- The GIAC Open Source Intelligence Certification (GOSI) exam has 75 questions, a 2-hour limit, and a 69% minimum passing score.
- The exam is open book with hardcopy materials only; internet access and personal electronic references are prohibited.
- Submitted answers cannot be changed, so commit only after you have checked your index.
- Six objective headings are published without official percentage weights, so study all six rather than gambling on one.
GOSI Cheat Sheet at a Glance
- GOSI Cheat Sheet at a Glance
- Confirm You Mean the GIAC Credential
- Exam Format and Rules in One Table
- Fees, Eligibility, and the 120-Day Window
- The Six Objective Headings, Decoded
- Open-Book Strategy: Building the Index
- What SEC497 Covers (and What It Doesn't Prove)
- A Domain-Ordered Review Plan
- Renewal and Four-Year Validity
- Who Uses This Credential
- Frequently Asked Questions
Key Takeaways
- The GIAC Open Source Intelligence Certification (GOSI) exam has 75 questions, a 2-hour limit, and a 69% minimum passing score.
- The exam is open book with hardcopy materials only; internet access and personal electronic references are prohibited.
- Submitted answers cannot be changed, so commit only after you have checked your index.
- Six objective headings are published without official percentage weights, so study all six rather than gambling on one.
- Certification lasts four years; renewal takes 36 CPE credits or a renewal exam, plus the $499 fee.
This page condenses what you need to know about the GIAC Open Source Intelligence Certification (GOSI) into one reviewable reference. Use it the week before your attempt, or as a map for deciding what to study. Where a topic deserves depth, we point you to a dedicated guide, such as our complete guide to all 6 GOSI content areas.
Confirm You Mean the GIAC Credential
The acronym "GOSI" is shared by several unrelated credentials and organizations. Everything on this page concerns one thing only: the GIAC Open Source Intelligence Certification (GOSI), issued by GIAC Certifications and administered by GIAC, LLC. If you want the broader background, see What Is GOSI Certification? or What Does GOSI Stand For?.
Exam Format and Rules in One Table
| Item | What to Know |
|---|---|
| Questions | 75 total |
| Time limit | 2 hours |
| Minimum passing score | 69% (applies to exam versions released on or after June 17, 2023) |
| Delivery | One proctored, web-based exam |
| Testing provider | Pearson VUE onsite or ProctorU remotely, subject to attempt-specific eligibility |
| Allowed materials | Hardcopy books, notes, and an index |
| Prohibited | Internet access, personal electronic references, and materials resembling practice or exam questions and answers |
| Changing answers | Not possible once submitted |
| Break time | 15 minutes allowed |
Run the arithmetic early. With 75 questions in 120 minutes, you have roughly 96 seconds per question on average. That is generous for recall questions and tight for scenario questions that require you to flip through an index. For a deeper look at what the 69% threshold means in practice, read our GOSI passing score breakdown.
Fees, Eligibility, and the 120-Day Window
Fee table
| Item | USD Price |
|---|---|
| Certification attempt | $999 |
| Retake | $899 |
| Official practice exam | $399 |
| Renewal fee | $499 |
Prices exclude applicable sales tax, and SANS training tuition is separate. A full pricing walk-through lives in our GOSI certification cost breakdown.
Eligibility and timing
- Prerequisites: There are no formal certification prerequisites. Training is optional and recommended. See GOSI requirements for the full eligibility picture.
- Attempt window: You have 120 days from activation to complete your attempt. Treat activation as the start of a countdown, not a formality.
- Scheduling: Because testing options depend on attempt-specific eligibility, check which proctoring route your attempt allows before you plan a date. Our GOSI exam dates and scheduling guide covers the practical side.
The Six Objective Headings, Decoded
GIAC lists six objective headings, shown here in published order. No official percentage weights are published for them, so you cannot safely skip a heading on the theory that it is "worth less." The notes below describe what each heading signals; they are interpretive study aids, not official sub-objectives.
Domain 1: Investigating Businesses
Expect to reason about how organizations can be researched through open sources: who is behind an entity, how it is structured, and how its public footprint can be pieced together.
- Know what kinds of public records and online traces describe a company
- Practice linking an organization to its people, domains, and infrastructure
Domain 2: Investigating People
This heading centers on researching individuals from open sources, which pulls in both technique and judgment about what is appropriate to collect.
- Understand how identity traces connect across platforms
- Be ready for questions where the method is right but the ethics or legality matter
Domain 3: Network Data and Infrastructure Analysis
The technical heart of the exam for many candidates. Think domains, hosting, and the infrastructure that reveals relationships between online assets.
- Know what infrastructure data can and cannot prove
- Index tool names alongside the question each one answers
Domain 4: OSINT Methodology
The process layer: how an investigation is framed, executed, documented, and reported. Candidates with field experience sometimes underrate this heading because it feels like common sense, but exam questions reward precise vocabulary.
- Learn the sequence of an investigation from requirement to deliverable
- Know why documentation and repeatability matter
Domain 5: Privacy and Operational Security Fundamentals
How investigators protect themselves and their work while researching. Questions here often present a scenario and ask which precaution fits.
