- How the FITSP-Designer Blueprint Is Built
- Domain Weights at a Glance
- Domain 3: NIST Control Families (22%)
- Domain 1: NIST Special Publications (20%)
- Domain 5: NIST Risk Management Framework (20%)
- Domain 4: Governmental Laws and Regulations (19%)
- Domain 2: NIST FIPS (13%)
- Domain 6: NIST Interagency Reports (6%)
- Sequencing Your Study by Domain
- Exam Format and Registration Mechanics
- What Happens After You Pass
- Frequently Asked Questions
- The FITSP-Designer exam has six weighted domains; NIST Control Families is the largest at 22%.
- The exam has 150 multiple-choice items in 3 hours: 120 scored and 30 unscored beta items.
- NIST Special Publications and the Risk Management Framework each carry 20%, so together they exceed Control Families alone.
- NIST Interagency Reports are only 6%, but the domain still deserves targeted review, not a skip.
How the FITSP-Designer Blueprint Is Built
The Federal IT Security Professional - Designer credential, issued by the Federal IT Security Institute (FITSI), is built for people who design security into federal information systems. Its exam blueprint reflects that purpose: instead of testing vendor products or generic security theory, it tests how well you know the federal standards, laws, and processes that govern system security. If you are new to the credential itself, start with what FITSP-Designer is and then return here for the content breakdown.
The current blueprint has six official weighted domains. These are distinct from the 18 cross-cutting security topic areas that FITSI also uses to organize the body of knowledge. Candidates sometimes confuse the two lists, so keep them separate in your notes: the six domains determine how many exam items you will see from each source family, while the topic areas cut across those domains (access control, for example, can surface through a NIST control family, a Special Publication, and a federal law all at once).
This guide is the domain-by-domain companion to our broader FITSP-Designer study guide. It focuses on what each domain contains, how heavily it is weighted, and what the Designer role specifically needs from you in each area.
Domain Weights at a Glance
| Domain | Name | Weight | Source Family |
|---|---|---|---|
| 1 | NIST Special Publications (SPs) | 20% | NIST 800-series guidance |
| 2 | NIST Federal Information Processing Standards (FIPS) | 13% | Mandatory federal standards |
| 3 | NIST Control Families (CFs) | 22% | Security and privacy control catalog |
| 4 | Governmental Laws and Regulations | 19% | Statutes, directives, regulations |
| 5 | NIST Risk Management Framework (RMF) | 20% | Lifecycle process for authorization |
| 6 | NIST Interagency Reports (NISTIRs) | 6% | Research and technical reports |
The weights sum to 100%. Notice how flat the distribution is: five of the six domains sit between 13% and 22%. There is no single domain you can ignore and still pass comfortably, and no single domain you can master to compensate for weakness elsewhere. Only the NISTIR domain is small enough to treat as a lower-priority review item.
Because the exam contains 120 scored items out of 150 total, the percentages translate roughly into a count of scored questions per domain. The 30 beta items are unscored and are not identified to you, so treat every question as if it counts.
Domain 3: NIST Control Families (22%)
The heaviest domain is the control catalog itself. A Designer selects, tailors, and specifies controls for a system, so the exam expects you to know the control families as a working vocabulary, not as a memorized list of two-letter abbreviations.
NIST Control Families (CFs)
You should be able to recognize what each family is for, which families commonly work together, and how a control's purpose maps to a design decision.
- Know the family names and their abbreviations well enough to decode an identifier such as AC-2 or SC-7 at a glance.
- Understand the difference between a base control, a control enhancement, and a baseline allocation.
- Practice distinguishing similar families, such as audit and accountability versus system and information integrity, and identification and authentication versus access control.
- Be comfortable with tailoring concepts: scoping, compensating controls, parameter assignment and selection.
- Connect families to system design: boundary protection, cryptographic protection, configuration management, and contingency planning all shape architecture.
Scenario questions in this domain tend to describe a system need and ask which control family or control addresses it. That means rote recall is not enough; you need to reason from a requirement to the right family. A good drill is to take a design requirement ("limit what a service account can reach") and name the family, then the likely control, then the baseline impact level where it typically appears.
