The CGEIT scoring system catches candidates off guard before they've answered a single question. They see 450 out of 800, divide, get 56 percent, and start calibrating their study plan around a number that means nothing. On a 200-800 scaled system, 200 is the lowest score possible, so the scale does not start at zero. The 450 threshold represents the minimum standard of knowledge ISACA has set, derived from scaled scoring, not from a raw question count. Everything below comes from official exam documentation, the exam content outline and CPE policy, so you can plan around the real rules.
TL;DR
- 150 multiple-choice questions, 4 hours, scaled score of 200-800: you need 450 to pass
- Four domains weighted 40 / 15 / 26 / 19 percent
- Exam registration costs US$575 for ISACA members and US$760 for nonmembers, and it is nonrefundable
- Passing the exam doesn't make you certified: a US$50 application processing fee and experience verification follow, and you have five years from your pass to apply
- More than 8,000 people have earned the CGEIT since the credential began in 2007
- Maintenance requires at least 20 CPE hours each year and 120 CPE hours across each three-year reporting period
Where Can I Practice with Realistic CGEIT Questions?
ISACA sells its own practice material for this exam: a CGEIT Questions, Answers and Explanations (QAE) database, and a CGEIT Review Manual. Both are listed in the ISACA store, and the QAE is the closest thing to a first-party question source. Check the store listing for the current number of questions and the length of the subscription before you buy, because those terms change.
Practice questions are most useful when each answer comes with a reason. For that, CertCompanion's CGEIT question bank gives you a structured way to work through the four domains with an explanation attached to every item. Use it to find which domain is weakest, then go back to ISACA's content outline and read the exact tasks listed under that domain.
| CGEIT question bank | |
|---|---|
| Questions | 598 |
| Single-answer | 517 |
| Select-all-that-apply | 81 (14%) |
| Median explanation length | 100 words |
How Does CGEIT Scoring Actually Work?
The pass mark is 450 on a scale of 200 to 800. The instinct to divide 450 by 800 and conclude "56 percent" is wrong.
ISACA reports scores on a common scale from 200 to 800. A scaled score is a conversion of a candidate's raw score to a standard scale, so that different versions of the exam stay comparable and fair. Official exam documentation states:
- A score of 800 is a perfect score, with all questions answered correctly.
- A score of 200 is the lowest score possible and signifies that only a small number of questions were answered correctly.
- You must score 450 or higher to pass. ISACA describes this as the minimum standard of knowledge.
- Domain-level results are provided for informational purposes only. Your score is based on the total number of items answered correctly, regardless of domain.
The exam is made up of scored items as well as pretest items. Pretest items don't count toward your score.
If you don't pass, you can request a rescore. The request has to be submitted in writing through the ISACA support page within 30 days of the release of your results, and it must include your name, ISACA ID number and mailing address. Rescores are performed by PSI and cost US$75 per request. Requests made after 30 days are not processed.
What Are the Four CGEIT Domains and How Much Does Each One Count?
ISACA's exam content outline divides the 150 questions across four job practice domains, weighted 40, 15, 26 and 19 percent. ISACA describes the credential as framework agnostic and as the only IT governance certification for the individual.
Domain 1 - Governance of Enterprise IT (40%)40%
Forty percent. This is the exam's centre of gravity. ISACA says the domain deals with the organizational structure of building IT frameworks, the strategy and technology aspects of IT governance, and essential knowledge about governing various types of information. It has three subtopic groups:
- Governance framework: components of a governance framework; organizational structures, roles and responsibilities; strategy development; legal and regulatory compliance; organizational culture; business ethics.
- Technology governance: governance strategy alignment with enterprise objectives; the strategic planning process; stakeholder analysis and engagement; communication and awareness strategy; enterprise architecture; policies and standards.
- Information governance: information architecture; the information asset lifecycle; information ownership and stewardship; information classification and handling.
Domain 2 - IT Resources (15%)15%
The smallest domain at 15 percent. ISACA describes it as insight into where to allocate IT resources effectively and how to keep them streamlined for performance. It has two subtopic groups:
- IT resource planning: sourcing strategies; resource capacity planning; acquisition of resources.
- IT resource optimization: IT resource lifecycle and asset management; human resource competency assessment and development; management of contracted services and relationships.
Fifteen percent is a smaller weight but still a real share of the exam, more than a seventh of what you are tested on. Don't skip it.
Domain 3 - Benefits Realization (26%)26%
Twenty-six percent makes this the second-largest domain. ISACA says its focus is managing performance, monitoring and reporting, and analyzing IT-enabled technology investment management. Its two subtopic groups are:
- IT performance and oversight: performance management; change management; governance monitoring; governance reporting; quality assurance; process development and improvement.
