- What This Cheat Sheet Covers
- Exam Specs at a Glance
- The Eight Published Objective Headings
- Must-Know Concepts by Heading
- Fees, Deadlines and Retake Rules
- Open-Book Rules and Your Index
- Mapping LDR514 and the 2026 Update to the Objectives
- Sequencing Your Final Review
- Claims to Ignore
- Frequently Asked Questions
- GSTRT is the GIAC Strategic Planning, Policy, and Leadership exam: 75 questions, 3 hours, 76% passing score.
- GIAC publishes eight objective headings but no official percentage weights, so never trust a domain-weight chart.
- The exam is open book with hardcopy materials only; build an index around management concepts and policy lifecycles.
- The exam-only fee is USD 999; a failed-exam retake is USD 899 and requires a 30-day wait.
What This Cheat Sheet Covers
This page condenses the facts that matter most for the GIAC Strategic Planning, Policy, and Leadership (GSTRT) exam into something you can scan in a few minutes. It is organized around what GIAC actually publishes: the exam specifications, the eight objective headings, the fee and retake mechanics, and the open-book rules. Where GIAC has not published a detail, this sheet says so rather than guessing.
If you are still deciding whether the credential suits you, start with What Is GSTRT Certification? and then return here. If you want a full study plan instead of a quick reference, read the GSTRT Study Guide 2026. For realistic practice against the style of question you will face, the GSTRT practice test site is the natural companion to this sheet.
Exam Specs at a Glance
| Item | What GIAC Publishes |
|---|---|
| Certifying body | GIAC Certifications (GIAC, LLC) |
| Number of questions | 75 total; scored/unscored split not publicly specified |
| Time limit | 3 hours |
| Passing score | 76% (for exam versions released on or after November 5, 2022) |
| Delivery | Web-based proctored exam via Pearson VUE onsite or ProctorU remotely, depending on what your attempt permits |
| Book policy | Open book: hardcopy books, notes and an index permitted |
| Prohibited | Practice-question-and-answer references, electronic reference files, internet access |
| Answer changes | Submitted answers cannot be changed |
| Breaks and skips | 15 minutes of break time; a limited skip allowance |
| Prerequisites | No mandatory degree, experience duration, training hours or references |
| Validity | Four years |
What GIAC does not specify
Be careful with any source that states more than the table above. GIAC's retrieved public sources do not specify the exact mix of multiple-choice, case-study or performance-based items, do not confirm a CyberLive component for this exam, and do not state whether delivery is adaptive. Calculator permission is also unverified. Your authoritative source is the Certification Information attached to your purchased attempt, which you can check at the GIAC attempts page (exams.giac.org/pages/attempts).
Key Takeaway
Arithmetic worth memorizing: 75 questions in 180 minutes is about 2.4 minutes per question on average. Because answers cannot be changed once submitted, spend your decision time before you commit, and use the limited skip allowance for questions that genuinely need a second look.
For the details behind the scoring threshold, see GSTRT Passing Score 2026. Keep in mind that a passing score is a bar you must clear on your own attempt; it is not the same thing as a pass rate across all candidates, a distinction covered in GSTRT Pass Rate 2026: What the Data Shows.
The Eight Published Objective Headings
GIAC lists eight exam-objective headings for GSTRT. They are presented in source order below. This is a list of headings, not a numbered, weighted domain system: GIAC has not published percentage weights, a highest-weight objective, or an equal allocation of questions per heading. Any chart claiming "Domain X is 20% of the exam" is not something this sheet can verify.
- Effective Management & Comms
- Leadership & Change
- Policy Development
- Policy Management
- Security Program Analysis
- Security Program Development
- Understanding the Business
- Understanding the Threats
The live objective list is undated and carries no separately identified blueprint edition, so treat the headings as current but do not attach a version year to them. For a deeper walk through each area, see GSTRT Exam Domains 2026: Complete Guide to All 8 Content Areas.
Must-Know Concepts by Heading
The headings below are grouped by how they relate in practice. The groupings are an editorial convenience and do not replace GIAC's eight headings.
People and communication
Effective Management & Comms
Expect scenario questions where the right answer depends on audience: what an executive needs to hear differs from what a technical team needs to hear.
- Translating security risk into business language and decision options
- Choosing the appropriate communication approach for a given stakeholder
- Managing teams, expectations and competing priorities as a security leader
Leadership & Change
This heading rewards candidates who think like a leader rather than a technician: how to introduce a new program, win support and sustain adoption.
