- The Pass Rate Reality: What Is and Isn't Published
- Why a Single Percentage Would Mislead You
- How the Cut Score Is Set
- Who Sits for This Exam
- Exam Format and What It Means for Your Odds
- Where Candidates Lose Points: Domain by Domain
- Retest Economics and Policy
- Test-Day Factors That Affect Outcomes
- A Domain-Weighted Preparation Plan
- After the Exam: Certification Is Not Automatic
- Frequently Asked Questions
- FITSI's retrieved handbooks do not publish a numeric pass rate or a numeric passing threshold for FITSP-Designer.
- The Designer cut score comes from an Angoff study approved by the Scheme Committee, not from a fixed curve.
- The exam has 150 items (120 scored, 30 beta) in 3 hours, closed book, English only.
- NIST Control Families (22%) and NIST SPs (20%) alone make up 42% of the exam.
The Pass Rate Reality: What Is and Isn't Published
Anyone searching for the FITSP-Designer pass rate wants one clean number. Here is the honest answer: the Federal IT Security Institute (FITSI) does not publish a pass-rate percentage for the Federal IT Security Professional - Designer exam in the handbooks and fee documents reviewed for this article (sources checked October 7, 2026). The same is true of the numeric passing threshold: the Scheme Details Handbook explains how the Designer cut score is established but does not print the score itself.
That leaves a lot of third-party "pass rate" claims floating around the internet with no traceable source. This site's policy is simple: if a figure cannot be traced to FITSI documentation, we do not repeat it. What the data does support is a detailed, qualitative picture of how hard the exam is, who attempts it, and which structural features drive outcomes. That picture is more useful for planning than a made-up percentage anyway.
For a broader view of difficulty without invented statistics, see our companion guide, How Hard Is the FITSP-Designer Exam? Complete Difficulty Guide 2026.
Why a Single Percentage Would Mislead You
Even if FITSI did release an aggregate pass rate, it would be a weak planning tool for this credential, for structural reasons specific to how FITSP-Designer works.
Self-selecting, experienced candidates
Certification requires five years of information-security experience, an application, a current resume or CV, two professional endorsements and agreement to the Code of Ethics. Candidates arrive with substantial federal-security backgrounds, so an aggregate rate would describe a pre-filtered population, not the general IT workforce. Your own odds depend on how well your experience maps to the exam's NIST-centric content, not on a population average.
Role-specific cut score
The passing standard is a Designer-specific cut score. A combined rate across FITSP roles, or a figure from a different credential entirely, would not reflect the standard you will actually face.
Beta items change the arithmetic
Of the 150 items, 30 are unscored beta items. You will not know which ones they are, so you must treat every question seriously, but your result is computed from 120 scored items only. Any "percent correct out of 150" estimate you hear is therefore not how your result is calculated.
How the Cut Score Is Set
FITSI describes its passing method in the FITSP Certification Scheme Details Handbook (v1.6, effective June 1, 2024). The key points:
- The cut score is Designer-specific, not shared across all FITSP roles.
- It is established through an Angoff study, a standard-setting method in which subject-matter experts judge how a minimally competent candidate would perform on each item.
- The resulting threshold is approved by the Scheme Committee.
- The retrieved handbook does not publish a numeric threshold.
Why does this matter for you? An Angoff-based standard is criterion-referenced. You are measured against a competence standard, not against other test-takers. You are not competing for a fixed share of passes, and a strong cohort does not make the exam harder for you. The practical consequence is that your preparation target is "minimally competent Designer across all six domains," not "beat the average." For more on this topic, read our dedicated explainer, FITSP-Designer Passing Score 2026: Exactly What You Need to Pass.
Who Sits for This Exam
FITSP-Designer targets professionals who design security into federal information systems. That is why the content leans on NIST publications and federal law instead of vendor products. Typical candidates include:
- Federal employees and military personnel working in information assurance or system security engineering
- Contractors supporting federal agencies, who often need credentialing to satisfy staffing requirements
- Security architects and engineers moving into federal programs from commercial environments
- ISSEs, ISSOs and risk-management staff who want formal recognition of their design-oriented skills
If you are weighing the career side, our guides on FITSP-Designer jobs and the FITSP-Designer salary guide cover the market in more detail. The relevant point here is that the candidate pool is experienced and domain-focused, which supports treating the exam as a serious professional assessment rather than an entry-level screen.
