- The exam has 150 multiple-choice items (120 scored, 30 beta) in 3 hours, closed book, English only.
- NIST Control Families is the heaviest domain at 22%; NISTIRs is the lightest at 6%.
- Initial exam costs USD 395; one same-role retest costs USD 197.50 after 21 days.
- Certification needs five years of experience, with up to three waived through degrees and certifications.
The One-Page Snapshot
This cheat sheet condenses everything a Federal IT Security Professional - Designer candidate should have memorized or bookmarked before sitting the exam. The credential is issued by the Federal IT Security Institute (FITSI), and the role-specific shorthand you will see in official documents is FITSP-D, with the current handbook name FITSP-Designer-NG. It is a federal-focused credential: the exam tests whether you can apply NIST publications, federal standards, and governmental law to the design of secure systems, not whether you can recite vendor product features.
If you are brand new to the credential, start with What Is FITSP-Designer? and then return here for the condensed review. For a deeper walkthrough of how to build a study plan around the material below, see the FITSP-Designer Study Guide.
Exam Format and Logistics at a Glance
| Item | What to Know |
|---|---|
| Administrator | FITSI administers and proctors the computer-based exam |
| Total items | 150 multiple-choice questions |
| Scored vs. beta | 120 scored items plus 30 beta items |
| Time limit | 3 hours; breaks do not extend the timer |
| Language | English only |
| Reference materials | Closed book; personal calculators prohibited |
| Passing method | Designer-specific cut score from an Angoff study, approved by the Scheme Committee |
| Published numeric threshold | Not published in the retrieved handbook |
What the 30 beta items mean for you
Thirty of the 150 items are unscored beta questions used to evaluate future exam content. You will not know which ones they are, so answer every question as though it counts. Treating a question as "probably beta" and rushing it is a bad bet. Roughly 80 percent of the exam is scored, and any single item could be one of the 120.
The cut score question
Candidates frequently ask for the exact percentage needed to pass. The method is documented (an Angoff study approved by the Scheme Committee), but a numeric threshold is not published in the handbook we reviewed. Plan to master the material rather than aim at a target number. The article on the FITSP-Designer passing score explains what is and is not known, and the pass rate article covers what the available data does and does not show.
Six Domains, Six Weights
The exam is built on six official weighted domains. These are distinct from the 18 cross-cutting security topic areas that appear in FITSI's body of knowledge; do not confuse the two lists when reading older courseware. The weights below took effect June 1, 2024, and current handbook weights take precedence over older reference guides and training materials.
| Domain | Weight | Priority |
|---|---|---|
| Domain 3: NIST Control Families (CFs) | 22% | Highest |
| Domain 1: NIST Special Publications (SPs) | 20% | High |
| Domain 5: NIST Risk Management Framework (RMF) | 20% | High |
| Domain 4: Governmental Laws and Regulations | 19% | High |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% | Medium |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% | Lower, but not skippable |
Notice that four domains sit between 19% and 22%. There is no single "easy" domain to lean on, and the top four together account for 81% of the exam. For the full breakdown of each content area, see the FITSP-Designer exam domains guide.
Domain-by-Domain Cheat Notes
Domain 3: NIST Control Families (22%)
The largest domain rewards candidates who can move fluidly between control families and understand what each one is designed to accomplish in a system design.
- Know each family's purpose well enough to match a described security need to the right family.
- Understand how controls are selected, tailored, and supplemented rather than just listed.
- Practice distinguishing similar-sounding families, since scenario questions often hinge on picking the family that fits best.
- As a Designer, think about where a control is built into architecture versus operated afterward.
Domain 1: NIST Special Publications (20%)
This domain is about knowing which publication addresses which problem. Expect questions that describe a task and ask which document governs it.
- Build a one-line purpose statement for each Special Publication in your study material.
- Understand how publications relate to one another (for example, which supports risk assessment versus control selection).
- Focus on what each document is for and when a designer would consult it.
Domain 5: NIST Risk Management Framework (20%)
The RMF is the connective tissue of federal system security. Designers need to know where their work sits in the lifecycle.
- Know the sequence of RMF steps and the main activities and outputs in each.
- Understand how categorization drives control selection and later authorization decisions.
- Be able to explain which design decisions are made early and how they affect assessment later.
Domain 4: Governmental Laws and Regulations (19%)
This is the domain that most separates FITSP-Designer from general security credentials. It tests federal statutes, policy, and mandates that shape how systems must be designed.
- Know what each law or regulation requires and who it applies to.
- Connect legal requirements to the technical standards and publications that implement them.
- Expect scenario questions where the correct answer is the requirement that actually applies, not the one that sounds most familiar.
Domain 2: NIST FIPS (13%)
FIPS documents are mandatory standards for federal systems, so questions tend toward what is required rather than what is recommended.
- Know the purpose of each FIPS in your reference material and which design decisions it constrains.
- Pay attention to the difference between a mandatory standard and guidance.
- Link FIPS content to the categorization and control concepts in Domains 3 and 5.
Domain 6: NIST Interagency Reports (6%)
The smallest domain still contributes meaningfully to a 120-item scored exam. A modest, targeted review pays off here.
- Learn the subject and intent of the NISTIRs covered in your reference material.
