- GSLC requires 70% correct on 115 questions in a 3-hour proctored exam window.
- GIAC publishes 18 objectives with no percentage weighting, so no single domain is "safe" to skip.
- The exam is open book for printed materials only - no electronic notes or internet access.
- A failed attempt costs $899 to retake, on top of the original $999 registration.
The Number: 70% Across 115 Questions
If you're searching for the GSLC passing score, here's the direct answer: you need 70% correct on a 115-question exam, completed within a 3-hour window. That works out to roughly 81 correct answers out of 115 - GIAC doesn't publish a scaled scoring formula for GSLC the way some other certifying bodies do, so the raw percentage is what matters.
There's no partial credit for "close enough" answers, and there's no separate cut score per domain. You're not required to hit 70% in Cryptography Concepts for Managers and 70% in Managing Cloud Security separately - it's one aggregate score across all 18 objective areas. That single fact should shape how you study, and we'll come back to it in the domain breakdown below.
How GSLC Scoring Actually Works
GSLC is delivered as a web-based, proctored exam, either remotely through ProctorU or in-person through a Pearson VUE testing center. Regardless of delivery method, the scoring mechanics are identical: 115 questions, 3 hours, 70% to pass. There's no adaptive difficulty and no negative marking for wrong answers, so guessing on a question you're unsure about is always better than leaving it blank.
Because the passing threshold is a flat percentage rather than a domain-weighted score, candidates sometimes assume they can cherry-pick which of the 18 objectives to master deeply and which to skim. That strategy is riskier than it sounds - GIAC doesn't publish how many questions come from each domain, so you have no way of knowing in advance which areas are "worth" more on test day. For a full walkthrough of how the objectives are structured, see the GSLC Exam Domains 2026: Complete Guide to All 18 Content Areas.
Key Takeaway
Treat every domain as equally likely to appear in meaningful numbers. Skipping a domain because it "sounds minor" (like Managing Negotiations and Vendors) is a common way candidates fall just short of 70%.
Why 18 Unweighted Domains Change Your Math
Most GIAC exams list objectives without percentage weights, and GSLC is no exception. Here's the full list of domains you're being scored against:
Domain 1: Cryptography Concepts for Managers
Management-level understanding of encryption types, hashing, and key management - not implementation detail, but enough to make policy and vendor decisions.
- Symmetric vs. asymmetric use cases
Domain 2: Incident Response and Business Continuity
How IR plans integrate with business continuity and disaster recovery planning at a program level.
- IR lifecycle stages and escalation paths
Domain 3: Managing a Security Operations Center
SOC staffing models, tooling decisions, and metrics a manager uses to evaluate SOC effectiveness.
- SOC maturity indicators
Domain 5: Managing Artificial Intelligence
Governance and risk considerations for AI adoption inside a security program - a newer addition that reflects how quickly GIAC updates objectives.
- AI-specific risk and oversight concerns
The remaining domains - Managing Application Security, Managing Cloud Security, Managing Encryption and Privacy, Managing Negotiations and Vendors, Managing Projects, Managing Security Awareness, Managing Security Policy, Managing System Security, Managing the Program Structure, Network Monitoring for Managers, Network Security Architecture, Networking Concepts for Managers, Risk Management and Security Frameworks, and Vulnerability Management - round out the full 18. Each represents a distinct body of management-level knowledge rather than deep technical execution.
Because none of these carry a published weight, the safest interpretation of "70% to pass" is that you need broad competence, not narrow depth in a few favorite topics. A candidate who is excellent at Network Security Architecture but weak on Managing the Program Structure and Managing Projects can easily land in the high 50s or low 60s overall - short of the cut score. Our GSLC Study Guide 2026: How to Pass on Your First Attempt goes deeper into sequencing all 18 areas so no domain gets neglected.
| Exam Fact | Detail |
|---|---|
| Total questions | 115 |
| Time limit | 3 hours |
| Passing score | 70% |
| Approx. correct answers needed | ~81 of 115 |
| Domains covered | 18, unweighted |
| Attempt validity window | 120 days from registration |
The Open-Book Factor and What It Doesn't Cover
GSLC is open book - but with real limits. You're allowed printed books, printed notes, and a printed index during the exam. What's explicitly off-limits: electronic resources, internet access, and anything resembling practice-test-style reference material. There's no laptop, no PDF viewer, no phone lookup. If your "notes" are a digital file, they're not usable on exam day unless printed out ahead of time.
This changes exam strategy in a specific way: the passing score isn't really testing memorization of trivia, it's testing whether you can locate and apply the right concept quickly under time pressure. With 115 questions in 3 hours, you have under two minutes per question on average - not enough time to flip through an unindexed binder for every answer. Candidates who build a well-organized personal index (organized by the 18 domain names, not by book chapter) consistently report finishing with time to spare.