Domain 1: NIST Special Publications (20%)
The Special Publications domain covers the NIST 800-series guidance that explains how to implement federal security requirements. Where the control families domain asks "what is the control," this domain asks "which document tells you how to do it, and what does that document say."
NIST Special Publications (SPs)
Expect questions that test whether you know a publication's purpose, its audience, and the process it defines.
- Match each core publication to its job: control catalog, assessment procedures, security categorization, risk assessment, contingency planning, continuous monitoring, and so on.
- Know which publications support the Risk Management Framework steps, since this domain overlaps heavily with Domain 5.
- Understand what distinguishes guidance from requirement: Special Publications generally provide guidelines, while FIPS are mandatory standards.
- Be able to recognize when a scenario calls for a particular document, such as an assessment procedure, a system security plan, or a risk assessment output.
One practical caution: the FITSI Federal Body of Knowledge Guide (v2.2, October 2021) is a reference inventory, but the current candidate handbook governs the weights. If a publication has been revised since the guide was written, verify which edition the exam objectives point to before you invest hours in it. For the official task-level objectives for the Designer role, FITSI publishes the FITSP-Designer Certification Competence Breakdown (v3.0, April 2023).
Domain 5: NIST Risk Management Framework (20%)
The Risk Management Framework is the lifecycle process that takes a system from categorization through authorization and ongoing monitoring. For a Designer, it is the process wrapper around everything else on the exam.
NIST Risk Management Framework (RMF)
You need to know the steps in order, the inputs and outputs of each, and who is responsible for what.
- Memorize the step sequence and the purpose of each step, including preparation, categorization, selection, implementation, assessment, authorization, and monitoring.
- Know the key artifacts: system security plan, security assessment report, plan of action and milestones, and the authorization decision.
- Understand roles such as authorizing official, system owner, security control assessor, and information system security officer, and what each can and cannot decide.
- Be ready for scenario questions that ask what happens next, or what was skipped, in a described authorization effort.
Domain 4: Governmental Laws and Regulations (19%)
This domain covers the statutes, directives, and regulations that create the obligation to secure federal systems in the first place. It is the domain most unlike the rest of the exam: instead of technical frameworks, you are reading policy and legal structure.
Governmental Laws and Regulations
Focus on what each authority requires, who it applies to, and how it connects to the NIST material.
- Know the major federal information security and privacy statutes, what each one mandates, and which agencies or roles it assigns responsibility to.
- Understand how executive-branch policy and directives relate to statute and to NIST guidance.
- Be able to explain why a requirement exists, not only that it exists; scenario items often ask which authority drives a given obligation.
- Recognize the relationship between the legal mandate and the mandatory FIPS that implement it.
Many technically strong candidates underweight this domain because it feels less hands-on, yet at 19% it is nearly as large as the RMF and Special Publications domains. If you are coming from a hands-on engineering background, plan explicit time for it. The difficulty guide explains why this is one of the areas where otherwise well-prepared candidates lose points.
Domain 2: NIST FIPS (13%)
Federal Information Processing Standards are the mandatory standards in the NIST family. The domain is smaller than the others, and the set of documents is limited, which makes it one of the most efficient areas to study.
NIST Federal Information Processing Standards (FIPS)
Because FIPS are compulsory for federal systems, questions often test applicability and consequence.
- Know which FIPS covers security categorization and how impact levels (low, moderate, high) are derived and used.
- Know which FIPS establishes minimum security requirements and how it ties to baseline selection.
- Understand the standards covering cryptographic module validation and related cryptographic requirements.
- Be able to explain the difference between a FIPS (mandatory) and an SP (guidance).
The categorization-to-baseline chain is the single most reusable concept here: system impact drives baseline selection, which drives the starting control set a Designer works from. Understanding that chain end to end will help on FIPS questions, RMF questions, and control-family questions alike.
Domain 6: NIST Interagency Reports (6%)
NISTIRs are research and technical reports, and this is the lightest domain on the exam. Its small weight makes it tempting to skip, but a handful of scored items are still available, and the material is usually approachable.
NIST Interagency Reports (NISTIRs)
Study for recognition: what each report addresses and why a Designer would consult it.
- Learn the subject area of each in-scope report so you can match a scenario to the right one.
- Understand how these reports relate to Special Publications, which are more prescriptive.
