- What "Qualifying" Actually Means for FITSP-Designer
- Two Tracks: Passing the Exam and Earning the Credential
- The Five-Year Experience Requirement and Waivers
- Building Your Application Package
- Exam Registration, Format and ID Rules
- The Knowledge You Must Bring: Six Weighted Domains
- A Qualification Timeline Built Around the Rules
- Keeping the Credential: Three-Year Cycle and Fees
- Who Typically Fits the Designer Profile
- Frequently Asked Questions
- FITSP-Designer is issued by the Federal IT Security Institute (FITSI); the exam is open to candidates, but certification requires five years of experience.
- An accredited bachelor's, a qualifying master's and an issuer-listed security certification can each waive one year, up to three total.
- The exam is 150 multiple-choice items in 3 hours, with 120 scored and 30 beta items; the initial fee is USD 395.
- Submit your certification application within five years of passing the exam, with two endorsements and a current resume.
What "Qualifying" Actually Means for FITSP-Designer
Most people searching for FITSP-Designer requirements want a simple yes-or-no answer: "Can I sit for this exam?" The more useful answer is that the credential has two separate gates. One is the computer-based examination. The other is the certification itself, which layers professional experience, an application, endorsements and an ethics agreement on top of the exam result.
FITSP-Designer is the Designer role within the Federal IT Security Professional scheme administered by the Federal IT Security Institute (FITSI). The issuer shorthand is FITSP-D, and the current handbook refers to the NG (next generation) version of the credential. If you are new to the scheme, the overview in What Is FITSP-Designer Certification? explains where the Designer role fits, and What Does FITSP-Designer Stand For? covers the naming.
Two Tracks: Passing the Exam and Earning the Credential
It helps to see the two requirements side by side before diving into each.
| Requirement | Exam Track | Certification Track |
|---|---|---|
| What it proves | Mastery of the six Designer exam domains | Professional experience, endorsement and ethical commitment |
| Core inputs | 150-item, 3-hour computer-based exam | Five years of information-security experience (with possible waivers) |
| Paperwork | Registration and two signed IDs | Application, current resume/CV, two professional endorsements, Code of Ethics agreement |
| Cost anchor | USD 395 initial exam; USD 197.50 discounted same-role retest | USD 75 annual maintenance fee once certified |
| Deadline logic | Retest after at least 21 days and within one year of the initial exam | Submit application within five years of passing |
FITSI administers and proctors the exam, and FITSI membership is optional, so you do not need to join anything simply to test. For a full fee walk-through, see FITSP-Designer Certification Cost 2026: Complete Pricing Breakdown.
The Five-Year Experience Requirement and Waivers
The headline eligibility rule for certification is five years of information-security experience. That figure is the baseline, and FITSI allows documented education and credentials to reduce it.
How the waivers stack
- Accredited bachelor's degree: can waive one year of experience.
- Master's degree in IT or information assurance: can waive a second year.
- Issuer-listed security certification: can waive one more year.
Together these can reduce the requirement by up to three years in total. Note the cap: even a candidate holding a bachelor's, a qualifying master's and a listed certification does not reach zero. The waivers are additive but bounded, which means a candidate with all three still needs experience on record.
What counts as experience?
The facts we can state with confidence are that the experience must be in information security and must be documented on your resume or CV and corroborated through endorsements. For the Designer role in particular, the work that makes your resume credible is architecture and design activity: selecting and specifying security controls, mapping requirements to NIST guidance, supporting authorization packages and shaping system security design in federal or federal-adjacent environments. The roles that show up in this space are covered in FITSP-Designer Jobs.
Building Your Application Package
The certification application has four required components. Prepare them in parallel with exam study rather than after, because endorsements in particular depend on other people's schedules.
- The application itself. Submitted to FITSI after you pass the exam, and within five years of that pass.
- A current resume or CV. It should show dated, role-by-role information-security experience so a reviewer can count years and see any waivers you are claiming.
- Two professional endorsements. These come from people who can speak to your professional work. Choose endorsers who have directly observed your security design or assessment responsibilities.
- Agreement to the Code of Ethics. This is a formal commitment and continues to bind you as a certification holder.
Key Takeaway
Write your resume bullets around design outcomes: control selection rationale, system categorization support, authorization documentation and standards alignment. Vague duty lists make it harder for a reviewer to match your history to the Designer role and to verify years of experience.
Exam Registration, Format and ID Rules
Eligibility to test is less restrictive than eligibility to certify, but the exam has strict logistics that trip up unprepared candidates.
Format at a glance
- 150 multiple-choice items, of which 120 are scored and 30 are beta items. You will not know which are which, so treat every question as scored.
- 3 hours total. Breaks do not extend the timer.
- English only.
- Closed book. Personal calculators are prohibited.
The passing standard is a Designer-specific cut score established through an Angoff study and approved by the Scheme Committee. A numeric threshold is not published in the handbook we reviewed, so be skeptical of any site claiming an exact percentage. The discussion in FITSP-Designer Passing Score 2026: Exactly What You Need to Pass goes deeper on what is and is not known.
Fees and retake rules
The initial exam costs USD 395. If you need a second attempt, a discounted same-role retest costs USD 197.50, available after at least 21 calendar days and within one year of the initial exam. Plan your first sitting so that you are never forced to retest quickly; the 21-day minimum is a floor, not a recommendation. For difficulty context, see How Hard Is the FITSP-Designer Exam? and the data discussion in FITSP-Designer Pass Rate 2026.
