Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

GIAC Critical Infrastructure Protection Certification (GCIP)

ICS Security Certification Overview

Validates the skills of practitioners who access, support, and maintain critical systems, with knowledge of NERC CIP requirements and practical implementation.

Explore ICS456 CourseRegister for the Exam
GCIP Badge
Jump to:

What Is the GCIP Certification?

The GIAC Critical Infrastructure Protection (GCIP) certification validates the skills and knowledge of practitioners who access, support, and maintain critical systems. GCIP certification holders understand the regulatory requirements of the North American Electric Reliability Corporation's Critical Infrastructure Protection standards (NERC CIP), and are equipped with practical implementation strategies.

By the numbers

3 hrs

Exam duration

75

Questions

70%

Min. passing score

What GCIP Covers

The 13 published exam objectives group into five practical domains.

Asset Identification and Governance

Covers BES Cyber System Categorization, NERC CIP Terms and Definitions, and Security Management Controls.

Access Control and Monitoring

Covers Electronic Security Perimeter(s) and Physical Security of BES Cyber Systems.

System Management

Covers System Security Management and Configuration Change Management and Vulnerability Assessments.

Information Protection and Response

Covers Personnel & Training, Information Protection, Incident Reporting and Response Planning, and Recovery Plans for BES Cyber Systems.

The CIP Process

Covers Standards Development and Standards Enforcement.

Prepare With This Course

ICS456: Essentials for NERC Critical Infrastructure Protection

Course Details

How ICS456 Prepares You for GCIP

ICS456 is built around the exam objectives that make up the GCIP certification: 

  • Section 1, Asset Identification and Governance builds skills tested under BES Cyber System Categorization, NERC CIP Terms and Definitions, and Security Management Controls.
  • Section 2, Access Control and Monitoring aligns with Electronic Security Perimeter(s) and Physical Security of BES Cyber Systems.
  • Section 3, System Management aligns with System Security Management and Configuration Change Management and Vulnerability Assessments.
  • Section 4, Information Protection and Response builds skills tested under Personnel & Training, Information Protection, Incident Reporting and Response Planning, and Recovery Plans for BES Cyber Systems.
  • Section 5, The CIP Process aligns with Standards Development and Standards Enforcement.

Across all five sections, 22 hands-on labs on three virtual machines, plus a Day 5 audit simulation exercise, give you the chance to apply each skill in a live lab environment before you sit the exam. 

Read the full GCIP certification overview 

ICS456 Course Authors

Tim Conway

Tim Conway

SANS ICS Curriculum Lead at SANS Institute

SANS Fellow Tim Conway, co-author of ICS456, ICS310, and ICS612, blends decades of hands-on ICS/OT security and compliance expertise with ongoing frontline consulting, helping students turn complex industrial challenges into practical skills.

Learn more
Jason Christopher

Jason Christopher

Senior Vice President, AI, Cybersecurity and Resilience at Energy Impact Partners

Jason D. Christopher, Energy Impact Partners SVP, teaches ICS456 and co-authors ICS418, turning regulation into safe, reliable OT-supporting programs and metrics to align practitioners and leaders on clear, defensible action.

Learn more
Felix Schallock

Felix Schallock

Owner and Managing Director at TIBITS Consulting GmbH

Felix is the owner of TIBITS Consulting GmbH, where he provides consulting and advisory services to organizations in the critical infrastructure sector. He brings over 30 years of experience and a diverse IT and OT background to SANS.

Learn more

Who Should Pursue GCIP

ICS Cyber Security Practitioners

Field Support Personnel

Compliance Staff

Team Leaders and Managers

Auditors

Frequently Asked Questions

GCIP validates the skills and knowledge of practitioners who access, support, and maintain critical systems. Holders understand the regulatory requirements of NERC CIP and have practical strategies for implementing them. 

The GCIP exam is one proctored exam with 75 questions and a 3-hour time limit. The minimum passing score is 70%. GIAC may update exam specifications, so check the Certification Information section of your GIAC account for the details that apply to your attempt. 

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page. 

GIAC designed GCIP for ICS cyber security practitioners, field support personnel, compliance staff, team leaders and managers, and auditors who work with NERC CIP requirements. 

ICS456: Essentials for NERC Critical Infrastructure Protection maps directly to the GCIP exam objectives. The course includes 22 hands-on labs on three virtual machines, covering skills such as network and firewall analysis, system hardening, forensic data preservation, and audit preparation. SANS training is not required for GIAC certification. 

SANS Institute is a training organization. GIAC LLC is an independent certification body accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC 17024:2012. Completion of SANS training is not required for GIAC certification, nor does it guarantee a passing exam result.

Ready to earn your GCIP certification?

Add the GCIP exam attempt when you register for ICS456.

Register for ICS456

Already trained? Register for the exam directly through GIAC.