- Leading versus managing, and when each approach fits
- Planning for resistance when a new policy or control changes how people work
- Building sponsorship and shared ownership for security initiatives
Policy work
Policy Development
Understand how a policy goes from a stated need to an approved document that people can actually follow.
- The difference between policies, standards, procedures and guidelines
- Aligning policy language with business objectives and legal or regulatory drivers
- Writing policy that is enforceable, clear and appropriately scoped
Policy Management
Writing a policy is only the beginning. This heading covers keeping it alive.
- Policy lifecycle: publication, awareness, exceptions, review and retirement
- Handling exceptions and measuring compliance
- Keeping the policy set consistent as the organization and threats change
Program thinking
Security Program Analysis
Think of this as assessing where you are before deciding where to go.
- Evaluating the current state of a security program against business needs
- Using metrics and measurement to judge effectiveness
- Identifying gaps that justify investment or change
Security Program Development
This is the forward-looking counterpart to program analysis: building a roadmap that the business will fund and support.
- Setting a mission and aligning strategy to organizational goals
- Prioritizing initiatives and sequencing them realistically
- Defining success measures before work begins
Context
Understanding the Business
Strategy that ignores how the organization makes money or delivers its mission will not survive contact with leadership.
- Business drivers, structure and decision-making processes
- Strategic analysis techniques used to examine the environment around the organization
- Connecting security investment to business outcomes
Understanding the Threats
A leadership-level view of threats: enough to prioritize and communicate, not to perform technical forensics.
- Recognizing the threat landscape relevant to the organization's sector and assets
- Linking threat information to risk decisions and program priorities
- Explaining threats to non-technical decision makers
Fees, Deadlines and Retake Rules
Cost table (USD, before applicable sales tax)
| Item | Listed Price |
|---|---|
| Initial exam attempt | $999 |
| Failed-exam retake | $899 |
| Practice exam | $399 |
| 45-day extension | $479 |
| Standard renewal | $499 |
GIAC does not publish separate member and non-member tiers. The SANS-associated certification add-on is also $999, with course tuition charged separately. That distinction matters: the exam fee and training tuition are different line items, and training is optional preparation rather than an eligibility requirement. Full breakdown: GSTRT Certification Cost 2026.
Time windows
- Standalone attempts: normally 120 days from activation to take the exam.
- Bundled training attempts: 120 days from the end of the event and/or aligned to the OnDemand course deadline.
- Failed-exam retake: normally a 30-day wait; its 60-day extension includes that wait.
- Three failures: trigger a one-year wait.
- Paid extensions: ordinarily add 45 days, within a 570-day total-access limit.
These are access windows, not exam durations. The exam itself is 3 hours. For scheduling mechanics, see GSTRT Exam Dates 2026.
Renewal cheat sheet
- Certification is valid for four years.
- Renew with 36 accepted CPE credits earned during the active cycle, or by passing the renewal exam.
- Pay the renewal fee ($499 standard); documentation and payment must be completed before expiry.
- Additional renewals within two years of paying a full $499 renewal are listed at $249.
Open-Book Rules and Your Index
The open-book format surprises candidates in the wrong direction. Because the material is conceptual, you cannot look up a command or a port number; you need to find the right framework, lifecycle or decision criterion quickly and then apply it to a scenario. An index built for lookup speed beats a transcript of your notes.
Index structure that suits this exam
- Management concepts: leadership versus management, communication approaches by audience, change-management stages.
- Policy lifecycle terms: development, approval, publication, awareness, exceptions, review, retirement.
- Document hierarchy: policy, standard, procedure, guideline, and how each differs in purpose and audience.
- Decision criteria: how to prioritize initiatives, justify spending, and choose between competing options.
- Business analysis techniques: any structured frameworks your course material uses to examine the organization's environment.
- Metrics and measurement: definitions and the reasoning for choosing particular measures.
Cross-reference each entry to a book and page, and add a short phrase describing when to use it. A single concept may deserve two or three entries under different words, since the exam may phrase it differently from your source. Also see the study-process advice in the GSTRT study guide.
Mapping LDR514 and the 2026 Update to the Objectives
The affiliated SANS preparation course is LDR514: Security Strategic Planning, Policy, and Leadership. Current delivery is five instructor-led days or 30 self-paced hours, awards 30 CPEs, and advertises 32 labs and 20 Cyber42 challenges. The detailed course list reaches Cyber42 Challenge #21, so the overview count and the detailed activity list differ slightly. The course contains five sections, the fifth being a workshop that applies the earlier material.
