- What FITSP-Designer Actually Means
- Decoding Each Word in the Name
- What the Designer Role Covers
- The Six Domains Behind the Credential
- How the Exam Is Built and Delivered
- Experience, Endorsements and Eligibility
- Fees, Validity and Maintenance
- Where the Credential Gets Used
- Sequencing Your Preparation by Domain
- Avoiding Naming Confusion
- Frequently Asked Questions
- FITSP-Designer is the Designer role certification from the Federal IT Security Institute (FITSI), shorthand FITSP-D.
- The exam has 150 multiple-choice items: 120 scored, 30 beta, in 3 hours, English only.
- Six weighted domains drive the exam; NIST Control Families is largest at 22%.
- Certification requires five years of security experience, with waivers up to three years total.
What FITSP-Designer Actually Means
FITSP-Designer is a professional certification issued by the Federal IT Security Institute (FITSI). The acronym unpacks as Federal IT Security Professional - Designer. The "Designer" portion names a specific role within FITSI's role-based certification scheme, and the issuer's own shorthand for it is FITSP-D. In its current handbooks FITSI refers to the credential as FITSP-Designer-NG, with "NG" marking the next-generation version of the scheme.
If you landed here searching for a quick definition, that is the short answer: it is a federal-focused information security credential that validates the knowledge needed to design security into federal information systems. The rest of this article explains what each part of the name signals, what the exam tests, and how the credential works in practice. For other angles on the same question, see our companion pieces What Is FITSP-Designer? and What Does FITSP-Designer Stand For?.
Decoding Each Word in the Name
Federal
The first word is the most important clue. Unlike general-purpose security certifications, this credential is built around the federal environment: NIST publications, federal standards, and governmental laws and regulations. A candidate who has never worked with that body of material will find the content distinctly different from vendor-neutral commercial security exams.
IT Security Professional
"Professional" signals that this is an experience-gated credential, not an entry-level badge. You must document five years of information-security experience (with some waivers available) in addition to passing the exam. We cover the mechanics in the eligibility section below, and in more depth in FITSP-Designer Requirements 2026.
Designer
The final word identifies the role. FITSI organizes its certifications around job roles rather than a single general exam, and Designer is the role oriented toward specifying and architecting security for systems. The exam content is tailored to that role through its own cut score and its own task objectives.
What the Designer Role Covers
FITSI publishes a competence breakdown for the Designer role (the FITSP-Designer Certification Competence Breakdown, v3.0, April 30, 2023) listing the task objectives the credential is meant to validate. In plain terms, the Designer is the person who translates federal security requirements into the structure of a system: selecting and tailoring controls, aligning the design with the risk management lifecycle, and making sure the resulting architecture satisfies applicable standards and law.
That orientation explains why the exam leans so heavily on NIST material. A Designer is not expected to merely recall definitions; the questions probe whether you can apply the right publication, standard or control family to a described situation. If you want a fuller picture of the credential as a whole, read FITSP-Designer Certification and What Is A FITSP-Designer?.
The Six Domains Behind the Credential
The meaning of the credential is easiest to grasp through its content outline. FITSI's current Candidate Handbook (v3.7) defines six official weighted exam domains, with weights effective June 1, 2024. These are distinct from the 18 cross-cutting security topic areas that appear elsewhere in FITSI's materials, a distinction that trips up many candidates.
| Domain | Weight | What It Emphasizes |
|---|---|---|
| NIST Special Publications (SPs) | 20% | Guidance documents that shape federal security practice |
| NIST Federal Information Processing Standards (FIPS) | 13% | Mandatory federal standards, including categorization and cryptographic requirements |
| NIST Control Families (CFs) | 22% | The catalog of security and privacy controls, organized by family |
| Governmental Laws and Regulations | 19% | The statutory and policy framework governing federal information security |
| NIST Risk Management Framework (RMF) | 20% | The lifecycle for categorizing, selecting, implementing, assessing, authorizing and monitoring |
| NIST Interagency Reports (NISTIRs) | 6% | Supporting technical and research reports |
NIST Control Families (22%)
The heaviest domain, and the one where Designers earn their keep. You need to recognize what each family addresses and know which family a described safeguard belongs to.
- Learn families as functional groupings, not as a memorized list
- Practice mapping scenario language to the correct family
- Understand how controls are selected and tailored during design
NIST Special Publications and the Risk Management Framework (20% each)
These two domains are tightly linked, since many Special Publications support steps of the RMF. Studying them together is more efficient than treating them as separate silos.
- Know which publication supports which RMF step
- Understand roles, artifacts and outputs at each stage
- Be ready for questions that blend publication knowledge with lifecycle sequencing
Governmental Laws and Regulations (19%)
This domain rewards candidates who understand why federal requirements exist, not only what they are called. Expect questions that connect a legal or policy driver to the practical obligation it creates.
- Match each law or policy to its purpose and scope
- Understand how legal drivers flow down into NIST guidance
FIPS (13%) and NISTIRs (6%)
Smaller weights, but not throwaway topics. FIPS content is concrete and fact-heavy, which makes it a good place to secure reliable points. NISTIRs are the lightest domain, so aim for working familiarity rather than exhaustive depth.
A note on sources: FITSI also maintains a Federal Body of Knowledge Guide (v2.2, 2021) as a reference inventory. Where older reference lists or courseware disagree with the current handbook's weights, the handbook takes precedence. For a deeper domain-by-domain walk-through, see FITSP-Designer Exam Domains 2026.
