- The Short Answer: What the Letters Mean
- FITSI: The Institute Behind the Credential
- Why "Designer" Is the Role That Matters
- FITSP-D, FITSP-Designer-NG and the Naming Trail
- What the Name Promises: The Six Exam Domains
- How the Exam Is Built and Delivered
- Earning and Keeping the Credential
- Who Hires for This Credential
- Sequencing Your Study Around the Domain Weights
- Frequently Asked Questions
- FITSP-Designer stands for Federal IT Security Professional, Designer role, issued by the Federal IT Security Institute (FITSI).
- The exam has 150 multiple-choice items (120 scored, 30 beta) in 3 hours, English only.
- NIST Control Families is the heaviest of six weighted domains at 22%.
- Certification requires five years of security experience, with up to three years waivable through education and certification.
The Short Answer: What the Letters Mean
FITSP-Designer stands for Federal IT Security Professional - Designer. Each word in the name carries a specific meaning:
- Federal signals that the body of knowledge is built around the U.S. federal government's information security framework: NIST publications, federal standards, and the laws that govern federal systems.
- IT Security places the credential in the information-assurance field rather than general IT administration.
- Professional indicates a practitioner-level certification that requires verified work experience, not just a passing exam score.
- Designer identifies the specific role the certification validates, which is the person who plans and architects security into systems.
Because several unrelated credentials share similar acronyms, it is worth being precise: this article is only about the Designer role certification administered by the Federal IT Security Institute. For a broader orientation, our overview pages What Is FITSP-Designer? and FITSP-Designer Meaning cover the same ground from different angles.
FITSI: The Institute Behind the Credential
The Federal IT Security Institute (FITSI) is the organization that defines the certification scheme, maintains the exam content, and administers and proctors the computer-based examination. Several practical points about FITSI are worth knowing before you invest in preparation:
- Membership is optional. You do not need to join FITSI to sit the exam or earn the credential.
- A Scheme Committee approves the passing standard. The Designer-specific cut score comes from an Angoff study, a standard-setting method in which subject-matter experts judge how a minimally qualified candidate would perform on each item. The handbook we reviewed does not publish a numeric threshold, so be skeptical of any site that claims an exact passing percentage. Our page on the FITSP-Designer passing score explains what is and is not known.
- Documentation is layered. FITSI publishes a Candidate Handbook, a Scheme Details Handbook, a Holder Handbook, a Competence Breakdown for each role, and a Federal Body of Knowledge Guide. When these disagree on weights or details, the current handbook takes precedence over older reference lists and third-party courseware.
Why "Designer" Is the Role That Matters
FITSI organizes its certifications by role, and the role word in the name tells you what the exam expects you to be able to do. The Designer role centers on the design side of the system lifecycle: selecting and specifying security controls, aligning system architecture to federal requirements, and understanding how the Risk Management Framework shapes those decisions before a system is built or authorized.
That emphasis explains why the exam is so reference-heavy. A designer in a federal environment must know which NIST publication governs a given decision, which control family a requirement belongs to, and which law or regulation drives the requirement in the first place. The official task objectives for the role are laid out in the FITSP-Designer Certification Competence Breakdown, which is a good document to read early because it shows how FITSI itself describes the job.
FITSP-D, FITSP-Designer-NG and the Naming Trail
If you search FITSI materials, you will meet several name variants for the same role credential:
| Name Form | Where You See It | What It Refers To |
|---|---|---|
| FITSP-Designer | Common usage, study resources | The Designer role certification |
| FITSP-D | Issuer shorthand | Same credential, abbreviated |
| FITSP-Designer-NG | Current handbook name | The "Next Generation" version of the credential |
The 2025 Holder Handbook covers both legacy and NG credentials, so existing holders and new candidates are described in the same document. One timeline detail trips people up: FITSI's March 3, 2020 NG FAQ described a six-year certification cycle. That was superseded by a May 3, 2024 announcement, effective June 1, 2024, which established the current three-year cycle. If you find an older forum post or courseware page quoting six years, it is out of date. For the full picture of what the credential is and how it positions itself, see FITSP-Designer Certification and What Is FITSP-Designer Certification?.