- Do not over-invest; a short pass with practice questions is usually more efficient than deep reading.
Registration, Fees, and Retest Rules
| Item | Detail |
|---|---|
| Initial exam fee | USD 395 |
| Same-role retest | USD 197.50 (discounted) |
| Retest timing | At least 21 calendar days after the initial attempt, and within one year of it |
| Annual maintenance fee | USD 75 once certified |
| FITSI membership | Optional |
The retest discount applies to the same role only and has both a floor (21 days) and a ceiling (one year). If you fail, use the waiting period to rebuild weak domains instead of rebooking immediately. For a full financial picture, including maintenance costs, see the certification cost breakdown.
Delivery options: check before you plan
The handbook describes both in-person and remote delivery, but the registration page has labeled in-person testing as unavailable. Confirm which sessions are actually open at FITSI's registration page before building your timeline around a particular format. Scheduling specifics are covered in the exam dates article.
Eligibility, Certification, and Renewal
Passing the exam is one part of becoming certified. FITSI also evaluates your professional background.
What certification requires
- Five years of information-security experience
- A completed application and a current resume or CV
- Two professional endorsements
- Agreement to the Code of Ethics
- Application submitted within five years of passing the exam
Experience waivers
The five-year requirement can be reduced, up to three years total, in these ways:
- An accredited bachelor's degree can waive one year.
- An IT or information-assurance master's degree can waive a second year.
- An issuer-listed security certification can waive one more year.
The full eligibility picture, including how to document experience, is in the requirements guide.
Staying certified
Certification is valid for three years. To renew, earn 60 CPE credits per certification over that cycle or retest at the end of it, continue observing the Code of Ethics, and pay the USD 75 annual maintenance fee. Be careful with older sources: a six-year cycle appears in FITSI's March 3, 2020 NG FAQ, but it was superseded by the May 3, 2024 announcement, effective June 1, 2024. The 2025 Holder Handbook covers both legacy and NG credentials.
Key Takeaway
If you see a six-year renewal cycle in an older forum post, blog, or courseware PDF, ignore it. The current cycle is three years, with the USD 75 annual fee due each year.
A Weighting-Driven Review Schedule
Because the exam weights are published, your review time can be allocated proportionally instead of evenly. Here is one way to sequence a six-week plan, with the logic tied to FITSP-Designer's structure rather than generic habits.
Domain 4 and Domain 1 foundations
- Start with governmental laws and regulations, since they explain why the NIST publications exist.
- Begin purpose statements for each Special Publication.
Domain 2 and Domain 1 completion
- Cover FIPS while the legal context is fresh, noting which standards are mandatory.
- Finish Special Publication mapping.
Domain 5: Risk Management Framework
- Learn the RMF steps, outputs, and how categorization feeds everything downstream.
Domain 3: Control Families, part one
- Take the heaviest domain in two passes so it gets the most repetition.
- Connect each family to RMF steps from Week 3.
Domain 3 part two and Domain 6
- Finish the remaining control families, then review NISTIRs briefly.
Cross-domain practice
- Take timed sets of 150 questions in 3-hour sessions to build pacing.
- Revisit any domain where scenario questions still feel ambiguous.
Adjust the plan to your background. Someone with deep federal compliance experience may compress Weeks 1 and 3, while a candidate coming from commercial security may need extra time on Domain 4. The study guide offers more detail on adapting the schedule, and the main practice test site lets you drill by topic.
Test-Day Rules That Can Cost You a Session
- Arrive or connect 30 minutes early. Late arrival risks losing your slot.
- Bring two signed IDs. At least one must be a photo ID.
- Remote testing needs two devices. You need a personal computer for the exam plus a separate phone or tablet for monitoring.
- Plan breaks carefully. The timer keeps running, so a break comes straight out of your 3 hours.
- Leave the calculator at home. Personal calculators are prohibited, and the exam is closed book.
Pacing math is simple: 150 items in 180 minutes works out to a little over a minute per question. Flag scenario questions that eat time, move on, and return if time remains. The aim is to see every question, since you cannot tell which 30 are unscored.
Frequently Asked Questions
The exam contains 150 multiple-choice items: 120 scored and 30 beta items. You have 3 hours, and the exam is closed book and offered in English only.
NIST Control Families is the largest at 22%. It is followed by NIST Special Publications and the NIST Risk Management Framework at 20% each, then Governmental Laws and Regulations at 19%, NIST FIPS at 13%, and NIST Interagency Reports at 6%.
The initial exam is USD 395. A discounted same-role retest costs USD 197.50 and is available after at least 21 calendar days, within one year of the initial attempt. Certified holders also pay a USD 75 annual maintenance fee.
Certification requires five years of information-security experience, plus an application, resume, two endorsements, and agreement to the Code of Ethics. You must submit the application within five years of passing. Degrees and an issuer-listed certification can waive up to three years. See the requirements guide for details.
Certification is valid for three years. Renew by earning 60 CPE credits per certification over the cycle or by retesting at the end, while observing the Code of Ethics and paying the USD 75 annual fee. Older references to a six-year cycle are outdated.
Whether the credential fits your career goals is a separate question from whether you can pass it. For that, read the ROI analysis, then return to timed practice on the main practice test site to confirm you are ready.