Exam Format and What It Means for Your Odds
| Feature | FITSP-Designer Detail | Why It Affects Outcomes |
|---|---|---|
| Administrator | FITSI administers and proctors the computer-based exam | Consistent proctoring rules; FITSI membership is optional |
| Items | 150 multiple-choice (120 scored, 30 beta) | Beta items are indistinguishable, so full effort throughout |
| Time | 3 hours | Averages roughly 72 seconds per item, so pacing matters |
| Reference materials | Closed book; personal calculators prohibited | NIST identifiers, families and relationships must be memorized |
| Language | English only | Dense federal and legal terminology offers no translation support |
| Breaks | Do not extend the timer | Time away from the screen is time lost |
The closed-book, multiple-choice format is the single biggest driver of difficulty. Federal security content is broad and detail-heavy: control families, publication numbering, risk management steps and statutory authorities. Without references, recall precision determines whether you pick the right answer or a plausible-sounding distractor. Our FITSP-Designer cheat sheet condenses the must-know facts for last-pass review.
Where Candidates Lose Points: Domain by Domain
FITSI publishes six weighted domains (Candidate Handbook v3.7, pp. 10-11, weights effective June 1, 2024). Because FITSI gives no per-domain pass data, the analysis below is qualitative: it reflects where the weighting and breadth of each domain create risk, not measured failure statistics.
| Domain | Weight | Risk Profile |
|---|---|---|
| Domain 3: NIST Control Families (CFs) | 22% | Largest domain; breadth across many families |
| Domain 1: NIST Special Publications (SPs) | 20% | Many documents with overlapping purposes |
| Domain 5: NIST Risk Management Framework (RMF) | 20% | Process knowledge plus supporting publications |
| Domain 4: Governmental Laws and Regulations | 19% | Memorization-heavy for technical candidates |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% | Standards with mandatory status; precise details |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% | Smallest, but easy to neglect |
Domain 3: NIST Control Families (22%)
The heaviest domain rewards candidates who know the control families as a system, not a list of labels.
- Know what each family is designed to accomplish and how families relate to one another
- Practice distinguishing similar-sounding families under time pressure
- Be ready to map a design scenario to the family that governs it
Domain 4: Governmental Laws and Regulations (19%)
Engineers frequently underprepare here because the content feels non-technical. At 19%, it carries nearly as much weight as the NIST SPs domain.
- Learn the purpose and reach of each major federal statute and directive in scope
- Understand which authorities drive which NIST requirements
- Expect scenario questions asking which law or regulation applies
Domain 6: NIST Interagency Reports (6%)
A small slice, but with 120 scored items, even a thinly covered domain contributes a handful of questions. Candidates who skip it entirely hand those points away.
Note that FITSI also defines 18 cross-cutting security topic areas. These are distinct from the six weighted exam domains. Do not confuse the two when building your study plan. The weights above are what govern how your exam is composed. For a full breakdown, see FITSP-Designer Exam Domains 2026: Complete Guide to All 6 Content Areas.
Retest Economics and Policy
Because no pass rate is published, the most practical way to think about failure risk is to understand what a retake would cost you in money and time.
| Item | Detail |
|---|---|
| Initial exam fee | USD 395 |
| Discounted same-role retest | USD 197.50 |
| Retest waiting period | At least 21 calendar days after the initial exam |
| Retest window | Within one year of the initial exam to receive the discount |
| Annual maintenance fee (after certification) | USD 75 |
The discounted retest cuts the second attempt to half the initial price, which softens the financial penalty of a miss. The 21-day minimum also means a failed attempt is not a quick-fix situation: use the gap to diagnose which domains cost you points and rebuild those areas deliberately. For the full cost picture, including maintenance, see FITSP-Designer Certification Cost 2026: Complete Pricing Breakdown.
Test-Day Factors That Affect Outcomes
Some candidates lose attempts for procedural reasons rather than knowledge gaps. FITSI's requirements are specific:
- Two signed IDs are required, including one photo ID.