What the Name Promises: The Six Exam Domains
The word "Federal" in the title is delivered through six official weighted domains. The weights below are effective June 1, 2024, per the Candidate Handbook outline.
| Domain | Weight |
|---|---|
| Domain 1: NIST Special Publications (SPs) | 20% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 3: NIST Control Families (CFs) | 22% |
| Domain 4: Governmental Laws and Regulations | 19% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% |
Domain 3: NIST Control Families (22%)
The largest domain. Candidates need to recognize control families, understand what each family is trying to accomplish, and map design requirements to the right controls.
- Know the purpose of each family, not just its name.
- Practice matching a scenario to the control family it falls under.
Domain 1: NIST Special Publications (20%)
Special Publications are the working guidance of the federal security program. Expect to connect each publication to the problem it solves.
- Learn which publication addresses which lifecycle activity.
- Understand how publications reference one another.
Domain 5: NIST Risk Management Framework (20%)
The RMF is the process backbone. Designers must understand how categorization, control selection and authorization decisions flow through the framework.
- Trace the framework steps end to end.
- Know where design decisions feed authorization.
Domain 4: Governmental Laws and Regulations (19%)
This domain explains why the technical guidance exists. Candidates should know the major federal laws and regulations that drive security requirements.
- Pair each law with its purpose and the guidance it spawned.
- Expect questions that connect legal drivers to practical requirements.
Domain 2 (FIPS, 13%) covers the mandatory federal standards, and Domain 6 (NISTIRs, 6%) covers the Interagency Reports. Both are smaller, but because the exam rewards precise recall of specific documents, neglecting them costs points that are easy to earn. Our full breakdown, FITSP-Designer Exam Domains 2026: Complete Guide to All 6 Content Areas, goes domain by domain.
How the Exam Is Built and Delivered
The exam composition and passing method come from the FITSP Certification Scheme Details Handbook (v1.6, effective June 1, 2024).
- Format: 150 multiple-choice items in 3 hours.
- Scored versus beta: 120 items are scored and 30 are beta items, which FITSI uses to evaluate future questions. You will not know which are which, so treat every item as live.
- Language: English only.
- Rules: Closed book, and personal calculators are prohibited.
- Remote testing: A personal computer plus a separate monitoring phone or tablet.
- Identification: Two signed IDs, including one photo ID.
- Arrival: Connect or arrive 30 minutes early. Breaks do not extend the timer.
Because the exam is closed book and tests recall of named documents, families and statutes, difficulty comes from breadth and precision rather than from tricky calculations. We discuss that in How Hard Is the FITSP-Designer Exam?.
Fees at a Glance
| Item | Amount |
|---|---|
| Initial exam | USD 395 |
| Same-role retest (discounted) | USD 197.50 |
| Annual maintenance fee | USD 75 |
The discounted retest is available after at least 21 calendar days and within one year of the initial exam. The figures come from the FITSI Fee Schedule; see FITSP-Designer Certification Cost 2026 for the full breakdown.
Earning and Keeping the Credential
The "Professional" in the name is backed by an experience requirement that sets this credential apart from exam-only certifications. Passing the exam alone does not make you certified.
Eligibility Requirements
- Five years of information-security experience.
- A completed application and a current resume or CV.
- Two professional endorsements.
- Agreement to the FITSI Code of Ethics.
- Submission of the application within five years of passing the exam.
Experience Waivers
Up to three years of the five-year requirement can be waived:
- An accredited bachelor's degree can waive one year.
- An IT or information-assurance master's can waive a second year.
- An issuer-listed security certification can waive one more.
Our guide to FITSP-Designer requirements walks through how these stack together.
