GSTP study guide
GSTP · Work through your exam, one topic at a time.
The GIAC Security Transformation Professional (GSTP) is a credential whose details could not be verified at the time of writing. The official GIAC certification page for the GSTP returned a "404 Page Not Found" error on retrieval, and the page content contained no descriptions of the exam's scope, its target audience, its item count, time limit, passing score, fee, delivery format, retake policy, or validity period. The GSTP study guide has 4 sections and about 1,521 words.
01Security Transformation Strategy and Governance
This domain tests whether you can connect a security transformation to business strategy and run it through a governance system that makes decisions, allocates money, and accepts risk in writing. Expect questions on strategy-to-execution traceability, decision rights, policy hierarchy, board reporting, and regulator expectations such as NIS2, DORA, and the SEC four-business-day material incident disclosure under Form 8-K Item 1.05.
389 words, about 2 min02Risk Management and Security Program Design
This domain tests how you identify, assess, treat, and monitor risk, and how you convert that into a program with scope, controls, funding, and a roadmap. Expect the NIST RMF steps, the ISO/IEC 27001:2022 clause 6 risk process and Statement of Applicability, FAIR quantification, business impact analysis, and third-party risk tiering.
405 words, about 2 min03Security Architecture and Technology Transformation
This domain tests architecture decisions and technology transformation: principles, reference architectures, zero trust, cloud and identity, secure by design, and architecture governance. Expect NIST SP 800-207 zero trust tenets, the CISA Zero Trust Maturity Model pillars, shared responsibility, SBOM and SLSA, and threat modeling.
377 words, about 2 min04Change Leadership, Operations, and Metrics
This domain tests execution: leading people through change, running security operations reliably, and proving progress with metrics that survive board scrutiny. Expect ADKAR and Kotter, stakeholder mapping, ITIL 4 change enablement, incident and problem management, and leading versus lagging indicators.
350 words, about 2 min