- The Plain-English Meaning of FITSP-Designer
- Decoding Each Word in the Credential Name
- What "Designer" Signals About the Role
- The Exam Behind the Name
- The Six Domains That Define the Credential
- What It Takes to Hold the Title
- Keeping the Credential Active
- Naming Variations You Will See in the Wild
- Who Uses the Credential
- Sequencing Your Preparation by Domain Weight
- Frequently Asked Questions
- FITSP-Designer is FITSI's Federal IT Security Professional credential for the Designer role, abbreviated FITSP-D.
- The exam has 150 multiple-choice items in 3 hours; 120 are scored and 30 are beta items.
- NIST Control Families carries the most weight at 22%, followed by NIST SPs and the RMF at 20% each.
- Certification also requires five years of experience (up to three waivable), two endorsements and Code of Ethics agreement.
The Plain-English Meaning of FITSP-Designer
FITSP-Designer is a professional certification issued by the Federal IT Security Institute (FITSI). It validates that a person can apply federal information security standards, laws and risk management practices when designing security into government information systems. The full expansion is Federal IT Security Professional - Designer, and FITSI's own shorthand for it is FITSP-D. In the current handbook the credential appears under the name FITSP-Designer-NG, where "NG" refers to the next-generation version of the scheme.
If you have landed here from a search for the acronym, one point is worth stating up front: this article is about the FITSI credential only. The letters in the name are descriptive of a federal-focused, role-based certification, and everything below, from the exam format to the renewal rules, comes from FITSI's published handbooks. If you want a broader introduction, our overview What Is FITSP-Designer? covers the credential from a high level, while this article concentrates on what the name itself tells you.
Decoding Each Word in the Credential Name
Every word in the title carries meaning, and unpacking them explains why the certification looks different from vendor-neutral security credentials.
Federal
The scope is the U.S. federal government security ecosystem. Candidates are tested on federal laws and regulations, NIST publications and the Risk Management Framework rather than on commercial product features or general industry frameworks. That federal lens is the defining trait of the whole FITSP family.
IT Security
The subject is information technology security: controls, standards, risk processes and governance for systems that handle federal information. It is a standards-driven discipline, so exam content leans heavily on what the official documents say.
Professional
"Professional" signals that this is an experience-based credential, not an entry-level knowledge check. Passing the exam is only one part of certification. Applicants must also document years of information-security experience, submit a resume, provide two professional endorsements and agree to a Code of Ethics.
Designer
The final word identifies the role. We unpack that next, because it determines how the exam content is framed.
What "Designer" Signals About the Role
FITSI organizes its certifications around roles in the federal information security lifecycle. The Designer role is oriented toward the people who shape how security is built into a system: selecting and specifying controls, applying standards during design, and aligning architecture decisions with federal requirements. FITSI's official task objectives for the role are published in the FITSP-Designer Certification Competence Breakdown, which is the best primary source for what a Designer is expected to do.
Practically, a candidate who earns this credential is saying: "I understand the federal security rulebook well enough to design systems that will stand up to it." That means being comfortable translating a regulation or NIST guideline into a design decision, and knowing which control families, publications and process steps apply to a given situation. Job titles that tend to align with this orientation include security architects, systems engineers on federal programs, and information assurance analysts who specify controls. Our page on FITSP-Designer jobs goes deeper into the hiring side.
The Exam Behind the Name
The exam is the most concrete expression of what the name means, so its mechanics are worth knowing. FITSI administers and proctors the computer-based examination, and membership in FITSI is optional for taking it.
| Exam Feature | FITSP-Designer Detail |
|---|---|
| Format | 150 multiple-choice items |
| Scored vs. beta | 120 scored items plus 30 beta items |
| Time limit | 3 hours; breaks do not extend the timer |
| Language | English only |
| Reference rules | Closed book; personal calculators prohibited |
| Initial exam fee | USD 395 |
| Discounted retest | USD 197.50, same role, after at least 21 calendar days and within one year of the initial exam |
| Identification | Two signed IDs, including one photo ID |
| Arrival | Connect or arrive 30 minutes early |
Candidates cannot tell which items are scored and which are beta, so every question deserves a full effort. The passing standard uses a Designer-specific cut score established through an Angoff study and approved by the Scheme Committee. The retrieved handbook does not publish a numeric threshold, so be skeptical of any site that quotes a precise percentage. Our article on the FITSP-Designer passing score explains what is and is not publicly known.
Remote Delivery Mechanics
Remote testing requires a personal computer plus a separate monitoring phone or tablet. The handbook describes both in-person and remote delivery, but the registration page has labeled in-person testing as unavailable, so confirm what is actually offered before you plan. Scheduling specifics are covered in FITSP-Designer exam dates, and the full fee picture is in the certification cost breakdown.
The Six Domains That Define the Credential
The clearest way to understand what "FITSP-Designer" means in practice is to look at what the exam actually measures. It has six official weighted domains. These are separate from the 18 cross-cutting security topic areas that appear in FITSI's reference materials, and the two lists should not be confused. The weights below took effect June 1, 2024.
| Domain | Weight |
|---|---|
| Domain 3: NIST Control Families (CFs) | 22% |
| Domain 1: NIST Special Publications (SPs) | 20% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 4: Governmental Laws and Regulations | 19% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% |
NIST Control Families (22%)
The heaviest domain. Candidates need to recognize the control families, understand what each family is for, and reason about which controls address a given design requirement.
- Know the purpose of each family, not just its name
- Practice matching scenarios to the controls that satisfy them
NIST Special Publications (20%)
Expect questions about what specific publications cover and when a Designer would turn to each one.
