GIME Certification

What the GIME Credential Actually Certifies

The GIME certification is issued by GIAC Certifications (formerly Global Information Assurance Certification) and validates a practitioner's ability to examine Apple platforms: macOS computers and iOS devices. Note that the issuer styles the credential "GIAC iOS and macOS Examiner," and this site preserves the "MacOS" spelling in its branding. If you are new to the acronym, our explainers on what GIME is and what GIME stands for cover the naming, but the short version is this: it is a digital forensics and incident response credential focused squarely on Apple ecosystems.

Unlike broad entry-level security certifications, GIME is a specialist credential. It asks whether you can take an Apple system, understand how its file systems, applications, logs, and cloud-synced data behave, and turn that understanding into defensible findings. That is why the objective list reads like an investigator's workflow rather than a vendor product catalog.

If you want the complete picture of what the credential means as a career asset, see What Is GIME Certification? and, for the decision framing, Is the GIME Certification Worth It?

Exam Format and Delivery Mechanics

The exam is a single web-based, proctored sitting with these published parameters:

Several things GIAC does not publicly specify deserve honesty. The sources we reviewed do not state how many questions are scored versus unscored, the exact mix of item types, whether the exam is adaptive, or any calculator rules. They also do not describe a GIME-specific hands-on practical component, so you should not assume the lab-style format used by some other GIAC exams applies here. Treat the published facts as your planning baseline and check your GIAC account for anything specific to your purchased attempt.

The 67% threshold is a passing score, not a pass rate. They are frequently confused. The score tells you how much of the exam you must answer correctly; a pass rate would describe how many candidates succeed, and GIAC does not publish a population pass rate for GIME. Our articles on the GIME passing score and the GIME pass rate unpack that distinction in detail.

Fees, Retakes, and the Access Window

GIAC prices are listed in US dollars and exclude applicable sales tax. No member versus non-member schedule is published for GIME.

SANS training and affiliate bundles are priced separately, so the exam fee alone is not the whole budget if you take the FOR518 course. For a full breakdown including how these line items combine, read the GIME certification cost guide.

The 120-Day Window

Once your attempt is activated, you have 120 days to complete it. This window is separate from the 2 hours of examination time. If you need more runway, the standard extension adds 45 days, subject to a 570-day maximum access limit. The extension costs $479, which is a strong incentive to schedule deliberately rather than treating the window as a cushion. Purchase-specific delivery terms and your GIAC account govern the actual attempt, so confirm them before you plan around dates. Our GIME exam dates guide covers scheduling logistics.

The 13 Objective Headings, Explained

GIAC lists 13 headings under its exam certification objectives and outcome statements, verified against the issuer's GIME page. These are official exam objectives, not a preparation curriculum, and GIAC does not publish percentage weights or identify a highest-weighted area. We present them in the issuer's order; for a deeper treatment, see our complete guide to all 13 GIME content areas.

Foundations: Platforms, Disks, and File Systems

Acquiring and Triaging Evidence

Applications, Documents, and the Cloud

Reconstructing Behavior

Working With an Open-Book Exam

GIME permits printed books, notes, and an index. Electronic references, internet access, and materials resembling practice or exam questions and answers are prohibited. That last rule matters: you cannot bring in anything that looks like a question-and-answer dump, so your notes should be conceptual and organized by topic rather than by remembered questions.

Open book changes how you study. The goal is not memorizing every artifact path but knowing where to find it in seconds. A strong index maps terms, artifacts, and concepts to the right page, and the best ones are built from your own study rather than copied from someone else's. Because you cannot return to a question, an index that gets you to the answer quickly on the first read is worth more than one that is exhaustive but slow.

Who Benefits From the Credential

The skills GIME validates map to roles where Apple devices become evidence or attack surface: digital forensic examiners, incident responders, corporate security teams supporting Mac-heavy fleets, e-discovery and investigations groups, and law enforcement or government forensic labs. Organizations with significant macOS and iOS adoption, such as creative agencies, technology companies, and mobile-first businesses, have an obvious need for examiners who understand those systems rather than treating them as an afterthought to Windows forensics.

We deliberately avoid quoting salary numbers because GIAC publishes none and invented figures would mislead you. For a qualitative look at how the credential relates to compensation and role types, see the GIME salary guide and the GIME jobs overview.

Prerequisites in Practice

There are no formal prerequisites: no mandatory education, work-hour, training-hour, or reference requirement. Training is recommended rather than compulsory. That said, the related FOR518 course describes working knowledge of forensics and the Unix command line as useful. Those are course recommendations, not GIME eligibility rules, but they are realistic signals of what makes the material approachable. Details are in our GIME requirements guide and the GIME training overview.

Sequencing Your Preparation by Domain

The one place generic scheduling helps is ordering the 13 headings so that each builds on the last. Foundations first, because every artifact heading assumes you understand the file system beneath it; reconstruction headings last, because timelines and pattern of life synthesize everything before them.

This eight-week arrangement is a suggestion, not an official plan; adjust it to your background. Someone with strong Unix and forensic experience may compress the foundations, while an examiner new to Apple platforms may want longer there. For a fuller methodology, read the GIME study guide, and gauge your starting point with how hard the GIME exam is.

When you reach the final weeks, simulate the real conditions: 75 questions, 2 hours, only printed materials, and no changing answers. Our practice tests are built for exactly this kind of timed rehearsal, and working through them will expose gaps in your index before the real attempt does.

Validity and Renewal

A GIME certification is valid for 4 years. You can renew either by earning 36 CPEs (continuing professional education credits) or by passing the renewal exam, and in both cases the $499 renewal fee applies. If you hold multiple GIAC certifications, additional renewal registrations made within 2 years after a full-price $499 renewal cost $249 each. Planning your CPEs across the four years is far less stressful than scrambling in the final months.

Frequently Asked Questions