- What "Passing Score" Means for FITSP-Designer
- The Numeric Threshold Question
- How the Cut Score Is Set: The Angoff Study
- 120 Scored Items, 30 Beta Items
- Where Your Points Come From: The Six Domains
- Setting a Practical Readiness Target
- Exam-Day Mechanics That Protect Your Score
- If You Miss the Cut: Retest Rules and Costs
- Passing the Exam Is Not the Same as Being Certified
- A Domain-Weighted Study Sequence
- Frequently Asked Questions
- FITSP-Designer uses a Designer-specific cut score from an Angoff study; the handbook does not publish a numeric threshold.
- The exam has 150 multiple-choice items in 3 hours, but only 120 are scored; 30 are unscored beta items.
- NIST Control Families carries the most weight at 22%, followed by NIST SPs and RMF at 20% each.
- A failed attempt allows one discounted USD 197.50 retest after 21 days, within one year of the first exam.
What "Passing Score" Means for FITSP-Designer
Candidates searching for the FITSP-Designer passing score usually want one thing: a number to aim for. That is a reasonable request, and it is also where this credential differs from many others. The Federal IT Security Institute (FITSI) administers the FITSP-Designer exam, and the way it decides who passes is documented in its scheme materials, but a single published percentage is not part of what the retrieved handbook states.
This article explains what is actually known about how passing works for the Designer role, what that means for how you should prepare, and how to build a practical readiness target without guessing at a figure that FITSI has not published. If you are still orienting yourself to the credential, start with What Is FITSP-Designer? and then return here.
The Numeric Threshold Question
The FITSI FITSP Certification Scheme Details Handbook (v1.6, effective June 1, 2024, p. 17) describes the exam composition and the passing method. It states that passing uses a Designer-specific cut score. It does not publish a numeric threshold in the version retrieved for this article.
That has a few practical consequences:
- Ignore forum numbers. Any specific percentage you see quoted online for FITSP-Designer is either unverified or borrowed from a different credential that happens to share an acronym. Do not anchor your preparation to it.
- The cut score is role-specific. FITSI offers multiple FITSP roles, and the Designer cut score is established for the Designer exam, not copied from another role.
- Score reporting may not give you the margin. Because the threshold is not published, you should plan around mastery of the content rather than around squeaking past a known line.
How the Cut Score Is Set: The Angoff Study
FITSI's scheme documentation says the cut score is established through an Angoff study and approved by the Scheme Committee. Understanding what that implies will change how you think about the exam.
In an Angoff-style standard-setting process, subject-matter experts review exam items and judge how a minimally competent candidate would perform on each one. Those judgments are aggregated into a recommended passing standard. The key idea is that the bar reflects competence for the role, not a curve against other test takers.
What this means for you
- You are not competing against other candidates. The standard is set against defined competence, so your result does not depend on how well anyone else sat the exam that week.
- The bar is tied to Designer tasks. The official role objectives are laid out in the FITSP-Designer Certification Competence Breakdown (v3.0), which is the best window into what a "minimally competent" Designer is expected to know.
- Difficulty can vary between forms. A criterion-referenced approach is designed to keep the standard consistent even if individual items differ in difficulty, which is another reason a fixed number would be a poor target.
For a broader view of how demanding the material is, see How Hard Is the FITSP-Designer Exam?, and for what the available data does and does not show about outcomes, read the FITSP-Designer pass rate analysis.
120 Scored Items, 30 Beta Items
The exam contains 150 multiple-choice items delivered in 3 hours. Of those, 120 are scored and 30 are beta items. Beta items are unscored questions FITSI uses to evaluate new content for future exam forms.
This structure matters for your strategy:
- You cannot tell which items are beta. They are mixed in with scored questions and are not labeled. Treat every question as if it counts.
- Do not spiral over an odd question. If one item seems unfamiliar or oddly worded, it may be a beta item. Make your best choice and move on rather than burning time you need elsewhere.
