What Is GIME?

What GIME Is, and What It Is Not

GIME stands for GIAC iOS and MacOS Examiner. It is a certification from GIAC Certifications (previously Global Information Assurance Certification) that validates a practitioner's ability to examine Apple devices and operating systems in a forensic or incident response context. Think of an examiner who must determine what happened on a Mac or an iPhone: which applications ran, which files were touched, what the user was doing, and whether anything was hidden in an encrypted container.

Because the acronym is short, it is easy to confuse with unrelated credentials. This article is only about the GIAC credential. If you are searching for terminology, our pages on what GIME stands for and the meaning of GIME cover the naming question directly. Here, the focus is on what the certification actually tests and how a candidate should approach it.

Note that GIAC styles the credential "GIAC iOS and macOS Examiner (GIME)" with a lowercase "mac." Some references, including ours, preserve the "MacOS" spelling, but both point to the same certification.

Who Issues It and How the Exam Is Built

GIAC is the certification body that administers the exam. The format is straightforward:

• One web-based, proctored exam with 75 questions.
• Two hours of exam time.
• Delivery: onsite at a Pearson VUE center or remotely through ProctorU, subject to availability for your purchased attempt.
• Minimum passing score of 67% for exam versions released on or after June 2, 2022.

Several details are not publicly specified in the sources we reviewed: how many questions are scored versus unscored, the exact mix of item types, whether any practical component is specific to GIME, calculator rules, and whether the format is adaptive. We will not guess at these. Likewise, be careful not to confuse the passing score (the threshold you must reach) with a pass rate (the share of candidates who succeed). The first is published; the second is not. Our piece on the GIME passing score unpacks that distinction, and what the data shows about GIME pass rates explains why no reliable population figure exists.

The 13 Exam Objectives in Plain Language

GIAC lists 13 headings under its certification objectives and outcome statements. These are official exam objectives, not a preparation curriculum, and GIAC does not publish percentage weights or identify a highest-weighted objective. That means you should treat all 13 as fair game and avoid betting your preparation on a guessed emphasis. For a deeper walkthrough, see our complete guide to all 13 GIME content areas. Here is how each objective translates into candidate-level skills.

Foundations

Artifact Analysis

Investigation Workflow

Who Should Sit the Exam

GIME has no formal prerequisites. There is no mandatory education level, work-experience requirement, training-hour minimum, or reference requirement. Training is recommended rather than compulsory. The related SANS course, FOR518: Mac and iOS Forensic Analysis and Incident Response, describes working knowledge of forensics and the Unix command line as useful, but those course recommendations are not eligibility rules for the exam. Our GIME requirements guide goes through eligibility in more detail.

In practice, the credential suits people who already touch Apple evidence or expect to:

• Digital forensic examiners handling Mac and iPhone cases.
• Incident responders who encounter macOS endpoints in enterprise environments.
• Corporate investigators and e-discovery staff dealing with employee devices.
• Law enforcement and government forensic personnel.

If you are weighing the career angle, our articles on GIME jobs and whether the certification is worth it lay out the reasoning without relying on invented figures.

Fees, Attempt Windows, and Extensions

Money and timing are where candidates most often get surprised, so here are the published figures. All amounts are in USD and exclude applicable sales tax. GIAC does not publish a separate member and non-member schedule. SANS training and affiliate bundles carry their own separate pricing.

The timing rules are equally important. Once you activate your attempt, you have a 120-day window to complete it. That window is separate from the two hours of exam time. If you need more runway, the standard extension adds 45 days, subject to a 570-day maximum access limit. Your purchase-specific delivery terms and your GIAC account govern the actual attempt, so check both before scheduling. For a full breakdown, read our GIME certification cost guide, and for scheduling logistics see GIME exam dates and testing windows.

Working With an Open-Book Format

GIME is open book, but the rules are narrow. You may bring printed books, notes, and an index. You may not use electronic references or the internet, and materials resembling practice or exam questions and answers are prohibited. In other words, your reference material must be physical and must be your own study aid, not a cache of questions.

This format changes how you study. Memorizing every artifact path is less valuable than knowing where to find it in your materials quickly. Candidates who build a clear, personal index, organized around the 13 objectives, tend to navigate a two-hour, 75-question session far more calmly. That works out to well under two minutes per question on average, which leaves little time for browsing unfamiliar pages. Our GIME cheat sheet shows the sort of condensed facts worth capturing, and how hard the GIME exam is discusses where candidates typically struggle.

Sequencing the Objectives Across Your Preparation

Since GIAC does not publish weights, a sensible plan covers all 13 objectives and orders them by dependency: foundations first, artifacts next, synthesis last. This is the only schedule-style section in this article, and it is tied directly to the exam's structure. Adjust the pacing to your own availability and your 120-day window.

The reasoning is simple: workflow objectives like timelines and pattern of life are only meaningful once you know the underlying artifacts. For a more detailed plan, our GIME study guide goes further, and the GIME practice test site lets you rehearse under timed conditions. Note that GIAC sells its own practice exam for $399; our practice questions are an additional way to gauge readiness. Training options are covered in our GIME training overview.

Validity and Renewal

A GIME certification is valid for 4 years. To renew, you either earn 36 CPEs or pass the renewal exam, and in both cases you pay the renewal fee ($499). If you register additional renewals within 2 years after a full-price $499 renewal, each is $249. These figures matter for long-term budgeting, and they feed into the return-on-investment picture discussed in our GIME salary guide and the worth-it analysis linked above.

Frequently Asked Questions