- How GIAC Lists the Eight Objectives
- Exam Snapshot: Format, Scoring and Logistics
- Domains 1 and 2: Managing, Communicating and Leading Change
- Domains 3 and 4: Policy Development and Policy Management
- Domains 5 and 6: Analyzing and Building the Security Program
- Domains 7 and 8: Business Context and Threats
- Mapping LDR514 and the 2026 AI Update to the Objectives
- Building an Index Around the Domains
- Sequencing the Domains in a Study Plan
- Frequently Asked Questions
- GIAC publishes eight objective headings for GSTRT, but no official percentage weights, so never trust a site quoting domain weightings.
- The exam has 75 questions, a 3-hour limit and a 76% passing score for versions released on or after November 5, 2022.
- The exam is open book with hardcopy materials only, so a domain-organized index matters as much as raw knowledge.
- LDR514's 2026 update expands AI/GenAI, cloud strategy and policy work, but GIAC has not announced a new exam edition or an AI objective.
How GIAC Lists the Eight Objectives
GIAC Strategic Planning, Policy, and Leadership (GSTRT) is a management-oriented certification. Its published scope is a list of eight objective headings with accompanying outcome statements on the official GIAC certification page. Those headings are the closest thing to an official blueprint, and this guide walks through each one. If you want the broader preparation picture first, the GSTRT study guide covers the full path, and What Is GSTRT Certification? gives the background.
Two cautions shape how you should read the objective list:
- The headings are not a weighted domain system. The count of eight reflects the number of sequential headings GIAC publishes. The retrieved sources contain no percentage weights, no "highest-weight domain" and no statement that questions are split equally across objectives.
- The list is undated. The live objective list carries no edition label or publication year. The November 5, 2022 date you will see elsewhere is when the current passing-score standard began to apply, not an outline revision date.
| # | Objective Heading (as published) | Broad Theme |
|---|---|---|
| 1 | Effective Management & Comms | Managing teams, stakeholders and messaging |
| 2 | Leadership & Change | Leading people and organizational change |
| 3 | Policy Development | Writing and creating policy |
| 4 | Policy Management | Maintaining and governing policy over time |
| 5 | Security Program Analysis | Assessing the current program |
| 6 | Security Program Development | Planning and building the program |
| 7 | Understanding the Business | Business context, goals and strategy |
| 8 | Understanding the Threats | Threat landscape and risk drivers |
Exam Snapshot: Format, Scoring and Logistics
Before diving into content, anchor yourself in the mechanics, because they influence how you study each domain.
- Questions: 75 total. GIAC does not publicly specify how many are scored versus unscored.
- Time: 3 hours, which works out to roughly two and a half minutes per question on average, a comfortable pace if your reference materials are well organized.
- Passing score: 76% for exam versions released on or after November 5, 2022. See GSTRT Passing Score 2026 for the detail, and note that a passing score is not the same as a pass rate. GIAC does not publish a population pass rate in the sources used here, as discussed in GSTRT Pass Rate 2026: What the Data Shows.
- Delivery: A web-based proctored exam through Pearson VUE onsite or ProctorU remotely, depending on what is permitted for your specific attempt.
- Open book: Hardcopy books, notes and an index are allowed. Electronic reference files, practice-question-and-answer references and internet access are prohibited.
- Answer rules: Submitted answers cannot be changed. A limited skip allowance and 15 minutes of break time are available.
- Item composition: The exact mix of multiple-choice, case-study or performance-based items is not specified in the retrieved current official sources, and a CyberLive component was not verified. Confirm the specifications for your attempt in its Certification Information at exams.giac.org/pages/attempts.
On cost, the initial exam fee is USD 999 before applicable sales tax, with a failed-exam retake listed at USD 899 and a practice exam at USD 399. The full breakdown, including optional training, is in GSTRT Certification Cost 2026. For scheduling windows, see GSTRT Exam Dates 2026.
Domains 1 and 2: Managing, Communicating and Leading Change
The first two headings are the "people side" of the exam. Candidates from deeply technical backgrounds often underestimate them because they feel soft, yet the questions tend to reward judgment about how a security leader should act in an organizational setting rather than recall of a definition.
Domain 1: Effective Management & Comms
This objective covers how a security leader manages work and conveys information to different audiences. Expect scenario thinking about who needs to hear what, and in what form.
