- What a FITSP-Designer Actually Is
- Who Issues the Credential and How It Is Administered
- What a Designer Does in Practice
- The Six Exam Domains
- Exam Format and Question Style
- Experience, Endorsements and Eligibility
- Fees, Retests and Keeping the Credential Current
- Where the Credential Gets Used
- A Domain-Driven Preparation Sequence
- Frequently Asked Questions
- FITSP-Designer is the Designer role certification from the Federal IT Security Institute (FITSI), shortened by the issuer to FITSP-D.
- The exam has 150 multiple-choice items (120 scored, 30 beta) in 3 hours, closed book, English only.
- NIST Control Families is the heaviest domain at 22%; NIST Interagency Reports is the lightest at 6%.
- Certification also requires five years of security experience (up to three years waivable), an application and two endorsements.
What a FITSP-Designer Actually Is
A FITSP-Designer is a professional who has earned the Federal IT Security Professional - Designer certification from the Federal IT Security Institute (FITSI). The credential belongs to FITSI's FITSP scheme, which defines separate certifications by job role rather than a single one-size-fits-all security credential. The Designer role focuses on the people who shape how security is built into federal information systems: selecting controls, applying federal standards, and making sure system designs line up with the requirements that govern U.S. government environments.
If you have seen the credential written as FITSP-D, that is simply the issuer's shorthand. The current handbook name is FITSP-Designer-NG, where "NG" refers to the next-generation version of the scheme. If you want a deeper treatment of the name itself, our pages on what FITSP-Designer stands for and the meaning of FITSP-Designer cover the terminology, while this article concentrates on the role, the exam and the practical mechanics.
Who Issues the Credential and How It Is Administered
FITSI both sets the certification requirements and administers and proctors the computer-based examination. Membership in FITSI is optional, so you do not need to join the organization to sit for the exam or earn the certification. The Designer-specific content comes from FITSI's published scheme documents, including the Candidate Handbook, the Certification Scheme Details Handbook and the Designer Certification Competence Breakdown, which lays out the official role task objectives.
One practical point: FITSI's handbooks describe both in-person and remote delivery, but the registration page has labeled in-person testing as unavailable, so you should confirm which session types are actually offered before planning your date. Our guide to FITSP-Designer exam dates and scheduling walks through how to approach that.
What a Designer Does in Practice
Federal systems do not get built on preference alone. They are designed against a stack of requirements: statutes, regulations, mandatory federal standards, and NIST guidance. The Designer role sits at the point where those requirements become architecture decisions. In practice that means:
- Translating a system's categorization and risk posture into a coherent set of security controls.
- Selecting and tailoring controls from the NIST control catalog so they fit the system rather than being copied wholesale.
- Ensuring designs reflect required cryptographic and security standards from the Federal Information Processing Standards.
- Documenting how the design satisfies applicable laws and regulations, and how it fits into the Risk Management Framework lifecycle.
- Working with assessors, authorizing officials and implementers so the design can be authorized and operated.
This is why the certification is anchored so heavily in NIST publications rather than in vendor products. The exam is testing whether you can reason about federal security requirements, not whether you can configure a particular firewall.
The Six Exam Domains
The exam is organized into six official weighted domains. These are distinct from the 18 cross-cutting security topic areas that FITSI also publishes, which is a common point of confusion; the six domains are what drive the weighting of your exam. Weights below reflect the structure effective June 1, 2024. For a longer walkthrough, see our complete guide to all six FITSP-Designer content areas.
| Domain | Weight | Core Focus |
|---|---|---|
| Domain 3: NIST Control Families (CFs) | 22% | The control catalog and what each family protects |
| Domain 1: NIST Special Publications (SPs) | 20% | Guidance documents that shape security practice |
| Domain 5: NIST Risk Management Framework (RMF) | 20% | The lifecycle for managing system risk and authorization |
| Domain 4: Governmental Laws and Regulations | 19% | The legal and policy basis for federal security |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% | Mandatory federal standards |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% | Technical and research-oriented NIST reports |
Domain 3: NIST Control Families (22%)
The largest slice of the exam. Expect questions that ask you to identify which control family addresses a given security objective, and to distinguish between families that sound similar.
- Know the purpose of each family well enough to place a scenario into the right one.
- Understand how families relate to each other, not just their names.
- Practice recognizing which family a described safeguard belongs to.
Domain 1: NIST Special Publications (20%)
Special Publications are the backbone of federal security guidance. Candidates need to know what individual publications are for and when each one applies.
- Match a publication to the problem it is meant to solve.
- Understand how SPs support each other across the system lifecycle.
- Prefer current handbook weights over older courseware lists when deciding what to emphasize.
Domain 5: NIST Risk Management Framework (20%)
The RMF is the process view of federal security: categorize, select, implement, assess, authorize and monitor. Designers must understand where their work fits in that flow.
- Know the sequence of steps and the outputs of each.
- Understand the roles involved in each step.
- Be able to connect design decisions to authorization needs.
Domain 4: Governmental Laws and Regulations (19%)
This domain rewards candidates who can explain why federal security requirements exist, not just what they say. Questions tend to test the purpose and reach of a law or policy.