- Pacing math is straightforward. With 150 items in 180 minutes, you have roughly 72 seconds per item on average. Because breaks do not extend the timer, any time spent away from the screen comes out of your total.
| Exam Feature | FITSP-Designer Detail |
|---|---|
| Total items | 150 multiple-choice |
| Scored items | 120 |
| Beta (unscored) items | 30 |
| Time allowed | 3 hours |
| Language | English only |
| Open/closed book | Closed book; personal calculators prohibited |
| Passing method | Designer-specific cut score via Angoff study |
| Published numeric threshold | Not published in the retrieved handbook |
Where Your Points Come From: The Six Domains
Because the passing standard is not a published percentage, the most reliable way to protect your result is to understand where the scored items concentrate. The current weights, effective June 1, 2024, are drawn from the FITSI Certification Candidate Handbook (v3.7). Note that these six exam domains are distinct from FITSI's 18 cross-cutting security topic areas; do not confuse the two lists when you study.
| Domain | Weight |
|---|---|
| Domain 3: NIST Control Families (CFs) | 22% |
| Domain 1: NIST Special Publications (SPs) | 20% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 4: Governmental Laws and Regulations | 19% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% |
Domain 3: NIST Control Families (22%)
The heaviest domain. Expect questions that test whether you can recognize what a control family is for and how families relate to design decisions.
- Know the purpose and scope of each family rather than memorizing control identifiers in isolation
- Practice distinguishing similar-sounding families under time pressure
- Connect families to the design activities a Designer performs
Domains 1 and 5: NIST SPs and the RMF (20% each)
Together these two domains account for 40% of the exam. They overlap in practice, since the RMF is implemented through SP guidance.
- Be fluent in the RMF steps and what each produces
- Know which NIST Special Publications support which activity
- Understand roles and responsibilities across the authorization lifecycle
Domain 4: Governmental Laws and Regulations (19%)
Often underestimated by technical candidates. This domain rewards knowing what federal statutes and policies require and why they exist.
- Match each law or regulation to its purpose and the problem it addresses
- Understand how legal requirements drive the NIST guidance used in design
Domains 2 and 6: FIPS (13%) and NISTIRs (6%)
Smaller, but not skippable. With only 120 scored items, even the 6% domain represents a handful of questions that can matter if your result is near the cut score.
- Know what FIPS publications mandate and where they apply
- Recognize the role of NISTIRs as supporting technical reports
For a deeper walkthrough of every area, see the complete guide to all six FITSP-Designer exam domains.
Setting a Practical Readiness Target
Without a published threshold, how do you decide you are ready? The goal is to replace "what score do I need?" with "can I demonstrate consistent competence in every domain?"
Use domain-level benchmarks, not one overall number
A single overall practice score can hide a dangerous weakness. A candidate who excels at Control Families but neglects Governmental Laws and Regulations might post a respectable aggregate while being exposed on 19% of the exam. Track your performance domain by domain and refuse to treat any heavily weighted domain as "good enough" if it is noticeably behind the others.
Build a margin
Because you cannot see the line, build distance from it. If your practice results in a given domain are borderline, assume you are at risk. Aim for scores that are clearly strong across all six areas, and leave extra margin in the three largest domains: Control Families, NIST SPs and the RMF.
You can pressure-test your readiness with timed sets on the FITSP-Designer practice test site, which lets you simulate the closed-book, time-limited experience. For a structured approach to what to review, the FITSP-Designer study guide breaks the material into manageable pieces.
Exam-Day Mechanics That Protect Your Score
Candidates sometimes lose points, or entire attempts, to logistics rather than knowledge. A few FITSP-Designer rules deserve attention because they can quietly erode your performance.
- Closed book, no personal calculators. Do not plan on bringing reference material or your own calculator.
- Two signed IDs, including one photo ID. Verify your identification well before test day so there are no surprises at check-in.
- Arrive or connect 30 minutes early. Late arrival eats into your composure and may cause problems with your session.
- Remote testing setup. Remote delivery uses a personal computer plus a separate monitoring phone or tablet. Test both devices ahead of time.
- Breaks do not stop the clock. Plan to use your three hours efficiently and minimize time away from the screen.
One more caveat: the handbook describes both in-person and remote delivery, but FITSI's registration page still labels in-person testing as unavailable. Check actual session availability on the exam dates and scheduling guide and with FITSI directly before you commit to a plan.
