- What the FITSP-Designer Credential Actually Is
- Exam Format and Test-Day Rules
- The Six Weighted Domains, Explained
- Domains Versus the 18 Cross-Cutting Topic Areas
- Experience, Endorsements, and Waivers
- Fees and Registration Mechanics
- Staying Certified: Three Years, 60 CPEs, and the Annual Fee
- Where the Credential Gets Used
- Sequencing Your Preparation by Domain
- Frequently Asked Questions
- The exam has 150 multiple-choice items in 3 hours: 120 scored questions plus 30 unscored beta items.
- NIST Control Families is the heaviest domain at 22%, followed by NIST SPs and the Risk Management Framework at 20% each.
- The initial exam costs USD 395; one same-role retest costs USD 197.50 after at least 21 days.
- Certification needs five years of security experience, though degrees and certifications can waive up to three years.
What the FITSP-Designer Credential Actually Is
FITSP-Designer is one of the role-based credentials issued by the Federal IT Security Institute (FITSI) under its Federal IT Security Professional (FITSP) scheme. The "Designer" role targets people who shape the security architecture and control selection of federal information systems, as opposed to those who operate, manage, or audit them. FITSI uses the shorthand FITSP-D, and its current handbook refers to the credential as FITSP-Designer-NG, the "next generation" version of the program.
What separates this certification from most vendor-neutral security credentials is its anchor: the federal body of knowledge. Instead of testing broad, general security theory, the exam draws on NIST publications, federal statutes, and the processes that govern how U.S. government systems are authorized and monitored. If you want the plain-language background first, our explainers on what FITSP-Designer certification is and what FITSP-Designer stands for cover the basics before you commit to a study plan.
FITSI administers and proctors the computer-based examination itself. Membership in FITSI is optional, so you do not need to join anything to sit for the exam.
Exam Format and Test-Day Rules
The exam consists of 150 multiple-choice items delivered in a 3-hour window. Of those 150, 120 are scored and 30 are beta items used to evaluate future questions. You cannot tell which are which, so treat every item as if it counts. The exam is offered in English only.
The passing standard is a Designer-specific cut score established through an Angoff study and approved by FITSI's Scheme Committee. A numeric threshold is not published in the handbook we reviewed, so be wary of any source that quotes a precise percentage. We unpack what is and is not known on the FITSP-Designer passing score page.
Logistics You Cannot Improvise
- Closed book: no reference materials, and personal calculators are prohibited.
- Two signed IDs: you need two, and at least one must be a photo ID.
- 30-minute early arrival: connect or arrive 30 minutes before your session starts.
- Breaks do not pause the clock: the 3-hour timer keeps running if you step away.
- Remote setup: remote testing requires a personal computer plus a separate phone or tablet for monitoring.
The Six Weighted Domains, Explained
The exam blueprint has six official weighted domains. The weights below took effect June 1, 2024, and current handbook weights take precedence over older reference lists or courseware you may find online. For a deeper pass through each area, see the full FITSP-Designer exam domains guide.
| Domain | Weight | Character of the Content |
|---|---|---|
| Domain 3: NIST Control Families (CFs) | 22% | Control-level knowledge across the catalog |
| Domain 1: NIST Special Publications (SPs) | 20% | Guidance documents and their purposes |
| Domain 5: NIST Risk Management Framework (RMF) | 20% | Lifecycle process and authorization logic |
| Domain 4: Governmental Laws and Regulations | 19% | Statutory and policy drivers |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% | Mandatory federal standards |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% | Supporting research and reference reports |
Domain 3: NIST Control Families (22%)
The largest domain rewards breadth. Designers must understand what each control family is for and how families relate to one another when architecting a system's protections.
- Know what each family covers and what kinds of safeguards it contains.
- Practice distinguishing similar-sounding families under time pressure.
- Connect controls to design decisions, not just definitions.
Domain 1: NIST Special Publications (20%)
This domain tests whether you know which publication answers which question. Candidates who memorize titles without understanding scope tend to struggle with scenario items.
- Match each publication to its purpose and intended audience.
- Understand how guidance documents build on and reference one another.
- Be able to say which document applies to a given design situation.
Domain 5: NIST Risk Management Framework (20%)
The RMF is a process, and questions often probe the sequence and intent of its steps. Designers need to see where their work fits within the larger authorization lifecycle.
- Learn the steps in order and the purpose of each.
- Understand roles and responsibilities across the lifecycle.
- Tie design-time decisions to later assessment and monitoring.
Domain 4: Governmental Laws and Regulations (19%)
Legal and policy drivers explain why the technical requirements exist. Expect to connect a requirement to the mandate behind it.
- Know the major federal security-related laws and what each requires.
- Understand how statute flows down into standards and guidance.
- Recognize which mandates apply to which kinds of systems.
Domain 2: NIST FIPS (13%)
FIPS are the mandatory federal standards, so questions tend toward precise recall of what each standard governs and when it applies.
- Memorize the scope of each relevant FIPS publication.
- Understand where standards constrain design choices.
Domain 6: NIST Interagency Reports (6%)
The smallest domain, but not one to skip. NISTIRs are supporting research and reference reports, and a handful of questions can be the margin on a close result.
- Learn what NISTIRs are and how they differ from SPs and FIPS.
- Be familiar with the major reports referenced in the exam blueprint.