- Understand how an investigator can be exposed by their own collection activity
- Know the purpose of separating investigative activity from personal identity
Domain 6: Searching, Collecting, and Processing Data
The mechanics of finding information and turning raw material into something usable. Search technique, collection, and data handling all live here.
- Be fluent in structured search approaches, not just casual searching
- Know how collected data is preserved and prepared for analysis
For a heading-by-heading study treatment, pair this section with the GOSI study guide.
Open-Book Strategy: Building the Index
An open-book exam changes what "knowing" means. You are tested on finding and applying, not only remembering. Because internet access and personal electronic references are prohibited, your index and hardcopy materials are the whole toolkit.
What a useful GOSI index contains
- Tool-to-purpose entries: for every tool or technique, the question it answers, not just its name.
- Concept pointers: terms from the methodology and OPSEC headings mapped to page numbers.
- Cross-domain tags: infrastructure topics often touch both business and people investigations, so tag entries with more than one heading.
Key Takeaway
Build the index while you study, not after. Entries written while learning a concept capture how you will actually phrase the lookup under time pressure. Also keep your notes free of anything resembling practice or exam questions and answers, since such materials are prohibited in the exam room.
Time discipline
Since answers cannot be changed after submission, the safe habit is to answer, verify against your index where needed, and then submit. Use your 15 minutes of break time deliberately rather than saving it as a bonus you never take. If you want to calibrate how hard that pacing feels, see how hard the GOSI exam is.
What SEC497 Covers (and What It Doesn't Prove)
The primary preparation source tied to this certification is SANS SEC497: Practical Open-Source Intelligence (OSINT). Its basic prerequisite is basic computer knowledge, which is separate from GIAC certification eligibility. The live detailed syllabus supports topics such as:
- ArchiveBox evidence capture
- API data collection
- Analysis of AI-generated content
- Whisper audio and video transcription
- Metadata and image analysis
- Infrastructure research and dark web research
- Data processing and report writing
Wondering whether the course is necessary? Training is optional, and our overview of GOSI training options weighs the tradeoffs against self-study.
A Domain-Ordered Review Plan
Generic study advice is everywhere; what matters here is sequencing the six headings so that foundational material supports the technical material. This sample plan runs four weeks and assumes you have your materials in hand.
Methodology and OPSEC First
- Work through Domain 4 (OSINT Methodology) and Domain 5 (Privacy and Operational Security Fundamentals)
- Why first: these frame every other topic, and their vocabulary appears in scenario questions across the exam
- Start the index with process terms and precautions
Search, Collection, and Processing
- Cover Domain 6 (Searching, Collecting, and Processing Data)
- Practice structured searches and note which technique solves which problem
- Index tools by the question they answer
Infrastructure, Businesses, and People
- Study Domain 3 (Network Data and Infrastructure Analysis), then Domain 1 (Investigating Businesses) and Domain 2 (Investigating People)
- Why this order: infrastructure data is the connective tissue that links businesses and individuals
- Add cross-domain tags to your index entries
Timed Practice and Index Repair
- Take timed 75-question sets at 2-hour pace using only your allowed materials
- Every missed lookup becomes an index fix
- Consider the official practice exam ($399) as a final readiness check
You can pressure-test this plan with timed questions on the GOSI practice test site, and our pass rate discussion explains why GIAC does not publish a number we can responsibly quote here.
Renewal and Four-Year Validity
A GOSI certification is valid for four years. To renew, you need either:
- 36 approved CPE credits earned during the active four-year period, or
- A renewal exam,
plus the standard $499 renewal fee in either case. Because OSINT tooling changes quickly, the CPE route naturally encourages ongoing learning; the renewal exam is the alternative if you would rather re-test than log credits. Policy details are maintained on GIAC's renewal pages, which are the authority if anything has changed since this article was generated in October 2026.
Who Uses This Credential
OSINT skills are applied wherever organizations need to research people, businesses, and online infrastructure from public sources. The six objective headings map naturally onto roles in security investigations, threat intelligence, and similar research-driven functions. We deliberately avoid quoting salary or hiring figures here, since GIAC does not publish them and we will not invent them. For qualitative discussion, see GOSI jobs, the GOSI salary guide, and whether the GOSI certification is worth it.
Frequently Asked Questions
The GIAC Open Source Intelligence Certification (GOSI) exam has 75 questions with a 2-hour time limit. You also get 15 minutes of break time, and the minimum passing score is 69%.
Yes. The exam is open book with hardcopy books, notes, and an index. Internet access, personal electronic references, and materials resembling practice or exam questions and answers are prohibited.
GIAC publishes six objective headings but no official percentage weights in its objective list. Plan to study all six: Investigating Businesses, Investigating People, Network Data and Infrastructure Analysis, OSINT Methodology, Privacy and Operational Security Fundamentals, and Searching, Collecting, and Processing Data.
No. There are no formal certification prerequisites, and training is optional but recommended. SEC497 is the primary preparation course, but its syllabus is curriculum, not an official list of exam objectives.
A retake costs $899, compared with $999 for the initial certification attempt. Check your assigned attempt page at exams.giac.org for current eligibility and timing, and see our GOSI certification overview for the bigger picture.