Where the 2026 course update fits
The published 2026 LDR514 update expands AI and GenAI content, PEST analysis, cloud strategy, mission and metrics, policy work and executive decision exercises. It does not establish a new 2026 exam edition or an additional AI objective on GIAC's list. A sensible way to map it is by existing heading:
| 2026 Course Emphasis | Most Natural Objective Heading |
|---|---|
| AI and GenAI policy considerations | Policy Development and Policy Management |
| PEST analysis | Understanding the Business |
| Cloud strategy | Security Program Development |
| Mission and metrics | Security Program Analysis and Security Program Development |
| Executive decision exercises | Effective Management & Comms and Leadership & Change |
This mapping is an editorial reading to help you organize notes, not an official GIAC crosswalk. One candidate account mentions AI-policy preparation, but that is an anecdote and not proof of any exam change. For training specifics, see GSTRT Training.
Preparation recommendations versus requirements
LDR514 recommends a basic understanding of security and business; LDR512 is recommended but not required, and there are no specific technical course prerequisites. These are preparation suggestions, not GSTRT eligibility rules. GIAC itself requires no degree, work-experience duration or training hours to begin an attempt. One secondary occupational database lists more than two years of education and work experience as required, which conflicts with GIAC's policy and is not adopted here. Details are in GSTRT Requirements 2026.
Sequencing Your Final Review
Because GIAC publishes no weights, do not allocate time by a made-up percentage. Allocate it by dependency: context first, then policy, then program, then communication. Here is one way to stage a final-month review tied to the eight headings.
Context
- Understanding the Business: drivers, structure, strategic analysis techniques
- Understanding the Threats: tie threats to business risk, not to technical detail
Policy
- Policy Development: document hierarchy and drafting logic
- Policy Management: lifecycle, exceptions, review cadence
Program
- Security Program Analysis: current-state assessment and metrics
- Security Program Development: mission, roadmap, prioritization
People and index finalization
- Effective Management & Comms and Leadership & Change scenarios
- Finish and tab your index; run timed sets at about 2.4 minutes per question
Context goes first because the later headings keep asking you to justify choices by reference to the business. Finish by taking timed sets on the practice test site, and for each miss, write down why the correct option was better and why the plausible alternative was weaker. That habit builds the judgment this exam tests.
Claims to Ignore
Public pages about this certification contradict each other and sometimes contradict GIAC. Treat these as red flags:
- Invented domain weights. Some sites assign percentages to the objectives. GIAC has not published any, and some of those sites also rename the objectives.
- Conflicting passing scores. You may see approximate figures such as 67% or 70% on third-party pages. GIAC's current stated threshold is 76% for versions released on or after November 5, 2022.
- Exam fees in other currencies or "acquisition" prices. A directory listing a very different euro figure is not GIAC's current $999 exam-only price.
- Assumed CyberLive content. A CyberLive component for this exam was not verified.
- Different exam lengths and renewal periods. The exam is 3 hours and the credential is valid four years, not three.
- Quoted pass rates and salary uplifts. No current GSTRT-specific population pass rate or numerical salary premium was verified. Broader occupational or other-certification figures do not transfer. For a careful treatment, see GSTRT Salary Guide 2026 and Is the GSTRT Certification Worth It?
Key Takeaway
When a number on a third-party page cannot be traced to GIAC, treat it as unverified. Check your own attempt's Certification Information for the final word on your exam's specifications.
If you are weighing GSTRT against other leadership-oriented credentials, compare each issuer's actual scope, eligibility rules and exam outline for your test date rather than assuming overlap. ISACA, for example, has announced an updated CISM exam content outline with an effective date of November 3, 2026, so check which outline applies to a candidate's own exam date. Nothing about another credential's objectives changes what GSTRT tests.
Frequently Asked Questions
The exam has 75 questions and a 3-hour time limit. GIAC does not publicly specify how many questions are scored versus unscored, or the exact breakdown of item types.
The stated passing score is 76%, applicable to exam versions released on or after November 5, 2022. That date marks when the score standard applies; it is not an outline revision date. See the passing score guide for more.
No. GIAC publishes the eight objective headings but no percentage weights, no highest-weight heading and no equal-allocation statement, so any weight chart you find is not issuer data.
Yes, with limits. Hardcopy books, notes and an index are allowed. Practice-question-and-answer references, electronic reference files and internet access are prohibited, and submitted answers cannot be changed.
No. GIAC requires no specific training, degree or experience duration to begin an attempt. LDR514 is the affiliated preparation course and carries 30 CPEs, but it is optional. The What Is GSTRT? overview explains how the pieces fit together.