The Certified Incident Response Professional (CIRP) is an intermediate, vendor-neutral certification for SOC analysts, responders and security engineers who have to take an incident from the first alert through to the lessons-learned review. It validates that you can prepare and detect, scope and investigate with sound evidence handling, contain, eradicate and recover in the right order, handle the specific playbooks for ransomware, business email compromise, cloud takeover and insider cases, and meet the communication and legal obligations that a real breach creates. The exam is computer adaptive and performance-based, and the credential is kept current through continuing education.
| Level | Intermediate. A professional credential: it goes deep on running incidents and assumes working SOC or security experience. |
|---|---|
| Delivery model | Computer adaptive, three stages. Your score on each stage selects the difficulty of the next, so no two candidates sit the same paper. |
| Format | 80 questions. A performance-based exam that includes performance-based questions and multiple-choice questions. No vendor product knowledge required. |
| Time | 120 minutes for the whole exam, timed. Autosaves every answer. |
| Scoring | You need a score of 700 out of 900 to pass. Results are reported on a scale of 100 to 900, and 700 corresponds to answering 72% of the exam correctly. Harder questions carry more weight, so a score means the same thing on any route. Multiple-response items and PBQs are all or nothing. |
| Retakes | No waiting period after a failed first attempt. Every attempt is paid for at the exam price. See the CertLabz Certification Retake Policy. |
| Voucher validity | 12 months from purchase, for one sitting. |
| Certification validity | 3 years. Renew with 50 CEUs per cycle and the $35 annual CE fee, or pass the current exam. Renewal details. |
| Language | English. |
| Credential | PDF certificate with QR code, public verification page, LinkedIn-ready credential ID. Issuer: CertLabz Certification Board. |
| Free resources | The exam objectives PDF and the ten sample questions PDF. |
| Workforce mapping | NICE Framework work roles: Incident Response (PD-WRL-003), Defensive Cybersecurity (PD-WRL-001). O*NET occupations: Information Security Analysts (15-1212.00). Self-declared by CertLabz, not reviewed by NIST or CISA. See the full mapping. |
A signed, verifiable:
The CIRP is a performance-based exam: it includes performance-based questions alongside multiple-choice questions. Instead of only picking A, B, C or D, you sequence the response to a credential-based intrusion, order evidence by volatility, classify actions as containment, eradication or recovery, and match a notification duty to the trigger that creates it. It is computer adaptive, is proctored and timed, needs no mandatory course, and covers the whole lifecycle rather than one tool or one phase.
The NIST SP 800-61 phases in order, with the decision rights, playbooks and metrics that let a team act at speed without improvising.
Scoping, timelines, order of volatility, memory and disk forensics, and pivoting on indicators and behavior to find the whole footprint.
Short and long-term containment, eradicating access and persistence together, and recovery from verified, clean backups.
Ransomware, BEC, cloud and insider playbooks, chain of custody, breach and securities notification, and lessons that change controls.
Incident response is where security careers accelerate: the people who can run a breach calmly are scarce and well paid, and every industry now needs them. Every route is shown here at once, so nothing is hidden behind a control you have to find.
United States pay reported by Glassdoor, checked September 2026. Pay varies by location, employer and experience. No certification guarantees a salary or a job.
| CertLabz CIRP | GIAC GCIH | EC-Council ECIH | CompTIA CySA+ | |
|---|---|---|---|---|
| What it is | Certification exam | Certification exam | Certification exam | Certification exam |
| Computer adaptive | Yes | No | No | No |
| Hands-on PBQs | Yes | No | No | Yes |
| Vendor neutral | Yes | Yes | Yes | Yes |
| Proctored | Yes | Yes | Yes | Yes |
| Scope | Incident response | Incident handling | Incident handling | Broad security analyst |
| Questions | 80 | 106 | 100 | Up to 85 |
| Time | 120 min | 240 min | 180 min | 165 min |
| Pass mark | 700 of 900 | 69% | 70% | 750 of 900 |
| Course required | No | No | No | No |
| Exam voucher | $149 | $999 | $450 | $425 |
Compiled September 2026 from the GIAC GCIH page, the EC-Council ECIH pages and the CompTIA CySA+ pages. Product names and trademarks belong to their owners; CertLabz is not affiliated with any of them. Confirm current details with each provider.
Six reasons this credential is worth your time, and worth an employer's attention.
One price for the exam, set by its level. Bundles add the study guide and hands-on practice at a saving.
Secure checkout by Stripe. Prices in USD. Sign in or create a free CertLabz account at checkout.
Every form is drawn from a bank of more than 90 items to these exact weights, whichever adaptive route you take. Filter by the area you want to study.
The exam runs in three stages. Your score on each stage selects the difficulty of the next, so a strong candidate is stretched and a struggling one is measured fairly rather than swamped. No two candidates sit the same paper. Harder questions carry more weight, so a scaled score means the same thing whichever route you took.
Each exam can have up to 5 to 12 performance-based questions, drawn fresh on every attempt, alongside the multiple-choice questions. A PBQ is a task rather than a list: you sequence a response, order evidence by volatility, classify containment versus eradication, or match a notification duty to its trigger. They are scored all or nothing, so partial guesses do not pass.
Yes. Scenarios use logs, evidence and lifecycle decisions described generically, mapped to NIST SP 800-61 and common frameworks. You never need one EDR's or one SIEM's product syntax. Where a question involves a tool, it is described generically.
700 out of 900. Results are reported on a scale of 100 to 900, and 700 corresponds to answering 72% of the exam correctly.
There is no waiting period between a failed first attempt and a second attempt. Buy another voucher and sit the exam again when you are ready, and it will draw a fresh adaptive form from the bank. See the CertLabz Certification Retake Policy.
Yes, after three years. Keep it current by logging 50 CEUs during the cycle and paying the $35 annual CE fee before expiry, or by passing the current exam again.
The exam objectives PDF and the ten sample questions PDF. The CIRP Official Study Guide is a $50 ebook, included in two of the bundles. Hands-on practice comes with the All Access plan, included in the Complete bundle.
A laptop or desktop with a webcam and microphone, Chrome, Edge or Firefox, a stable connection, and a quiet private room for two hours. Phones and tablets are not supported.
CIRP is a continuing-education certification, like the CE credentials from CompTIA and ISC2. It is valid for three years from the day you pass. To keep it, log 50 continuing-education units during the cycle and pay the $35 annual CE fee before your expiry date. Or pass the current version of the exam again. Earning a higher-level CertLabz certification renews it too, the way CompTIA certifications stack.
CEUs are logged from your CertLabz dashboard with supporting evidence. A certification that lapses can be reinstated only by passing the current exam.
Buy a voucher, study the objectives, sit the exam when you are ready. Your credential is issued the moment you pass.