- Associate each publication with its purpose and audience
- Understand how publications relate to one another in a design workflow
NIST Risk Management Framework (20%)
The RMF is the process backbone for authorizing federal systems. Designers need to understand each step and how design decisions feed into it.
- Know the sequence of RMF steps and their outputs
- Connect RMF activities to control selection and implementation
Governmental Laws and Regulations (19%)
This domain tests the legal and policy foundation behind federal security requirements, which is what makes the credential distinctly federal.
- Learn what each law or regulation mandates and who it applies to
- Understand how statutes drive the standards that Designers apply
NIST FIPS (13%)
FIPS are mandatory standards for federal systems. Questions focus on what each standard establishes and when it applies.
NIST Interagency Reports (6%)
The smallest domain, but still worth coverage. Learn what NISTIRs are and the topics the key reports address.
For a deeper walk through each area, see our complete guide to all six FITSP-Designer exam domains. One reference caveat: FITSI's Federal Body of Knowledge Guide and older courseware lists can differ from the current handbook, and the current handbook's weights take precedence.
What It Takes to Hold the Title
Passing the exam does not automatically make you a FITSP-Designer. The credential is awarded to people who also meet FITSI's professional requirements:
- Five years of information-security experience as the baseline requirement.
- A completed application with a current resume or CV.
- Two professional endorsements.
- Agreement to the Code of Ethics.
- Timely submission: the application must be submitted within five years of passing the exam.
Experience can be reduced through waivers, up to three years in total: an accredited bachelor's degree can waive one year, an IT or information-assurance master's a second, and an issuer-listed security certification one more. The full list of conditions is in our FITSP-Designer requirements guide.
Keeping the Credential Active
Certification is valid for three years. To maintain it, holders can either earn 60 CPE credits per certification over that cycle or retest at the end, while observing the Code of Ethics and paying a USD 75 annual maintenance fee. The 2025 Holder Handbook covers both legacy and NG credentials.
A note on a common source of confusion: FITSI's March 3, 2020 NG FAQ described a six-year cycle. That was superseded by a May 3, 2024 announcement, effective June 1, 2024, which established the current three-year cycle. If you find an older page or forum post citing six years, treat it as outdated.
Naming Variations You Will See in the Wild
Because the credential has evolved, you will encounter several labels that all point to the same Designer certification:
- FITSP-Designer - the standard name used in this article and on most job postings.
- FITSP-D - FITSI's own issuer shorthand.
- FITSP-Designer-NG - the current handbook name reflecting the next-generation scheme.
- Legacy FITSP-Designer - the earlier version still referenced in the Holder Handbook.
If you want this same topic from other angles, we also have pages on the FITSP-Designer meaning, what a FITSP-Designer is as a professional, and what the certification entails.
Who Uses the Credential
Given its federal scope, the credential is most relevant to people working on or alongside U.S. federal information systems: government employees, and contractors who support agency programs and must demonstrate fluency in NIST-based requirements. Roles that design, specify or review security architecture for such systems are the natural fit. Because hiring and pay vary by employer, clearance, location and contract, treat any single salary number with caution. Our salary guide and ROI analysis discuss the value question qualitatively and in context.
Sequencing Your Preparation by Domain Weight
This is the one place we will talk about study planning, and only in terms of what the FITSP-Designer domains imply. Because the exam is closed book and tests recall of specific documents, it pays to build your foundation in the order that dependencies and weights suggest.
Laws and Regulations First
- Governmental Laws and Regulations (19%) explains why the standards exist
- Build a one-line summary per law: purpose, scope, who it covers
FIPS and Special Publications
- FIPS (13%) and SPs (20%) are the documents the laws point to
- Map each publication to its purpose and when a Designer would use it
Risk Management Framework
- RMF (20%) ties the documents into a process
- Trace how design choices feed each step
Control Families, the Largest Domain
- NIST Control Families (22%) rewards everything learned earlier
- Add NISTIRs (6%) as a lighter final pass
Finish with timed practice, since 150 questions in 3 hours with no extra time for breaks is a pacing exercise as much as a knowledge test. Our full study guide expands this approach, the difficulty guide sets realistic expectations, and the cheat sheet is a handy last-day review. When you are ready to test yourself against exam-style questions, try the FITSP-Designer practice tests.
Key Takeaway
Treat the name as a roadmap: "Federal" points you to laws and NIST documents, "Professional" reminds you that experience and endorsements matter alongside the exam, and "Designer" tells you to think like someone specifying security into a system.
Frequently Asked Questions
It stands for Federal IT Security Professional - Designer. FITSI issues the credential, and FITSP-D is the issuer's shorthand. The current handbook name is FITSP-Designer-NG.
No. In this credential, "Designer" is a security role focused on building federal standards, controls and risk management requirements into information systems. The exam tests NIST publications, control families, the RMF and federal laws rather than creative design skills.
No. Certification also requires five years of information-security experience (reducible by up to three years through waivers), an application with a current resume, two professional endorsements and agreement to the Code of Ethics. Apply within five years of passing the exam.
Three years. To renew, earn 60 CPE credits per certification over the cycle or retest at its end, follow the Code of Ethics and pay the USD 75 annual maintenance fee. The older six-year cycle was superseded effective June 1, 2024.
NIST Control Families at 22%. NIST Special Publications and the NIST Risk Management Framework follow at 20% each, then Governmental Laws and Regulations at 19%, FIPS at 13% and NISTIRs at 6%. For the pass-rate question, see our pass rate article, which covers what is publicly known.