- What the FITSP-Designer Exam Actually Tests
- Exam Format, Fees, and Session Rules
- Where the Points Live: Domain Weights
- Domain 3: NIST Control Families (22%)
- Domains 1 and 5: Special Publications and the RMF
- Laws, FIPS, and NISTIRs
- Sequencing Your Study Calendar
- Eligibility, Application, and Maintenance
- Test-Day Execution
- Frequently Asked Questions
- The exam has 150 multiple-choice items in 3 hours; 120 are scored and 30 are unscored beta items.
- NIST Control Families is the heaviest domain at 22%, followed by NIST SPs and the RMF at 20% each.
- The initial exam costs USD 395; one same-role retest costs USD 197.50 after at least 21 days.
- The test is closed book with no personal calculators, so you must recall NIST material from memory.
What the FITSP-Designer Exam Actually Tests
FITSP-Designer is the Designer role credential from the Federal IT Security Institute (FITSI). If you are new to the credential family, What Is FITSP-Designer? and What Does FITSP-Designer Stand For? cover the naming, but the essential point for a study plan is this: the exam is not a general cybersecurity test. It is a federal-flavored, document-centric exam. It rewards candidates who know what the NIST publications, FIPS standards, federal laws, and Risk Management Framework steps actually say, and who can apply them to the design of secure federal information systems.
That makes it different from vendor-neutral exams that lean on broad concepts. A candidate with ten years of commercial security experience can still stumble if they have never had to distinguish what a Special Publication prescribes from what a FIPS mandates. The Designer role emphasizes architecture and design decisions: selecting and tailoring controls, understanding how categorization drives baselines, and knowing which statutes and standards constrain a system's design.
Exam Format, Fees, and Session Rules
Know the logistics before you study, because they shape how you practice.
| Item | FITSP-Designer Detail |
|---|---|
| Administrator | FITSI administers and proctors the computer-based exam; membership is optional |
| Length | 150 multiple-choice items in 3 hours |
| Scored items | 120 scored; 30 unscored beta items |
| Language | English only |
| Resources | Closed book; personal calculators prohibited |
| Initial fee | USD 395 |
| Retest fee | USD 197.50 (one discounted same-role retest, at least 21 calendar days after and within one year of the initial exam) |
| Remote setup | Personal computer plus a separate monitoring phone or tablet |
| Identification | Two signed IDs, including one photo ID |
| Arrival | Connect or arrive 30 minutes early |
Three details deserve emphasis. First, the beta items are indistinguishable from scored ones, so you cannot skip anything that feels strange; treat every question as if it counts. Second, breaks do not stop the clock, so a three-hour window means roughly 72 seconds per question on average. Third, the handbook describes both in-person and remote delivery, but the registration page has labeled in-person testing unavailable, so confirm what sessions are actually offered before you plan your date. For scheduling specifics, see FITSP-Designer Exam Dates, and for a full fee picture including maintenance, see FITSP-Designer Certification Cost.
A note on the passing score
FITSI uses a Designer-specific cut score set through an Angoff study and approved by its Scheme Committee. The retrieved handbook does not publish a numeric threshold, so be skeptical of any site that quotes an exact percentage. The practical implication: aim for comfortable mastery across all six domains rather than targeting a number. The details are discussed in FITSP-Designer Passing Score.
Where the Points Live: Domain Weights
FITSI's six official weighted domains are distinct from its 18 cross-cutting security topic areas. Candidates sometimes confuse the two lists; the weights below are what drive the exam blueprint (effective June 1, 2024, per the Candidate Handbook).
| Domain | Weight | Character of the material |
|---|---|---|
| NIST Control Families (CFs) | 22% | Breadth and precision across control families |
| NIST Special Publications (SPs) | 20% | Which SP addresses which task |
| NIST Risk Management Framework (RMF) | 20% | Process steps, roles, artifacts |
| Governmental Laws and Regulations | 19% | Statutes, directives, purpose and scope |
| NIST Federal Information Processing Standards (FIPS) | 13% | Mandatory standards and what each defines |
| NIST Interagency Reports (NISTIRs) | 6% | Narrower, lower-frequency topics |
The top four domains account for 81% of the blueprint. That is where most of your hours should go, but do not neglect the smaller two: with 120 scored items, even a 6% domain contributes a meaningful handful of questions, and FIPS at 13% is dense with facts that are easy to memorize and easy to confuse. A full walkthrough lives in FITSP-Designer Exam Domains: Complete Guide to All 6 Content Areas.
