Incident Response Certifications Compared: GCIH, ECIH, CySA+ and GCFA (2026)

Last updated October 26, 2026. Exam details below come from GIAC, EC-Council and CompTIA’s own pages and the DoD 8140 Qualification Matrix, checked this month. Fees change often, so we link to each price page instead of listing them.

Four certifications come up most when people look for incident response credentials: GIAC GCIH, EC-Council ECIH, CompTIA CySA+ and GIAC GCFA. They are not interchangeable. GCIH and ECIH are built around handling an incident from first alert to recovery. CySA+ is a security analyst exam where incident response is one of four domains. GCFA is the forensics and threat hunting step for people who already respond to intrusions.

The short version:

• Analyst who already has Security+: CySA+ is a common next step, and the DoD 8140 matrix lists it at the Advanced level for the incident responder work role.
• Hands-on incident handler or first responder: GCIH. Its exam includes CyberLive questions in live virtual machines.
• You want a structured course on the whole incident handling process: ECIH, a three-day EC-Council program with a 100-question exam.
• You already handle incidents and want memory, timeline and Windows forensics: GCFA.

Incident response certifications compared

Sources: GIAC pages for GCIH and GCFA, EC-Council ECIH, CompTIA CySA+ V4 and the DoD 8140 Document Library (Qualification Matrix V2.1), checked October 2026. GIAC passing scores apply to specific exam versions, and GIAC tells candidates to confirm theirs in their GIAC account.

GIAC GCIH: incident handling with hands-on questions

GIAC says GCIH validates the ability to “detect, respond to, and resolve computer security incidents.” The three areas it lists are incident handling and computer crime investigation, computer and network hacker exploits, and hacker tools such as Nmap, Metasploit and Netcat (GIAC). It is aimed at incident handlers, IR team leads, system administrators, security architects and anyone else who is a first responder.

A few of GCIH’s 15 exam objectives show how wide it runs:

• Incident Response and Cyber Investigation: the PICERL and DAIR incident handling processes.
• Detecting Evasive and Post-Exploitation Techniques: finding an attacker who is already inside, including persistence and hiding.
• Network and Log Investigations and Malware and AI Assisted Investigations, which includes how AI can support investigative work.
• Integrating LLMs with Offensive Operations: LLM prompt processing, common attack methods and defending against AI-specific attacks.
• Attack-side objectives: password attacks, SMB security, scanning and mapping, web application injection and API attacks, and credentials and data in the cloud.

The exam is 106 questions in 4 hours, with a 69% passing score for exam versions released on or after May 10, 2025. GIAC exams are web-based and proctored, either remotely through ProctorU or on site at Pearson VUE, and you have 120 days from activation to take your attempt. GIAC does not require a SANS course, but the course it links to is SEC504: Hacker Tools, Techniques, and Incident Handling. SANS lists 44 hands-on labs and recommends you arrive with networking basics, Windows and Linux skills, and comfort on the command line. GIAC certifications are renewed by collecting 36 CPE credits over four years (GIAC renewal).

EC-Council ECIH: the incident handling process, start to finish

ECIH is EC-Council’s incident handling program, now in version 3. EC-Council describes it as a method-driven course covering incident handling from planning through recovery, and it trains to nine stages: preparation, incident recording and assignment, incident triage, notification, containment, evidence gathering and forensic analysis, eradication, recovery, and post-incident activities (EC-Council).

The course runs 10 modules:

• Introduction to incident handling and response, including frameworks such as the Cyber Kill Chain and MITRE ATT&CK, and incident handling laws
• The incident handling and response process
• First response: securing the scene and collecting, preserving and transporting evidence
• Malware incidents, email security incidents, network security incidents and web application incidents
• Cloud security incidents, with Azure, AWS and Google Cloud sections
• Insider threats, and endpoint incidents covering mobile, IoT and OT devices

EC-Council says the training takes three days, or 24 hours of class time, and that half of the class time is lab work. You can take it self-paced (iLearn), live online (iWeek) or in person with a training partner. The exam has 100 multiple-choice questions in 3 hours. EC-Council says ECIH is not a beginner program: candidates need at least one year of cybersecurity experience. Its page lists ECIH as recognized for DoD work role 531, Cyber Defense Incident Responder.

EC-Council also runs CEH. If you are weighing the two, CEH is an ethical hacking exam and ECIH is a response exam. EC-Council suggests CHFI as the follow-on if you want to move into digital forensics and incident response.

CompTIA CySA+: the analyst exam with an incident response domain

CySA+ is a broader analyst exam than the other three, and it is the only one of the four from CompTIA. CompTIA says it validates “your ability to detect, analyze, and respond to threats in security operations and vulnerability management roles” (CompTIA). Version 4 (CS0-004) launched on June 23, 2026. The English V3 exam retires on December 22, 2026 (CompTIA).