Remote testing and identification
- Remote testing uses a personal computer plus a separate monitoring phone or tablet.
- You need two signed IDs, including one photo ID.
- Connect or arrive 30 minutes early.
The Knowledge You Must Bring: Six Weighted Domains
There is no prerequisite course or mandatory training to sit for the exam, but the content is demanding and specifically federal. The exam is organized into six official weighted domains. These are distinct from FITSI's 18 cross-cutting security topic areas, which describe subject matter rather than exam weighting.
| Domain | Weight |
|---|---|
| Domain 3: NIST Control Families (CFs) | 22% |
| Domain 1: NIST Special Publications (SPs) | 20% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 4: Governmental Laws and Regulations | 19% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% |
Weights reflect the schedule effective June 1, 2024, and current handbook weights take precedence over older reference lists and courseware. A full breakdown lives in FITSP-Designer Exam Domains 2026: Complete Guide to All 6 Content Areas.
Domain 3: NIST Control Families (22%)
The largest domain. Designers are expected to understand what each control family protects against and how controls relate to one another.
- Know the purpose and scope of each family, not just its name.
- Practice distinguishing controls that sound similar but serve different objectives.
- Connect control families to design decisions, such as where access control, audit and configuration management apply in an architecture.
Domain 1: NIST Special Publications (20%)
The guidance library that Designers lean on daily.
- Know which SP addresses which task: categorization, control selection, assessment, continuous monitoring.
- Understand how SPs reference one another.
Domain 5: NIST Risk Management Framework (20%)
The lifecycle that governs how federal systems are authorized.
- Know the RMF steps in order and the Designer's contribution at each.
- Understand how categorization drives control selection and tailoring.
Domain 4: Governmental Laws and Regulations (19%)
The legal backdrop that makes federal security distinctive.
- Know which law or regulation establishes which obligation.
- Recognize how statutory requirements translate into the standards and guidance Designers apply.
Domain 2: NIST FIPS (13%) and Domain 6: NIST Interagency Reports (6%)
Smaller by weight but easy to underestimate.
- FIPS are mandatory standards, so know what each one governs.
- NISTIRs are narrower, so focus on recognizing what topics they address rather than memorizing detail.
The official task objectives for the Designer role are published in FITSI's Certification Competence Breakdown, and the study approach in FITSP-Designer Study Guide 2026 maps well to them. For a compact refresher, the FITSP-Designer Cheat Sheet is useful late in preparation, and the practice tests on the main site let you check yourself against the six domains.
A Qualification Timeline Built Around the Rules
The only scheduling advice worth giving here is tied to the actual deadlines. Because the five-year application window starts at your exam pass, and because the heaviest domains are Control Families, SPs and RMF, a sequence that front-loads those three makes sense.
Audit your eligibility
- Count your information-security years and identify any waiver you can claim.
- Line up two potential endorsers.
Domain 3 and Domain 1
- Work through Control Families and the Special Publications that define them, since these are 42% of the exam combined.
Domain 5 and Domain 4
- Study the RMF lifecycle alongside the laws and regulations that require it, so the legal and procedural pieces reinforce each other.
Domains 2 and 6, then full review
- Cover FIPS and NISTIRs, then run timed practice sets to rehearse the 3-hour, closed-book format.
Submit the application
- Send your application, resume, endorsements and Code of Ethics agreement well inside the five-year window.
Keeping the Credential: Three-Year Cycle and Fees
Meeting the requirements once is not the end. Certification is valid for three years. To maintain it you can either earn 60 CPE credits per certification over that cycle or retest at its end. In both cases you must observe the Code of Ethics and pay the USD 75 annual maintenance fee.
The long-term economics are worth weighing before you commit, and Is the FITSP-Designer Certification Worth It? and the FITSP-Designer Salary Guide address that question.
Who Typically Fits the Designer Profile
The Designer role suits professionals whose work involves shaping the security of systems rather than only operating or auditing them. Typical backgrounds include security architects and engineers, system designers supporting authorization efforts, and security analysts who translate NIST guidance into system requirements. The common thread is regular contact with the NIST publication set and federal compliance obligations.
If you are earlier in your career, the five-year requirement does not necessarily block you from studying or testing; it governs when you can be certified. Many candidates take the exam while still accumulating experience, provided they submit the application inside the five-year window. For background on the role itself, see What Is A FITSP-Designer? and the broader FITSP-Designer Certification overview.
Frequently Asked Questions
The five-year requirement applies to certification, not to sitting for the exam. You can pass the exam first, but you must submit your certification application within five years of passing and demonstrate the required experience, less any waivers you qualify for.
An accredited bachelor's degree can waive one year, an IT or information-assurance master's can waive a second, and an issuer-listed security certification can waive one more. The maximum total waiver is three years.
You need a completed application, a current resume or CV, two professional endorsements and agreement to the Code of Ethics. The application must be submitted within five years of your exam pass.
The initial exam is USD 395, with a discounted same-role retest at USD 197.50 after at least 21 days and within one year. Once certified, the annual maintenance fee is USD 75, and recertification requires 60 CPE credits per certification or a retest at the end of the three-year cycle.
No. FITSI administers and proctors the computer-based exam, but membership is optional. Check the registration page for currently available delivery options, since remote and in-person availability may differ from what the handbook describes.