If You Miss the Cut: Retest Rules and Costs
Knowing the retest policy removes some of the pressure of a first attempt, which can itself help your performance.
- Initial exam: USD 395.
- Discounted retest: USD 197.50 for one same-role retest.
- Timing window: at least 21 calendar days after the initial exam, and within one year of it.
The 21-day minimum is useful planning information. If you do not pass, you have a defined gap in which to review. Because the threshold is unpublished, use that time to diagnose weaker domains rather than assuming you were "just a few questions short" without evidence. For the full financial picture, including maintenance fees, see the FITSP-Designer certification cost breakdown.
| Attempt | Fee | Condition |
|---|---|---|
| Initial exam | USD 395 | Standard registration |
| Same-role retest | USD 197.50 | At least 21 calendar days after, and within one year of, the initial exam |
Passing the Exam Is Not the Same as Being Certified
A common misunderstanding is that clearing the cut score finishes the process. For FITSP-Designer, the exam is one requirement among several.
Certification requires five years of information-security experience, an application, a current resume or CV, two professional endorsements, and agreement to the Code of Ethics. You must submit the application within five years of passing the exam. Certain credentials can reduce the experience requirement:
- An accredited bachelor's degree can waive one year.
- An IT or information-assurance master's can waive a second year.
- An issuer-listed security certification can waive one more year.
- Waivers total at most three years.
The details of who qualifies are covered in the FITSP-Designer requirements guide. Once certified, the credential is valid for three years. You maintain it with 60 CPE credits per certification over that cycle or by retesting at its end, while observing the Code of Ethics and paying the USD 75 annual maintenance fee. Note that an older six-year cycle described in FITSI's March 3, 2020 NG FAQ was superseded by the May 3, 2024 announcement, effective June 1, 2024, so rely on the current 2025 Holder Handbook.
Key Takeaway
Treat the exam as the first checkpoint, not the finish line. If you are early in your career, confirm you can satisfy the experience and endorsement requirements before investing heavily, and use the five-year window after passing wisely.
A Domain-Weighted Study Sequence
Since you cannot study toward a published number, allocate effort in proportion to domain weight and conceptual dependency. This sequence is one way to do that over six weeks.
Foundation: NIST SPs and FIPS
- Build a map of the key Special Publications and what each is used for
- Cover FIPS requirements, since later domains reference them
NIST Risk Management Framework
- Learn each RMF step and its outputs
- Link RMF activities back to the SPs from Week 1
NIST Control Families (heaviest domain)
- Spend two weeks here because it carries 22% of the exam
- Drill families until you can distinguish them quickly
Governmental Laws and Regulations plus NISTIRs
- Tie each law to its purpose and the guidance it drives
- Cover NISTIRs as the smallest domain
Timed, full-length simulation
- Take full 150-question practice sessions in 3 hours
- Review misses by domain and patch the weakest area
Reference material matters here. FITSI's Federal Body of Knowledge Guide (v2.2) is a useful inventory, but current handbook weights take precedence over older reference and courseware lists, so always check a resource against the June 1, 2024 weights. For a one-page recap before exam day, the FITSP-Designer cheat sheet is a handy final review.
Frequently Asked Questions
FITSI uses a Designer-specific cut score established through an Angoff study and approved by the Scheme Committee. A numeric threshold is not published in the retrieved handbook, so you should prepare for broad competence across all six domains rather than target a specific percentage.
The exam has 150 multiple-choice items in 3 hours. Only 120 are scored; the other 30 are unscored beta items. Beta questions are not identified, so answer every item as though it counts.
Yes. FITSI offers one discounted same-role retest at USD 197.50, available at least 21 calendar days after the initial exam and within one year of it. The initial exam costs USD 395.
NIST Control Families is the largest at 22%, followed by NIST SPs and the NIST Risk Management Framework at 20% each. Governmental Laws and Regulations is 19%, FIPS is 13%, and NISTIRs is 6%. No domain should be ignored.
Not by itself. Certification also requires five years of information-security experience (with up to three years of waivers), an application, a current resume, two professional endorsements and agreement to the Code of Ethics. Submit the application within five years of passing.