Domains Versus the 18 Cross-Cutting Topic Areas
One easy way to get confused is mixing up the two organizing structures FITSI publishes. The exam is weighted by the six domains above. Separately, FITSI describes 18 cross-cutting security topic areas, which are subject themes that run through the material rather than weighted exam sections. Do not build your study calendar around the 18 topic areas as if they were scored sections; use them as a lens for connecting ideas across domains.
The role's official task objectives are laid out in the FITSP-Designer Certification Competence Breakdown, while the Federal Body of Knowledge Guide provides the reference inventory behind the content. Because the body of knowledge guide is older than the handbook weights, use it for what to read, but trust the current handbook for how heavily each area counts.
Key Takeaway
Plan around the six weighted domains, and use the 18 topic areas only to cross-reference ideas. When any older course outline disagrees with the current candidate handbook, the handbook wins.
Experience, Endorsements, and Waivers
Passing the exam is only one part of earning the credential. Certification requires five years of information-security experience, a completed application, a current resume or CV, two professional endorsements, and agreement to the Code of Ethics. You must submit the application within five years of passing the exam.
The experience requirement can be reduced in three steps, up to three years total:
- An accredited bachelor's degree can waive one year.
- An IT or information-assurance master's degree can waive a second year.
- An issuer-listed security certification can waive one more year.
For a full walkthrough of qualifying and documenting your background, read our FITSP-Designer requirements guide.
Fees and Registration Mechanics
| Item | Cost | Notes |
|---|---|---|
| Initial exam | USD 395 | Taken through FITSI's proctored computer-based exam |
| Same-role retest | USD 197.50 | Discounted; only after at least 21 calendar days and within one year of the initial exam |
| Annual maintenance fee | USD 75 | Ongoing requirement to keep the credential active |
The retest discount comes with two timing conditions that trip people up: you must wait at least 21 calendar days, and you must use the retest within one year of the initial attempt. Miss that window and you are back to full price. A fuller breakdown, including recurring costs, lives in our FITSP-Designer certification cost guide.
Registration is handled through FITSI's exam registration page. Fees are drawn from the FITSI Fee Schedule, so confirm current pricing at checkout.
Staying Certified: Three Years, 60 CPEs, and the Annual Fee
Certification is valid for three years. To renew, you can earn 60 CPE credits per certification over that cycle, or retest at the end. Either way, you must observe the Code of Ethics and pay the USD 75 annual maintenance fee.
Where the Credential Gets Used
FITSP-Designer is built around federal practice, so its value concentrates where federal security requirements drive hiring. That typically means:
- Federal agencies that need staff able to architect systems consistent with NIST guidance.
- Government contractors and integrators who must show customers that their engineers understand the federal control and authorization landscape.
- Consultancies supporting authorization work where RMF fluency and control selection are daily tasks.
Whether it pays off depends heavily on your target employers. If your career is aimed at federal or federal-adjacent work, the alignment is strong; if it is aimed at purely commercial roles, weigh that carefully. We discuss the tradeoffs in is the FITSP-Designer certification worth it, and you can browse role types in our FITSP-Designer jobs overview. Compensation varies widely by employer and clearance level, which is why our salary guide focuses on qualitative drivers rather than a single number.
Sequencing Your Preparation by Domain
Rather than a generic schedule, order your study by how the domains depend on one another. Laws explain why standards exist, standards and guidance feed the process, and the process uses the controls. This sequence is one reasonable way to build that chain; adjust the pacing to your background. Our broader FITSP-Designer study guide covers resources in more depth.
Laws and Regulations (Domain 4)
- Build the legal backbone so later standards make sense.
- Map each mandate to the guidance it triggers.
FIPS and NISTIRs (Domains 2 and 6)
- Cover the two smaller domains together, since both are recall-heavy.
- Create a one-line scope summary for each publication.
NIST SPs and the RMF (Domains 1 and 5)
- Study the Special Publications in the context of RMF steps.
- Practice explaining which document supports which step.
Control Families (Domain 3)
- Give the largest domain the most repetition near test day.
- Drill family-to-purpose recall until it is automatic.
In the final stretch, take timed practice sets that mimic the 150-question, 3-hour format so pacing becomes familiar. At roughly 72 seconds per item if you used the whole window, there is little room for lingering on a single question. Try our FITSP-Designer practice tests to rehearse that rhythm, and keep our one-page cheat sheet handy for last-day review.
Frequently Asked Questions
The exam has 150 multiple-choice items delivered in 3 hours. Of these, 120 are scored and 30 are unscored beta items, and you cannot tell which is which while testing.
FITSI uses a Designer-specific cut score set through an Angoff study and approved by its Scheme Committee. A numeric threshold is not published in the handbook reviewed for this article, so avoid sources that claim a precise percentage. See our pass rate discussion for what can and cannot be said.
Yes. A single discounted same-role retest costs USD 197.50, available after at least 21 calendar days and within one year of your initial exam. Outside those conditions, standard pricing applies.
Experience is a requirement for certification, not necessarily for sitting the exam. You must submit your application within five years of passing. Degrees and an issuer-listed security certification can waive up to three years of the experience requirement.
Difficulty depends on your familiarity with NIST publications, federal law, and the RMF rather than general security theory. Candidates with federal systems experience often find the content more natural. Our difficulty guide explores what makes the exam challenging.