese. You'll need five years of governance experience, with no general waivers.

Who CGEIT fits

The audience is senior. Think of IT directors, CIOs and those a step below them, IT governance and portfolio managers, enterprise architects who sit on investment boards, and consultants who design governance frameworks for clients. ISACA requires five years managing, advising or overseeing the governance of IT's contribution to the enterprise, all within the ten years before you apply.

ISACA's certification page requires experience across at least three of the four domains, including a year related to Domain 1. Its 2026 candidate guide lists no experience waivers or substitutions. A chapter summary mentions a one-year waiver, but the central certification page does not explain one. Do not assume a COBIT certificate reduces the requirement: ask ISACA to confirm your eligibility before relying on an exception.

If you're earlier in your career, this exam will wait for you. A security leader whose governance work is about security should take CISM, and someone whose governance is mostly about risk will get more from CRISC. CGEIT makes sense once your decisions span the whole IT portfolio.

CGEIT at a glance

CGEIT
Format150 multiple-choice questions, one best answer each
Time4 hours (240 minutes)
Passing score450 on a scaled range of 200 to 800
PriceUS$575 for ISACA members, US$760 for non-members; US$50 application fee after passing
DeliveryPSI test centers or remote proctoring; English and Simplified Chinese
ExperienceFive years in IT governance across at least three domains, including one year related to Domain 1
OutlineEffective 2020
RenewalAnnual fee of US$45 (members) or US$85; 20 CPE hours a year, 120 over three years

Governance, resources, benefits, risk

  • Governance of Enterprise IT: 40%
  • IT Resources: 15%
  • Benefits Realization: 26%
  • Risk Optimization: 19%

Domain 1 alone is 40% of the exam, the heaviest single domain in any of ISACA's five core certifications. It has three parts. The governance framework covers its components, roles, strategy, legal compliance, culture and business ethics. Technology governance takes in strategic planning, stakeholder engagement, communication, enterprise architecture, and policies and standards. Information governance adds information architecture, the asset life cycle, ownership and stewardship, and classification.

Benefits Realization, at 26%, is mostly about money. It asks how you develop and judge business cases, manage IT investments through their economic life, choose performance metrics and evaluate whether benefits arrived. IT Resources covers sourcing strategy, capacity, contracted services and staff competency; Risk Optimization is enterprise risk management seen from the board's side, with appetite, tolerance and risk frameworks.

The supporting tasks show the level. Two of them begin "Evaluate, direct, and monitor", and most start with "Establish" or "Ensure". You're answering as the person who sets direction and holds management to account, so expect the best option to be a framework, a policy or an oversight mechanism more often than a project-level fix.

How to prepare

ISACA's support for this exam is thinner. The CGEIT page lists the Review Manual, 8th edition, a Questions, Answers and Explanations database with a 300-question pool, a free practice quiz and member study groups, with no online review course. At 300 questions the database runs out quickly, so treat a second pass as review of your reasoning, not as a score.

COBIT 2019 is a useful companion. It's ISACA's governance framework for information and technology, and its Design and Implementation certificate covers related material. Treat that as preparation rather than a promised experience waiver. Read its governance objectives alongside Domains 1 and 3, where the exam spends two thirds of its questions.

Your own organization supplies the case studies. Take a recent IT investment and find its business case: were benefits defined in measurable terms, who owned them, and did anyone check after go-live? Map which committee approves IT spending, what information it receives and what it can't see. Those exercises cover tasks the exam asks about directly. Give Domain 1 about 40% of your hours and Benefits Realization a quarter, matching the weights.

Pace yourself at about a minute and a half per question across 150 questions in four hours. Join ISACA before you register if you're paying: membership is US$145 a year plus chapter dues, and the member exam price is US$185 lower.

Keeping it, and what to add

Apply within five years of passing, with experience verified by a supervisor, manager, colleague or client. To stay certified, report 20 CPE hours a year and 120 over each three-year cycle, at least 90 of them tied to the CGEIT outline, and pay US$45 a year as a member or US$85 as a non-member. Holders of more than two ISACA certifications pay US$25 or US$50 for each additional one. A random sample of holders is audited each year.

Next steps that build on CGEIT:

  • CRISC, for depth in the IT risk work that Risk Optimization only surveys.
  • CISM, if security governance is part of your remit.
  • AAIR, ISACA's AI risk credential, which lists CGEIT among its qualifying certifications (US$459 for members, US$599 for non-members).

Our view

CGEIT confirms a career rather than starting one. The five-year governance requirement, without general waivers, keeps the holder base small (ISACA counts more than 8,000). We see its value mostly where COBIT is already in use, among people who know what the letters mean. The case against it is that ISACA appears to invest less in it. The outline hasn't changed since 2020 while CISA, CRISC, CDPSE and CISM were all revised between 2024 and 2026, and there's no online course. We'd take it if you already work at governance level and want that recognized, or if you consult on COBIT. A senior security or risk leader will usually get more from CISM or CRISC.

Sources