Skip to content
CertGPS

GSEC and CISA: A Technical Baseline for Auditors, or a Way Into Audit for Defenders

Comparison

GIAC writes GSEC partly for auditors who want the defensive baseline; CISA tests the audit method itself. Exams, costs, overlap and which order makes sense.

Published
Updated
Read time
4 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

On this page

GSEC and CISA: A Technical Baseline for Auditors, or a Way Into Audit for Defenders

GIAC names auditors in GSEC's intended audience, next to administrators and analysts, so this pair works in both directions. CISA certifies the audit method: risk-based planning, evidence and reporting. GSEC certifies that you can apply defensive security on live Windows and Linux systems. For most readers the question is which one to add to the other, and the deciding fact is price: GIAC charges US$999 for a GSEC attempt before any SANS training.

The exams compared

GSECCISA
IssuerGIACISACA
FormatProctored, open book (printed material only), with CyberLive hands-on tasks in virtual machinesMultiple choice, four options, one best answer
Questions106150
Time4 hours4 hours
Passing score72%450 on a scaled range of 200 to 800
Price$999 per attempt; $899 retakeUS$575 members, US$760 non-members, plus a US$50 application fee
ExperienceNone listedFive years of qualifying IS audit, control, assurance or security work; up to three years waived, with at least two years in a CISA domain
RenewalEvery four years: 36 CPEs and a $499 fee, or pass the current examUS$45 (members) or US$85 a year; 20 CPE hours a year, 120 per three years

Two directions through the same pair

An IT auditor two or three years in, who can follow a control test but can't yet check a Group Policy setting or read Linux permissions for themselves, fits the audience GIAC describes, and GSEC fills that gap. CISA's protection of information assets domain, 26% of the exam by ISACA's weights, covers identity, network and endpoint security, encryption and cloud. CISA tests whether you know what good looks like; GSEC tests whether you can check it on a running system.

A system administrator or new analyst whose employer funds SANS training comes the other way. GSEC is their baseline, and CISA becomes relevant only if they later move into assurance or internal audit. ISACA counts security work toward CISA's five years, so their technical years aren't wasted if they do.

If neither describes you, consider simpler routes. A self-funded newcomer who needs a baseline that job postings ask for can get it from Security+ for $439, according to CompTIA. An auditor who wants to move from assessing risk to owning it should read CISM vs CISA instead.

Open book on a live system versus one best answer

The formats reward opposite habits. GSEC lets you bring printed books, notes and your own index, then ends with CyberLive tasks in real virtual machines. GIAC warns that candidates who can't answer most of those tasks correctly shouldn't expect to pass. It publishes 26 objectives without weights, and Windows takes six of them, from NTFS and registry permissions to Group Policy security templates and auditing with PowerShell.

CISA allows nothing in the room and gives you about a minute and a half per question. The 2024 outline's 43 tasks are almost all "evaluate", and the audit process logic runs through every domain: what to sample, whether evidence is sufficient, when to report a gap and leave the fix to management. CISA gives audit-specific weight to IT governance, systems development and implementation, business impact analysis and disaster recovery; GSEC approaches resilience and controls from the practitioner side.

The one CISA task that reads like GSEC is "utilize technical security testing to identify potential vulnerabilities". GSEC's vulnerability scanning and penetration testing objective covers the same ground at a high level.

Credits, defense roles and order

Each body gives some credit for the other. GIAC's renewal rules accept "other accredited professional training or certification" under a category capped at 36 CPEs, the whole GSEC requirement; its renewal page doesn't say how many credits a given certification earns. ISACA's CPE policy gives two CPE hours per exam hour for passing a related exam aligned with the CISA outline, so a passed four-hour GSEC would be worth eight.

Both appear on US Department of Defense lists. GIAC includes GSEC among its certifications approved for DoD 8140, and ISACA announced CISA's approval under DoDM 8140.03 in May 2024. GSEC has no experience rule to waive, and it doesn't reduce CISA's either, since ISACA lists specific work, education and credential substitutions, including CIMA and ACCA.

For an auditor we'd put CISA first, because it's the credential audit employers ask for, then GSEC when the technical gap starts to limit your fieldwork. For a defender, GSEC first, and CISA only after a decision to change careers.

Our view

GSEC suits an auditor well because it makes you prove things on a live host, which CISA never asks of you. Cost is the objection. GIAC charges $999 for the attempt alone and SANS lists SEC401 at $8,780, so we'd only recommend it when the employer pays. A self-funded auditor will get further from lab practice against the CISA protection domain and a cheaper baseline exam. We'd also skip CISA for any defender who only wants a second credential: the audit mindset it tests is a separate job, and it won't make you a better analyst.

Sources (16)