Maintenance
Certification is valid for three years. To renew, you can either earn 60 CPE credits per certification over that cycle or retest at the end of it. Either way, you must observe the Code of Ethics and pay the USD 75 annual maintenance fee.
Key Takeaway
Read the experience requirement before you book the exam. Because the application must be submitted within five years of passing, and waivers cap at three years, a candidate with limited experience should confirm their path to qualification first.
Who Hires for This Credential
Because the body of knowledge is built on NIST guidance and federal law, the credential is most relevant to people whose work touches federal information systems. That typically includes:
- Federal agency security staff responsible for system design and authorization packages.
- Government contractors who build, integrate or assess systems under federal security requirements.
- Security architects and engineers who must translate NIST control requirements into system designs.
- Compliance and risk professionals who work with the Risk Management Framework.
The credential's value is concentrated in the federal and federal-contractor space, and less relevant for employers with no federal exposure. We explore openings in FITSP-Designer Jobs, compensation context in the salary guide, and the return question in Is the FITSP-Designer Certification Worth It?.
Sequencing Your Study Around the Domain Weights
Rather than generic study advice, the most useful planning move is ordering your preparation by domain weight and dependency. Here is one sequence that follows the logic of the exam:
Laws and the RMF backbone
- Start with Domain 4 (Laws and Regulations, 19%) and Domain 5 (RMF, 20%) to understand why the guidance exists and how the process flows.
Special Publications
- Work through Domain 1 (NIST SPs, 20%), tying each publication to the RMF step it supports.
Control Families
- Give Domain 3 (22%) the most time. It is the heaviest domain and benefits from the context built in earlier weeks.
FIPS, NISTIRs and review
- Cover Domain 2 (FIPS, 13%) and Domain 6 (NISTIRs, 6%), then run timed practice sets under 3-hour conditions.
This ordering is a suggestion, not an official FITSI schedule; adjust it to your background. Build your reference list from the current Candidate Handbook weights rather than older courseware, since the weights changed effective June 1, 2024. For a deeper plan, see the FITSP-Designer Study Guide and the one-page cheat sheet. When you are ready to test recall under realistic conditions, our FITSP-Designer practice tests let you drill each domain.
Frequently Asked Questions
It stands for Federal IT Security Professional - Designer. The credential is issued by the Federal IT Security Institute (FITSI), and "Designer" names the role the certification validates. The issuer's shorthand is FITSP-D, and the current handbook uses FITSP-Designer-NG.
No. This credential is specifically the FITSI Designer role certification built around NIST guidance and federal law. Other credentials may share similar letters but have different certifying bodies, content and requirements, so always verify the issuer.
The exam has 150 multiple-choice items in 3 hours, of which 120 are scored and 30 are beta items. The exam is English only and closed book. See our pass rate page for what is and is not publicly known about outcomes.
Yes. Certification requires five years of information-security experience, an application, a current resume or CV, two professional endorsements and agreement to the Code of Ethics. An accredited bachelor's degree, a qualifying master's and an issuer-listed security certification can each waive one year, for up to three years total.
It is valid for three years. You can recertify with 60 CPE credits per certification over that cycle or retest at its end, while observing the Code of Ethics and paying the USD 75 annual maintenance fee. Older references to a six-year cycle are superseded.
Our related pages What Does FITSP-Designer Stand For?, What Does FITSP-Designer Mean? and What Is A FITSP-Designer? approach the same question from different angles, and FITSP-Designer Training covers preparation options.
In short, every word in FITSP-Designer maps to something concrete: a federal body of knowledge, a security discipline, a verified-experience standard and a design-focused role. Understanding that mapping makes the exam outline, fees and renewal rules easier to follow, and it points you toward the right preparation: NIST publications, control families, the Risk Management Framework and the federal laws behind them. To start applying that knowledge, try the full set of questions at our FITSP-Designer practice test site.