- Prioritize this domain last, but still review it before exam day.
Key Takeaway
A 6% domain is worth roughly the same number of scored items as a few good practice sessions. Treat it as a low-effort, high-return final pass rather than a skip, especially if you are near the edge of your readiness.
Sequencing Your Study by Domain
You do not need a generic study method; you need an order that respects how the domains depend on each other. Here is one sequence that follows the dependency chain, from foundations to application.
Standards and Process Foundation
- Start with NIST FIPS (Domain 2) and the categorization-to-baseline chain.
- Move into the Risk Management Framework (Domain 5) and learn the step sequence and artifacts.
Guidance and Controls
- Work through the Special Publications (Domain 1), tying each to an RMF step.
- Begin the control families (Domain 3), a few families per session.
Policy and Integration
- Cover Governmental Laws and Regulations (Domain 4) and link each to the standards that implement it.
- Finish control families and add a short NISTIR review (Domain 6).
Timed Practice
- Take full-length timed sets under exam conditions and review weak domains first.
This ordering is a suggestion, not a requirement. If you work with the Risk Management Framework daily, you may compress the early weeks and spend more time on the laws domain. The cheat sheet is a good late-stage tool for consolidating key facts, and practice questions on the main site let you check which domains still need work.
Exam Format and Registration Mechanics
Knowing the domains is half the battle; knowing the exam logistics keeps surprises off test day.
- Format: 150 multiple-choice items, including 120 scored and 30 beta items, in 3 hours. The exam is English only and closed book; personal calculators are prohibited.
- Fees: The initial exam is USD 395. A discounted same-role retest costs USD 197.50, available after at least 21 calendar days and within one year of the initial exam. For the full cost picture, see the certification cost breakdown.
- Administration: FITSI administers and proctors the computer-based exam; FITSI membership is optional.
- Remote testing: You need a personal computer plus a separate phone or tablet for monitoring. Two signed IDs are required, including one photo ID, and you should connect or arrive 30 minutes early. Breaks do not extend the timer.
- Availability: The handbook describes both in-person and remote delivery, but the registration page still labels in-person testing as unavailable, so confirm which session types are actually offered before you plan.
For scheduling details and deadlines, see the exam dates guide.
What Happens After You Pass
Passing the exam is one of several requirements for the credential. Certification requires five years of information-security experience, an application, a current resume or CV, two professional endorsements, and agreement to the Code of Ethics. You must submit the application within five years of passing the exam.
Education and other certifications can reduce the experience requirement: an accredited bachelor's degree can waive one year, an IT or information-assurance master's a second, and an issuer-listed security certification one more, up to three years total. The full eligibility picture is in the requirements guide.
Once certified, the credential is valid for three years. To maintain it you recertify with 60 CPE credits per certification over that cycle or retest at its end, observe the Code of Ethics, and pay the USD 75 annual maintenance fee. The three-year cycle reflects the May 3, 2024 announcement, effective June 1, 2024, which superseded the six-year cycle described in FITSI's earlier NG FAQ. If you are weighing the investment, the ROI analysis and the jobs overview cover who hires for this credential.
Frequently Asked Questions
There are six official weighted domains: NIST Special Publications (20%), NIST FIPS (13%), NIST Control Families (22%), Governmental Laws and Regulations (19%), NIST Risk Management Framework (20%), and NIST Interagency Reports (6%). These are separate from FITSI's 18 cross-cutting security topic areas.
NIST Control Families is the largest at 22%. However, the Special Publications and Risk Management Framework domains are each 20%, so the weighting is fairly even and no domain should be neglected.
Not necessarily. The weights in this guide come from the FITSI Candidate Handbook and took effect June 1, 2024. Older reference guides and courseware may show different lists, and the current handbook takes precedence when they conflict.
The exam has 150 multiple-choice items in 3 hours. Of those, 120 are scored and 30 are unscored beta items. The exam is closed book and offered in English only.
It is the smallest domain at 6%, so it is the best candidate for lighter review, but skipping it entirely gives up scored items. A short final-pass review is usually a better use of time than ignoring it.
For a broader overview of how the pieces fit together, read our guide to FITSP-Designer certification, and use the practice tests to see how your readiness stacks up across all six domains.