For candidates trying to gauge whether the open-book format makes GSLC easier or harder than it looks on paper, How Hard Is the GSLC Exam? Complete Difficulty Guide 2026 breaks down where the real difficulty sits - it's rarely the individual questions, and more often the sheer breadth of 18 domains competing for your prep time.
Fees, Attempts, and the 120-Day Clock
The passing score doesn't exist in isolation from the money and time mechanics around it. A GSLC attempt costs $999. If you don't clear 70% on the first try, a retake is $899 - not a small expense to shrug off. GIAC also sells a $399 practice exam and charges $499 for renewal down the line.
Once you register, your attempt stays active for 120 days. That window is your entire scheduling runway: book your ProctorU or Pearson VUE session, prep, and sit the exam before it lapses. Miss the window and you may need to re-register at additional cost. For the complete fee structure, including how the practice exam and renewal fees fit together over a 4-year certification cycle, see GSLC Certification Cost 2026: Complete Pricing Breakdown.
Key Takeaway
A retake costs $899 - nearly as much as the original $999 attempt. Treat the 70% cut score as non-negotiable and prep accordingly rather than planning on a "learning" first attempt.
If you're weighing whether the fee structure and time investment are worthwhile given where GSLC sits in a security management career path, Is the GSLC Certification Worth It? Complete ROI Analysis 2026 and GSLC Salary Guide 2026: Complete Earnings Analysis look at that question from the employer and compensation side. GSLC tends to appeal to candidates already in or moving toward security management, compliance, and program-leadership roles rather than hands-on technical positions - worth checking against current listings on GSLC Jobs.
Mapping the Passing Score to a Study Plan
Since the exam has no per-domain weighting, the most defensible prep approach is to allocate study time roughly evenly across all 18 domains, then add extra hours to whichever ones are genuinely unfamiliar to you personally. A network engineer moving into management might breeze through Networking Concepts for Managers and Network Monitoring for Managers but need real time on Managing Negotiations and Vendors or Managing Projects. A compliance-background candidate might need the opposite allocation.
Foundational Domains
- Cryptography Concepts for Managers
- Networking Concepts for Managers
- Risk Management and Security Frameworks
Operational Domains
- Managing a Security Operations Center
- Incident Response and Business Continuity
- Network Monitoring for Managers
- Vulnerability Management
Program and People Domains
- Managing Security Policy
- Managing Security Awareness
- Managing the Program Structure
- Managing Projects
- Managing Negotiations and Vendors
Technical Management Domains + Review
- Managing Cloud Security
- Managing Application Security
- Managing System Security
- Managing Encryption and Privacy
- Network Security Architecture
- Managing Artificial Intelligence
- Build and rehearse your printed index
Whatever pacing you use, build your printed index in parallel with your reading rather than after - retrofitting an index in the final week is where a lot of last-minute cramming goes wrong. If you want a condensed reference to sanity-check your own notes against, the GSLC Cheat Sheet 2026: One-Page Review of Must-Know Facts is built around the same 18-domain structure. And before you lock in a study calendar, confirm you meet the basic eligibility expectations in GSLC Requirements 2026: Eligibility, Prerequisites & How to Qualify and check upcoming testing windows via GSLC Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Running timed practice questions on our practice test platform before test day is one of the few ways to simulate the two-minutes-per-question pace you'll face across all 115 questions. Doing this across a full-length simulated exam - not just isolated flashcards - is what reveals whether your 70% is comfortable or borderline.
After You Hit 70%: Renewal Math
Passing is not the end of the scoring story. GSLC certification is valid for 4 years. To keep it active, you either earn 36 CPE credits within that period or retake and pass the current version of the exam again - at the current passing score, whatever it is at that time. Renewal itself carries a $499 fee separate from the CPE activities.
This matters for scoring strategy because GIAC periodically updates domain lists (note that Managing Artificial Intelligence is a relatively recent addition to the 18 objectives). A candidate who renews via the exam route four years from now will be tested against whatever domain list and cut score are current then, not the one they originally passed under.
If you're still deciding whether GSLC is the right credential to invest four years and a $999 sitting fee into, background reading like What Is GSLC Certification?, GSLC Meaning, and GSLC Certification covers the fundamentals, while GSLC Pass Rate 2026: What the Data Shows examines outcome data without relying on guesswork. For structured coursework options that map to the 18 domains, see GSLC Training.
FAQ
You need 70% correct across 115 questions, which is approximately 81 correct answers. There is no separate minimum per domain - it's one overall percentage.
No published weighting exists. GIAC lists all 18 objectives without percentages, so candidates should prepare for each domain as potentially significant rather than guessing which ones matter most.
No. GSLC permits printed books, printed notes, and a printed index only. Electronic resources, internet access, and practice-test-style materials are prohibited during the proctored session.
You can retake the exam for $899. Your original attempt and any retake still need to occur within the 120-day active window tied to your registration, so plan your retest date accordingly.
A GSLC pass keeps your certification valid for 4 years. You then renew with 36 CPE credits or by passing the current exam again, plus a $499 renewal fee.