Domain 3: NIST Control Families (22%)
This is the single largest domain, and it is the one where memorization pays off most directly because the exam is closed book. You need to be able to recognize each control family by its role, understand what kinds of controls live in it, and reason about how families interact in a system design.
NIST Control Families
Expect scenario-style questions that describe a design need and ask which family or control type addresses it.
- Know the full roster of families and be able to describe each family's purpose in a sentence.
- Distinguish technical, operational, and management-oriented controls, and know which families lean which way.
- Understand how baselines are selected from impact levels and then tailored, since designers make these choices.
- Practice telling apart similar-sounding families, such as access control versus identification and authentication, or contingency planning versus incident response.
- Be comfortable with the idea of common, hybrid, and system-specific control provision.
A useful drill: take a realistic system description (for example, a web application handling moderate-impact data in a cloud environment) and list which families would contribute controls to each design layer. If you cannot justify each family in a sentence, you have found a gap. For a compact reference of this kind of material, the FITSP-Designer Cheat Sheet is a good companion.
Domains 1 and 5: Special Publications and the RMF
NIST Special Publications and the Risk Management Framework together make up 40% of the exam, and they reinforce each other. The RMF is a process; the SPs are the documents that tell you how to execute its steps. Studying them together is far more efficient than studying them separately.
NIST Special Publications (20%)
The challenge here is breadth. You are not expected to recite entire publications, but you are expected to know which publication answers which question: which one governs security control catalogs, which one guides assessment, which one covers categorization, which one addresses contingency planning, and so on. Build a one-line index card for each major SP: its number, its title, its purpose, and the RMF step or control area it supports.
NIST Risk Management Framework (20%)
RMF Process Mastery
Candidates must be able to walk a system through the lifecycle and name what happens, who does it, and what artifact results.
- Memorize the sequence of steps and the purpose of each.
- Know the key roles: authorizing official, system owner, security control assessor, information system security officer, and others.
- Know the principal artifacts: system security plan, security assessment report, plan of action and milestones, and authorization decision documents.
- Understand how categorization feeds baseline selection and how monitoring feeds reauthorization decisions.
- Connect each step to the SP that supports it.
Key Takeaway
Study the RMF as a story, not a list. If you can narrate a system from categorization through continuous monitoring, naming the roles and documents at each point, you will answer most process questions correctly and many SP questions as a side effect.
Laws, FIPS, and NISTIRs
Governmental Laws and Regulations (19%)
This domain trips up technically strong candidates because it is closer to civics than to engineering. Focus on the purpose, scope, and practical effect of each major federal law, directive, and policy in the FITSI body of knowledge. A reliable method is a three-column sheet: the statute or directive, what problem it was created to solve, and what it requires of agencies or systems. Questions tend to test whether you can match a requirement or scenario to the right authority.
NIST FIPS (13%)
FIPS are compact and mandatory for federal systems, which makes them high-yield for study time spent. Know each relevant FIPS by number and title, what it standardizes (categorization, minimum security requirements, cryptographic module validation, personal identity verification, and similar), and how it connects to the SPs that implement it. FIPS 199 and FIPS 200 in particular sit at the foundation of the categorization and baseline logic you need for the control-family and RMF domains, so learning them early pays double.
NIST Interagency Reports (6%)
NISTIRs are the smallest domain. Do not skip them, but do not over-invest either. Skim the ones listed in the current handbook outline, capture each report's subject in a sentence, and revisit them in your final review week. If your time is tight, this is the domain where partial coverage is the most defensible trade-off.
Sequencing Your Study Calendar
Generic schedules fail because they ignore dependencies between domains. For this exam, order matters: foundational standards first, process second, control detail third, and legal context woven throughout. The example below assumes about six weeks; stretch or compress it based on your background, and see How Hard Is the FITSP-Designer Exam? to gauge where you stand.