- Tailoring security messages to executives, technical staff and non-technical stakeholders
- Setting expectations, delegating and managing team performance
- Presenting risk and investment cases in business terms
- Recognizing when a message fails because the audience was misjudged
Domain 2: Leadership & Change
Here the focus shifts from managing tasks to leading people through transitions. Security programs routinely fail not for technical reasons but because change was poorly introduced.
- Distinguishing leadership from management and when each is appropriate
- Understanding why people resist change and how leaders respond
- Building buy-in and sponsorship for new security initiatives
- Influencing without formal authority
When a question on these domains offers several plausible actions, the best answer is usually the one that aligns the security goal with a stakeholder's concerns and builds durable support, not the one that simply enforces a rule.
Domains 3 and 4: Policy Development and Policy Management
Policy is a defining theme of the GSTRT credential. The two policy headings are deliberately separated: one is about creating policy, the other about keeping it alive and effective.
Domain 3: Policy Development
This objective is about how policy gets written well. A good policy is clear, enforceable and tied to organizational goals.
- The relationship between policies, standards, procedures and guidelines
- Writing language that is unambiguous and appropriate for its audience
- Aligning policy with business objectives and legal or regulatory drivers
- Involving the right stakeholders during drafting
Domain 4: Policy Management
Policies do not end at publication. This objective covers governance across the policy lifecycle.
- Review cycles, version control and retirement of outdated policy
- Communicating and training staff on policy changes
- Handling exceptions and measuring compliance
- Assigning ownership and accountability for each policy
Key Takeaway
Keep "develop" and "manage" mentally separate. If a question describes a policy that exists but is ignored, stale or unevenly enforced, think lifecycle and governance, not drafting.
Domains 5 and 6: Analyzing and Building the Security Program
The middle of the list moves from people and policy to the program as a whole. One heading is diagnostic, the other constructive, and the exam can pose problems that sit on the boundary between them.
Domain 5: Security Program Analysis
Before you can improve a program you must understand where it stands. This objective is about assessment and measurement.
- Evaluating program maturity and identifying gaps
- Choosing meaningful metrics rather than vanity measurements
- Interpreting results and tying them back to business outcomes
- Deciding what the analysis implies for next steps
Domain 6: Security Program Development
This objective covers planning and building a program, from vision to execution.
- Defining mission, vision and strategic goals for security
- Prioritizing initiatives against limited resources
- Roadmapping and sequencing work over time
- Securing funding and demonstrating value to leadership
A common trap is jumping straight to building when the scenario really calls for analysis first. If the facts describe uncertainty about current state, the better answer usually involves assessing before committing resources. Understanding how hard these judgment-style questions can feel is explored in How Hard Is the GSTRT Exam?
Domains 7 and 8: Business Context and Threats
The final two headings anchor everything else. Security strategy has to serve the business and respond to real threats, and the exam tests whether you can connect the two.
Domain 7: Understanding the Business
Security leaders earn credibility by speaking the language of the organization.
- Reading business strategy, structure and operating environment
- Identifying what the organization values and what it can tolerate
- Aligning security investments to business priorities
- Considering external forces that shape strategy, a theme reinforced by the PEST analysis emphasis in the 2026 LDR514 update
Domain 8: Understanding the Threats
This objective is about the threat landscape from a leadership vantage point. It is not a deep technical exploitation syllabus.
- Recognizing categories of threat actors and their motivations
- Connecting threats to business impact and risk decisions
- Using threat awareness to inform strategy and priorities
- Communicating threat information in terms leaders can act on
Mapping LDR514 and the 2026 AI Update to the Objectives
The affiliated SANS course is LDR514: Security Strategic Planning, Policy, and Leadership. It is offered as five instructor-led days or about 30 self-paced hours, awards 30 CPEs, and advertises 32 labs and 20 Cyber42 challenges. Its detailed activity list runs to Cyber42 Challenge #21, so the overview and detailed counts differ. The course has five sections, the fifth being a workshop that applies earlier material.
Two points matter for your domain planning:
- Course sections are not exam domains. LDR514's five sections and the credential overview's four preparation groupings do not replace GIAC's eight headings. Use the eight headings as your scope checklist and the course as a learning vehicle.
- Course activities are not exam items. Cyber42 exercises, business case studies and the executive-presentation capstone are training activities. They are not verified GIAC CyberLive tasks.