How the Exam Is Built and Delivered
The exam consists of 150 multiple-choice items delivered in 3 hours, in English only. Of those items, 120 are scored and 30 are beta items, which FITSI uses to evaluate new questions. You will not be told which items are which, so treat every question as if it counts. The exam is closed book, and personal calculators are prohibited.
Delivery and identity rules
- FITSI administers and proctors the computer-based examination; FITSI membership is optional.
- Remote testing requires a personal computer plus a separate monitoring phone or tablet.
- Two signed IDs are required, including one photo ID.
- Connect or arrive 30 minutes early.
One practical caution: the handbook describes both in-person and remote delivery, but the registration page has still labeled in-person testing as unavailable. Always confirm which session types are actually open before planning your logistics. Our exam dates and scheduling guide covers how to approach this.
Experience, Endorsements and Eligibility
Passing the exam is only part of earning the designation. FITSI certification requires:
- Five years of information-security experience
- A completed application
- A current resume or CV
- Two professional endorsements
- Agreement to the Code of Ethics
You must submit the application within five years of passing the exam. The experience requirement can be reduced through waivers: an accredited bachelor's degree can waive one year, an IT or information-assurance master's can waive a second, and an issuer-listed security certification can waive one more, for a maximum of three years waived in total.
Key Takeaway
Start collecting your two professional endorsers and updating your resume before you sit for the exam. The five-year window after passing is generous, but documenting experience cleanly takes longer than most candidates expect.
Fees, Validity and Maintenance
| Item | Detail |
|---|---|
| Initial exam | USD 395 |
| Discounted same-role retest | USD 197.50, after at least 21 calendar days and within one year of the initial exam |
| Certification validity | Three years |
| Recertification | 60 CPE credits per certification over the cycle, or retest at the end |
| Annual maintenance fee | USD 75 |
The three-year validity period reflects a change: FITSI's March 3, 2020 NG FAQ described a six-year cycle, but that was superseded by the May 3, 2024 announcement, effective June 1, 2024. If you find older material citing six years, it is out of date. The 2025 Holder Handbook covers both legacy and NG credentials, and holders must also observe the Code of Ethics throughout the cycle.
For a full budget view, including how the retest discount factors in, see FITSP-Designer Certification Cost 2026.
Where the Credential Gets Used
Because the content centers on federal standards, law and the Risk Management Framework, the credential is most relevant where those frameworks are daily working material: federal agencies and the contractors that support them. Roles that involve system security architecture, control selection and tailoring, authorization packages, and compliance alignment are the natural fit. The Designer orientation suits people who shape how a system will meet requirements, rather than those who only operate or audit it afterward.
We deliberately avoid quoting salary figures here, since no verified numbers are available in the source material for this credential. If you are weighing the career case, our guides on FITSP-Designer jobs, earnings and whether the certification is worth it lay out the qualitative reasoning.
Sequencing Your Preparation by Domain
Rather than a generic study calendar, sequence your preparation around how the domains depend on one another. Here is a logical order that reflects those dependencies and the exam weights:
Frame the landscape: Laws and FIPS
- Learn the governmental laws and regulations that create federal security obligations
- Cover the FIPS standards while the concrete facts are easy to retain
Learn the lifecycle: RMF with Special Publications
- Walk through each RMF step and attach the supporting Special Publications
- Note the inputs and outputs of each step
Master the largest domain: Control Families
- Study each family's purpose and typical safeguards
- Practice classifying scenario descriptions by family
Close gaps: NISTIRs and timed practice
- Skim the NISTIRs for working familiarity
- Take timed sets to build pacing across 150 items in 3 hours
This order puts context before detail: the legal and standards backdrop first, then the process that ties everything together, then the control catalog that the process depends on. For a fuller plan, read the FITSP-Designer study guide, keep the cheat sheet handy for last-minute review, and check how hard the exam is to calibrate your timeline. When you are ready to test yourself, try the FITSP-Designer practice tests.
Avoiding Naming Confusion
Searching for this credential online can be messy because several unrelated certifications share similar-looking acronyms. Keep these markers in mind to confirm you are reading about the right one:
- The issuer is the Federal IT Security Institute (FITSI).
- The role name is Designer, with shorthand FITSP-D and handbook name FITSP-Designer-NG.
- The exam has six weighted domains built around NIST publications, FIPS, control families, federal law and the RMF.
- The exam is 150 items in 3 hours, with USD 395 initial pricing.
If a source describes a different issuer, a different exam length, or a different set of domains, it is describing something else. The same caution applies to older FITSI-related material, since the scheme changed effective June 1, 2024. For more phrasing variations of this question, see What Does FITSP-Designer Mean? and What Is FITSP-Designer Certification?, and for preparation resources see FITSP-Designer Training.
Frequently Asked Questions
It stands for Federal IT Security Professional - Designer. The credential is issued by the Federal IT Security Institute (FITSI), and its shorthand is FITSP-D. The current handbook name is FITSP-Designer-NG.
Designer is the job role the certification targets. FITSI organizes its credentials by role, and the Designer exam is tailored to the knowledge needed to build security requirements into federal information systems, using a Designer-specific cut score.
The exam has 150 multiple-choice items in 3 hours. Of those, 120 are scored and 30 are unscored beta items. It is closed book, English only, and breaks do not extend the timer.
Certification is valid for three years. You recertify by earning 60 CPE credits per certification over that cycle or by retesting at its end, observing the Code of Ethics, and paying the USD 75 annual maintenance fee.
The experience requirement applies to earning the certification, and you must submit your application within five years of passing the exam. Waivers can reduce the requirement by up to three years total through a bachelor's degree, a relevant master's degree, or an issuer-listed security certification.