- Management of IT-enabled investments: business case development and evaluation; IT investment management and reporting; performance metrics; benefit evaluation methods.
Domain 4 - Risk Optimization (19%)19%
ISACA describes this domain as mitigating potential IT risks and challenges and overseeing the risks of IT management capabilities. Its two subtopic groups are:
- Risk strategy: risk frameworks and standards; enterprise risk management; risk appetite and risk tolerance.
- Risk management: IT-enabled capabilities, processes and services; business risk, exposures and threats; the risk management lifecycle; risk assessment methods.
The outline also lists 38 supporting tasks that cut across the domains. They are written as actions a governance professional takes, for example establishing a framework for the governance of enterprise IT, incorporating a strategic planning process into it, ensuring that a business case and benefits realization process is established for IT-enabled investments, and ensuring that comprehensive IT and information risk management programs are in place. Reading the task list is a fast way to see how the exam frames the work.
What Kind of Thinking Does the CGEIT Test?
Most IT certifications test what you know how to do. The CGEIT is built around governing enterprise IT: structures, accountability, investment value and risk appetite. You can see this in the outline's own wording. The tasks begin with verbs such as establish, ensure, evaluate, direct and monitor, and they are about frameworks, policies, roles, business cases and risk programs rather than configuring systems.
That is a useful lens when you practice. For every question, ask who is accountable for the decision, which governance mechanism applies, and how the outcome would be measured and reported. Candidates coming from hands-on technical work often need to read the content outline closely before the framing feels natural.
ISACA's own description is that the credential recognizes expertise in enterprise IT governance, resources, benefits and risk optimization. The domains follow that order, and so should your study plan: start with Domain 1, because it carries 40 percent of the exam.
Reasoning Through a CGEIT Question
Governance questions test whether you can apply the correct decision-making authority to a governance situation, not whether you can recite a framework definition. Memorising vocabulary is not enough: you need to be able to reason about who decides, who is accountable and what the governance response looks like.
A Question From Our Bank
A global enterprise operates with a Federal IT governance archetype where both central IT and business units share decision-making authority. The organization experiences conflicts over technology standards, with business units demanding autonomy while central IT emphasizes enterprise consistency and cost optimization. Which governance approach BEST resolves this tension? (Select one!)
- A. Shift to IT Monarchy to centralize all technology decisions under the CIO
- B. Implement Business Monarchy to give business units complete technology autonomy
- C. Define clear decision rights specifying which decisions are centralized versus decentralized based on impact
- D. Establish consensus-based decision-making requiring agreement from all parties
Show the answer and the reasoning
Correct answer: C. Define clear decision rights specifying which decisions are centralized versus decentralized based on impact
Defining clear decision rights specifying which decisions are centralized versus decentralized based on impact resolves tension by creating explicit governance boundaries. Federal archetype organizations must clearly articulate which decisions require enterprise consistency (infrastructure, security, architecture standards) versus local optimization (business applications, process tools). This clarity reduces conflict by establishing when central authority applies and when business unit autonomy is appropriate. Shifting to IT Monarchy eliminates the Federal model's business engagement benefits and may reduce business agility. Business Monarchy creates integration challenges, security risks, and cost inefficiencies from lack of enterprise coordination. Consensus-based decision-making creates deadlock and slows decisions. Effective Federal governance requires clear decision allocation matrices defining authority based on decision type and impact scope.
When you review a question like this, do not stop at the correct letter. Ask why each wrong option fails at the governance level, and which domain of the content outline the question maps to.
How Do I Register and Schedule the CGEIT?
CGEIT exams are computer-based and administered at authorized PSI testing centers globally or as remotely proctored exams. Registration is continuous: there are no exam windows or application periods. You register online through your ISACA account, and your name must match the government-issued identification you will present on exam day.
The fee depends on membership status at the time you register: US$575 for ISACA members and US$760 for nonmembers. Exam registration fees are nonrefundable and nontransferable. You can schedule a testing appointment as early as 48 hours after payment, and you cannot schedule until the fee is paid in full.
Some rules that catch candidates off guard:
- Eligibility period: registering gives you a six-month eligibility period. You must take the exam within six months of the date you register.
- Extension: if you need more time, you can buy a six-month extension for US$75. The option appears on your dashboard 30 days before and after your eligibility expires. If an exam is already scheduled, it must be canceled at least 48 hours before the exam date to extend. There is a maximum of one extension per exam.
- Forfeiting your fee: the eligibility and registration fees are forfeited if you do not take the exam within the eligibility period, if you miss your appointment, or if you are more than 15 minutes late.
- Rescheduling: you can reschedule without penalty during your eligibility period if you do it at least 48 hours before the appointment. Inside 48 hours you must take the exam or forfeit the fee.