The 2026 LDR514 update expands AI and GenAI coverage, PEST analysis, cloud strategy, mission and metrics work, policy work and executive decision exercises. That does not establish a new 2026 GSTRT exam edition or an added AI objective. The practical way to handle it is to fold AI topics into existing headings:
| 2026 Course Emphasis | Best-Fit Existing Objective | How to Study It |
|---|---|---|
| AI/GenAI policy | Policy Development; Policy Management | Consider how an acceptable-use rule for AI tools would be drafted, then governed and reviewed |
| PEST analysis | Understanding the Business | Practice linking political, economic, social and technological forces to security priorities |
| Cloud strategy | Security Program Development | Think about roadmap and resourcing decisions rather than configuration detail |
| Mission and metrics | Security Program Analysis; Program Development | Separate meaningful measures from vanity measures |
| Executive decision exercises | Effective Management & Comms; Leadership & Change | Rehearse framing a recommendation for a senior audience |
Candidate anecdotes online mention AI-policy preparation, but those are individual experiences, not official specifications or proof of an exam change. For SANS course background, see GSTRT Training.
Building an Index Around the Domains
Because the exam is open book and hardcopy only, your index is a core tool. Candidates in public discussion often describe the material as abstract and the wording as tricky, which makes fast, concept-based lookup more valuable than a keyword list copied from a glossary.
A few approaches suited to GSTRT specifically:
- Index concepts, not just terms. Entries such as "policy lifecycle," "stakeholder buy-in" or "maturity assessment" are more useful than isolated vocabulary because questions describe situations rather than quote definitions.
- Tag each entry to one of the eight headings. This lets you jump to the right region of your materials when a scenario's theme is clear.
- Add decision criteria. Note why one action beats another in typical scenarios, for example analysis before development, or audience-fit before detail.
- Keep it printed and usable. Electronic reference files are prohibited, so your index must be on paper and tested for speed before exam day.
For a compact companion, the GSTRT cheat sheet summarizes the must-know facts, and you can pressure-test your recall with the practice questions on the main practice test site.
Sequencing the Domains in a Study Plan
Generic study advice matters less here than the order in which you tackle the domains. One reasonable sequence follows the logic of how a security program is built, front-loading the context that later objectives depend on.
Context first: Domains 7 and 8
- Learn how business strategy and threats frame every later decision
- Draft index entries tagged to business and threat concepts
People and influence: Domains 1 and 2
- Practice audience-based communication scenarios
- Study change leadership and sources of resistance
Policy depth: Domains 3 and 4
- Work through the full policy lifecycle from drafting to retirement
- Include AI/GenAI policy as a worked example
Program integration: Domains 5 and 6, then review
- Practice analyzing before building and choosing meaningful metrics
- Run timed sets against your finished index and refine weak entries
Adjust the pacing to your background. A seasoned manager may compress the people domains, while an engineer new to policy work may need extra time on Domains 3 and 4. The retake and access rules also affect planning: standalone attempts normally allow 120 days from activation, a failed-exam retake normally requires a 30-day wait, and three failures trigger a one-year wait. Check scheduling and deadlines before committing to a timeline.
Frequently Asked Questions
No. The retrieved official sources list eight objective headings without percentage weights, a highest-weight objective or an equal-allocation statement. Any site presenting domain percentages is not drawing them from GIAC.
The exam has 75 questions and a 3-hour limit. The scored versus unscored split is not publicly specified, and the exact item composition should be confirmed in your attempt's Certification Information.
The passing score is 76% for exam versions released on or after November 5, 2022. That is a score standard, not a pass rate, and GIAC does not publish a population pass rate in the sources used here.
Not as far as the published sources show. The LDR514 course update expanded AI/GenAI content, but that does not establish a new exam edition or a ninth objective. Study AI topics under policy, business and program objectives.
Yes, the exam is open book with permitted hardcopy books, notes and an index. Exam or practice-question-and-answer references, electronic reference files and internet access are prohibited, so build a printed, domain-organized index.
For the full certification overview, start with What Is GSTRT? and review earning potential in the GSTRT salary guide, keeping in mind that no GSTRT-specific salary figure has been verified. When you are ready to test your knowledge across all eight areas, try the GSTRT practice tests.