- Connect or arrive 30 minutes early. Do not treat this as optional.
- Remote testing requires a personal computer plus a separate monitoring phone or tablet.
- Breaks do not extend the timer, so plan to use them sparingly.
- Personal calculators are prohibited.
The handbook describes both in-person and remote delivery, but the registration page still labels in-person testing as unavailable. Check the registration page for actual session availability before building a timeline around a particular delivery method. Our article on FITSP-Designer exam dates and scheduling walks through the logistics.
A Domain-Weighted Preparation Plan
Rather than a generic schedule, here is one built around the exam's weights. It assumes you are an experienced practitioner who needs structured coverage, and it front-loads the largest domains while reserving time for the legal and standards material that technical candidates tend to skip.
NIST Control Families (22%) and SPs (20%)
- Work through the families and the publications that define and support them
- Build your own relationship map between SPs and control families
RMF (20%) and FIPS (13%)
- Learn the RMF process end to end and the publications attached to each step
- Memorize FIPS purposes and their mandatory status
Laws and Regulations (19%) and NISTIRs (6%)
- Match each statute or directive to what it requires and who it governs
- Cover the NISTIRs so no domain is left blank
Timed practice and gap repair
- Take full-length timed sessions at roughly 72 seconds per item
- Re-study whichever domain your practice results flag as weakest
Use our FITSP-Designer practice tests during weeks 5 and 6 to simulate the closed-book, time-limited experience, and to get a domain-level read on where you stand. For resource recommendations and a fuller plan, see the FITSP-Designer Study Guide 2026: How to Pass on Your First Attempt.
Key Takeaway
Because the exam is criterion-referenced and the pass rate is unpublished, your best predictor of success is domain coverage, not population statistics. Aim for competent, balanced performance across all six domains, with the strongest depth in Control Families, SPs and RMF, which together account for 62% of the exam.
After the Exam: Certification Is Not Automatic
Passing the exam is one step. FITSI certification also requires that you meet the experience and application requirements, and that you submit the application within five years of passing the exam. This catches some candidates off guard, so it is worth knowing in advance.
- Experience: five years of information-security experience.
- Waivers: an accredited bachelor's degree can waive one year, an IT or information-assurance master's a second, and an issuer-listed security certification one more, up to three years total.
- Application materials: application, current resume or CV, two professional endorsements and agreement to the Code of Ethics.
- Validity: three years. Recertify with 60 CPE credits per certification over that cycle, or retest at the end of it, while observing the Code of Ethics and paying the USD 75 annual maintenance fee.
One detail to watch: older materials, including a March 3, 2020 FAQ for the NG credentials, describe a six-year cycle. That was superseded by FITSI's May 3, 2024 announcement, effective June 1, 2024. The current cycle is three years, per the 2025 Holder Handbook. If you are researching renewal, rely on the current handbook. Full eligibility details are in FITSP-Designer Requirements 2026: Eligibility, Prerequisites & How to Qualify, and the value question is covered in Is the FITSP-Designer Certification Worth It? Complete ROI Analysis 2026.
Frequently Asked Questions
FITSI does not publish a pass-rate percentage in the handbooks and fee documents reviewed for this article. Any specific figure you see without a FITSI citation should be treated as unverified, and may belong to a different credential that shares the acronym.
The exam uses a Designer-specific cut score set through an Angoff study and approved by the Scheme Committee. The retrieved handbook does not publish the numeric threshold, so prepare for competence across all six domains rather than chasing a target percentage.
The exam has 150 multiple-choice items, of which 120 are scored and 30 are unscored beta items. You cannot tell which are which, so answer every question with full effort within the 3-hour limit.
You can take a discounted same-role retest for USD 197.50, provided at least 21 calendar days have passed and the retest falls within one year of your initial exam. The initial exam fee is USD 395.
NIST Control Families (22%), NIST SPs (20%) and the NIST RMF (20%) carry the most weight, followed by Governmental Laws and Regulations (19%), NIST FIPS (13%) and NISTIRs (6%). Do not skip the smaller domains, since they still contribute scored questions.