The V4 domains and weights:

• Security Operations (34%): indicators of malicious activity across networks, endpoints, cloud and identity; SIEM, EDR and packet analysis; threat intelligence and threat hunting; AI in security operations.
• Vulnerability Management (26%): scanning, analyzing output and prioritizing fixes by risk.
• Incident Response and Management (24%): attack frameworks such as MITRE ATT&CK and the Cyber Kill Chain; the phases of preparation, detection, analysis, containment, eradication and recovery; triage, evidence handling, escalation, remediation and root cause.
• Reporting and Communication (16%): incident documentation, post-incident reviews and metrics such as detection time and response time.

The exam allows up to 85 questions in 165 minutes and you pass at 750 on a 100 to 900 scale. CompTIA lists about four years in a SOC or vulnerability analyst role as recommended experience. Our CySA+ study guide has an 8-week plan, and Security+ vs CySA+ covers which to take first.

GIAC GCFA: forensics and threat hunting for experienced responders

GCFA sits a level above the others. GIAC says holders can “conduct formal incident investigations and handle advanced incident handling scenarios,” including data breach intrusions, advanced persistent threats, anti-forensic techniques and complex digital forensic cases (GIAC). The areas covered are advanced incident response and digital forensics; memory forensics, timeline analysis and anti-forensics detection; and threat hunting and APT intrusion response.

Most of its 10 objectives are Windows-focused: memory artifacts, file system timelines, NTFS, Windows system artifacts, and telling normal user activity apart from malicious activity. One objective covers enterprise incident response, scaling tools to large investigations.

The exam is 82 questions in 3 hours, with a 71% passing score for versions released on or after March 18, 2023. The affiliated course is FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics. SANS says FOR508 does not cover the basics of incident response policy or forensics and recommends a background in FOR500, Windows Forensic Analysis, first.

How DoD 8140 lists incident response certifications

For Defense Department jobs and contracts, the work role decides which certifications count. The incident response role is DCWF 531, Cyber Defense Incident Responder. Qualification Matrix V2.1, still the current matrix in the DoD 8140 Document Library in October 2026, lists these personnel certifications for it:

• Basic: ISC2 CC, GIAC GDSA, GIAC GISF.
• Intermediate: CBROPS, CCSP, CEH, CEH (Practical), Cloud+, ECIH, FITSP-O, GCED, GCIH, GRID, GSEC, PenTest+, RCCE Level 1, Security+.
• Advanced: CFR, CySA+, GCFA, GCIA, GICSP.

A certification covers the foundational part of 8140 qualification. DoD Manual 8140.03 also calls for on-the-job (residential) qualification and continuous professional development (DoDM 8140.03). Our DoD 8140 certifications guide has the lists for other work roles, and IAT vs IAM levels explains how the old 8570 categories map across.

Which incident response certification to take first

• Still in help desk or new to security: start with Security+. It covers incident response activities at a foundation level and is an Intermediate option for role 531.
• One to three years in a SOC: CySA+ if you want the vendor-neutral analyst credential employers and DoD postings name, or ECIH if your team wants a process-driven handling course.
• Your employer pays for SANS training: GCIH through SEC504, then GCFA through FOR508 once you are working real intrusions.
• Moving toward detection engineering or Microsoft security operations: look at SC-200 alongside CySA+.

For the wider order of certifications by job, see our cybersecurity certification path. If you are building or rewriting your team’s playbook, our incident response plan guide and incident response overview cover the process side.

Who pays for incident response certifications

An employer training budget is the usual first ask, and the issuers publish material to support it:

• Employer training budgets: SANS publishes justification letters you can hand to a manager for SEC504 (GCIH) and FOR508 (GCFA). GIAC’s own fees are on its pricing page.
• Exam-only attempts: GIAC sells a certification attempt on its own as well as SANS course bundles, and says practical work experience or self-paced study may be enough preparation. EC-Council lists its course and certification packages on the ECIH page.
• Military: EC-Council lists Army Credentialing Assistance, which it says covers tuition and exam costs for soldiers on IT and cybersecurity certifications.
• CompTIA: CySA+ vouchers, and bundles that pair CertMaster training with a voucher and Retake Assurance, are sold from the CySA+ page.

If cost is the main constraint, our certifications with no experience guide lists cheaper starting points.

Incident response certification questions

Sources

• GIAC, Certified Incident Handler (GCIH): giac.org
• GIAC, Certified Forensic Analyst (GCFA): giac.org
• GIAC, Renewing your certification: giac.org
• GIAC, Pricing: giac.org
• SANS, SEC504: Hacker Tools, Techniques, and Incident Handling: sans.org
• SANS, FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics: sans.org
• EC-Council, Certified Incident Handler (ECIH): eccouncil.org
• CompTIA, CySA+: comptia.org
• CompTIA, CySA+ V4 (CS0-004): comptia.org
• DoD CIO, DoD 8140 Document Library (Qualification Matrix V2.1): cyberworkforce.mil
• DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program: esd.whs.mil (PDF)

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.