FIPS and categorization foundations
- Learn the core FIPS and what each standardizes.
- Practice categorizing sample systems by impact level.
RMF and the Special Publications that support it
- Walk the RMF steps with roles and artifacts.
- Build your SP index cards and map each to an RMF step.
Control families and design reasoning
- Cover every family; write a one-sentence purpose for each.
- Drill baseline selection and tailoring scenarios.
Laws, NISTIRs, and full-length practice
- Complete the law-to-purpose sheet and skim the NISTIRs.
- Take timed 150-question practice runs and review every miss by domain.
Because the exam is closed book, build active recall into every week: close the document and write the index card from memory, then check it. Timed full-length practice in the final week matters for pacing; you can find realistic question sets on the FITSP-Designer practice test site.
Eligibility, Application, and Maintenance
Passing the exam is one part of earning the credential. FITSI requires five years of information-security experience, an application, a current resume or CV, two professional endorsements, and agreement to the Code of Ethics. You must submit the application within five years of passing the exam. Education and other credentials can waive experience: an accredited bachelor's degree can waive one year, an IT or information-assurance master's a second, and an issuer-listed security certification one more, for up to three years total. Read FITSP-Designer Requirements for the full eligibility walk-through.
Once certified, the credential is valid for three years. You can recertify with 60 CPE credits per certification over that cycle or retest at the end, while observing the Code of Ethics and paying the USD 75 annual maintenance fee. Note that the three-year cycle reflects FITSI's May 3, 2024 announcement, effective June 1, 2024; an older six-year cycle described in a 2020 FAQ was superseded, so ignore forum posts that still cite it.
If you are weighing the investment, the economics are covered in Is the FITSP-Designer Certification Worth It? and the career side in FITSP-Designer Jobs. In general, the credential is aimed at professionals working on or supporting federal systems, including agency staff and contractors who design, document, and defend them.
Test-Day Execution
With 150 items and no pause in the timer, execution discipline counts. A few practices fit this exam well:
- Do a first pass at steady speed. Answer what you know, flag what you do not, and avoid spending several minutes on one item.
- Watch for absolute language. Federal standards often distinguish "shall" from "should"; questions may hinge on whether something is required or recommended.
- Anchor on the document. When two answers seem plausible, ask which NIST publication or law would actually address the scenario, and choose the one that matches.
- Do not hunt for beta items. You cannot tell which 30 are unscored, so give every question full effort.
- Prepare the environment early. For remote delivery, set up the computer and the separate monitoring device in advance, have two signed IDs ready, and connect 30 minutes early.
If your first attempt does not go well, the discounted retest of USD 197.50 is available after 21 calendar days and within one year of the initial exam. Use your score feedback to target weak domains rather than restarting from scratch. For context on outcomes, see FITSP-Designer Pass Rate, which explains what can and cannot be said responsibly about pass data.
Frequently Asked Questions
The exam has 150 multiple-choice questions to be completed in 3 hours. Of these, 120 are scored and 30 are unscored beta items, and you cannot tell which are which.
NIST Control Families carries the most weight at 22%, but it is easiest to learn after you understand FIPS categorization and the RMF. Start with FIPS, move to the RMF and Special Publications, then tackle control families in depth.
No. The exam is closed book and personal calculators are prohibited, so you need to recall publication numbers, control family purposes, and RMF steps from memory.
You can take one discounted same-role retest for USD 197.50. It must occur at least 21 calendar days after the initial exam and within one year of it.
Certification requires five years of information-security experience, which can be reduced by up to three years through a qualifying degree and an issuer-listed certification. You must submit your application within five years of passing the exam. Check the current requirements and registration page for exact sequencing.
It is valid for three years. You maintain it with 60 CPE credits over the cycle or by retesting, plus adherence to the Code of Ethics and the USD 75 annual maintenance fee.
For a broader orientation before you commit to a plan, revisit the FITSP-Designer certification overview, and when you are ready to test your recall under timed conditions, head to the practice exam and review every miss against the six domains above.