On exam day you need a single, original form of identification showing your name, signature and photograph, and the name must match your registration. ISACA accepts a driver's license, state ID card, passport, passport card, green card, alien registration, permanent resident card or national ID card. Digital IDs and copies are not accepted, and if you cannot provide acceptable ID you will not be allowed to sit and will forfeit the fee.
What Happens If I Fail the CGEIT?
You get four attempts within a rolling 12-month period, counted from the date of your first attempt. You pay the registration fee in full for every attempt. The required waits are:
| Attempt | Wait required |
|---|---|
| Attempt 2 (first retake) | 30 days from the date of attempt 1 |
| Attempt 3 (second retake) | 90 days from the date of attempt 2 |
| Attempt 4 (third retake) | 90 days from the date of attempt 3 |
If you pass, you cannot take the same exam again within the five-year application period, and certification holders cannot take the same exam while they are certified.
Use the wait productively. Your score report gives domain-level results for information, so you can see which of the four domains cost you the most, then go back to the matching section of the content outline and to practice questions for that domain.
Passing the Exam Does Not Make You Certified
Scoring 450 or above earns you an exam pass, not a certification. To become CGEIT certified you must:
- Pass the certification exam
- Pay the US$50 application processing fee
- Submit an application demonstrating the experience requirements
- Adhere to ISACA's Code of Professional Ethics
- Adhere to ISACA's Continuing Professional Education Policy
Official exam documentation lists the experience requirement as five or more years of experience in an advisory or oversight role supporting the governance of the IT-related contribution to an enterprise. No experience waivers or substitutions are available for CGEIT. You have five years from your exam pass date to apply for certification.
Keeping the credential
Once certified, ISACA's CPE policy requires you to:
- attain and report a minimum of 20 CPE hours each year, on activities that map to the certification's exam content outline
- pay the annual certification maintenance fee in full
- attain and report a minimum of 120 CPE hours across each three-year reporting period, of which at least 90 must align with the content outline (up to 30 can cover other professional activity such as leadership or mentoring)
- comply with the Code of Professional Ethics
The annual reporting period begins on 1 January, and payment and reporting of CPE hours are due by 31 December. If you do not comply, the credential is revoked, and to become certified again you must pass the exam and submit another application.
Frequently Asked Questions
How many questions are on the CGEIT exam, and how long is it? The exam has 150 multiple-choice questions and runs 4 hours (240 minutes). It is the same length and question count as ISACA's CISA, CRISC and CISM exams.
What score do I need to pass the CGEIT? 450 on ISACA's scaled score of 200 to 800. The scale does not start at zero, so 450 does not mean 56 percent of questions correct.
What are the CGEIT domain weights? Domain 1, Governance of Enterprise IT, is 40 percent. Domain 2, IT Resources, is 15 percent. Domain 3, Benefits Realization, is 26 percent. Domain 4, Risk Optimization, is 19 percent.
How much does the CGEIT exam cost? US$575 for ISACA members and US$760 for nonmembers, nonrefundable and nontransferable. A rescore request costs US$75 and a six-month eligibility extension costs US$75. After you pass, there is a separate US$50 application processing fee.
What languages is the CGEIT exam available in? The CGEIT exam is offered in English and Chinese Simplified.
How long do I have to take the exam after I register? Six months from the date you register. You can buy one six-month extension for US$75.
What is the retake policy if I fail? Four attempts in a rolling 12-month period, with waits of 30 days after the first attempt and 90 days after each of the next two. You pay the full registration fee every time.
Do I need work experience to become CGEIT certified? Yes. Five or more years of experience in an advisory or oversight role supporting the governance of the IT-related contribution to an enterprise, with no waivers or substitutions. You submit an application after passing and have five years from your pass date to do so.
How do I keep the CGEIT after I earn it? Report at least 20 CPE hours every year and 120 CPE hours per three-year period (at least 90 aligned with the content outline), pay the annual maintenance fee, and follow the Code of Professional Ethics. Payment and reporting are due by 31 December.
The CGEIT is a specific credential for a specific kind of professional: someone who works in an advisory or oversight role over how an enterprise governs IT, and who can show that expertise through a 150-question, 4-hour exam scored on a 200-800 scale. The content outline fixes the four domain weights at 40, 15, 26 and 19 percent, so study time should follow that order of priority.
Explore CertCompanion's CGEIT practice questions and browse the full ISACA certification catalog if you're mapping a broader credential path.
Start with the free questions at CertCompanion, identify which of the four domains needs the most work, and schedule once your practice results show you are ready across the full question set: CertCompanion.
Checked against official ISACA CGEIT exam documentation and current candidate reports. Last verified 2026-11-01.