- Learn what each major law or regulation requires and whom it applies to.
- Be ready to connect legal drivers to the standards and controls that implement them.
Domain 2: NIST FIPS (13%) and Domain 6: NIST Interagency Reports (6%)
Smaller domains, but easy to underestimate. FIPS documents are mandatory standards, so precision matters. NISTIRs carry the least weight but still contribute scored items.
- For FIPS, know what each standard governs and why it is mandatory.
- For NISTIRs, aim for recognition-level familiarity rather than deep memorization.
Exam Format and Question Style
The Designer exam is a computer-based, closed-book test delivered in English only. Personal calculators are prohibited.
| Element | Detail |
|---|---|
| Total items | 150 multiple-choice questions |
| Scored items | 120 |
| Beta (unscored) items | 30 |
| Time limit | 3 hours |
| Language | English only |
| Reference materials | Closed book |
The 30 beta items are mixed in with the scored ones and you cannot tell which are which, so treat every question as if it counts. Breaks do not extend the timer, which means any time you spend away from the screen comes out of your three hours.
FITSI uses a Designer-specific cut score established through an Angoff study and approved by the Scheme Committee. The handbook we reviewed does not publish a numeric threshold, so be wary of any source that quotes a precise percentage as fact. We discuss what is and is not known on our FITSP-Designer passing score page, and our pass rate analysis explains why a reliable pass rate figure is hard to come by.
Experience, Endorsements and Eligibility
Passing the exam is only part of earning the credential. FITSI also requires a documented professional background. Certification requires:
- Five years of information-security experience.
- A completed application and a current resume or CV.
- Two professional endorsements.
- Agreement to the FITSI Code of Ethics.
You must submit the application within five years of passing the exam. That window matters if you test early in your career and plan to accumulate experience afterward.
Waivers that reduce the experience requirement
Certain education and certifications can offset experience, up to three years in total:
- An accredited bachelor's degree can waive one year.
- A master's degree in IT or information assurance can waive a second year.
- An issuer-listed security certification can waive one more year.
Our FITSP-Designer requirements guide goes into the application mechanics in more detail.
Fees, Retests and Keeping the Credential Current
The FITSI fee schedule sets the initial exam at USD 395. If you do not pass, one discounted same-role retest is available for USD 197.50, provided you wait at least 21 calendar days and retest within one year of the initial exam. That discount applies once, so it pays to arrive prepared the first time. The full picture, including ongoing costs, is in our FITSP-Designer certification cost breakdown.
The three-year cycle
Once certified, your credential is valid for three years. To stay current you must:
- Earn 60 CPE credits per certification over that cycle, or retest at the end of it.
- Observe the Code of Ethics.
- Pay the USD 75 annual maintenance fee.
Where the Credential Gets Used
Because the content is built around federal requirements, the credential is most relevant where federal security obligations apply. That generally includes federal agencies, defense and civilian contractors supporting government systems, and consulting firms that help organizations meet federal control and authorization requirements. Typical roles that benefit from Designer-level knowledge include security architects, system security engineers, information assurance analysts and security control assessors who work on systems subject to the Risk Management Framework.
We deliberately avoid quoting salary numbers here because no reliable figure is published by the issuer. For a measured view of how the credential fits into a career, see our analysis of FITSP-Designer earnings and the broader question of whether the certification is worth it. If you are scanning for openings, our overview of FITSP-Designer jobs is a useful starting point.
A Domain-Driven Preparation Sequence
Rather than a generic schedule, sequence your preparation around how the domains depend on each other. The Risk Management Framework gives structure to everything else, so it makes a good anchor, and the weighting tells you where the points are.
RMF and Governmental Laws (Domains 5 and 4)
- Learn the RMF lifecycle first so later material has a place to attach.
- Tie each major law to the part of the lifecycle it drives.
NIST Special Publications and FIPS (Domains 1 and 2)
- Map each publication or standard to its purpose and where it fits in RMF steps.
- Be precise about what is mandatory versus advisory.
NIST Control Families (Domain 3)
- Give the heaviest domain the most repetition; practice placing scenarios into the correct family.
- Touch NISTIRs lightly for recognition.
Mixed practice under timed conditions
- Simulate the 150-question, 3-hour format with no references.
- Review misses by domain to find the weak spots.
For a fuller plan, our FITSP-Designer study guide expands on this approach, and the cheat sheet is handy for last-minute review. To test yourself against realistic questions, try the FITSP-Designer practice tests.
Key Takeaway
Spend your time in proportion to the weights, but do not skip the small domains. A 13% FIPS domain and a 6% NISTIR domain together still account for roughly a fifth of the exam. Use the current handbook weights, not older courseware lists, to decide where to focus.
Frequently Asked Questions
It stands for Federal IT Security Professional - Designer, a role-based certification from the Federal IT Security Institute (FITSI). The issuer shortens it to FITSP-D, and the current handbook name is FITSP-Designer-NG.
The exam has 150 multiple-choice items, of which 120 are scored and 30 are unscored beta items, with a 3-hour time limit. It is closed book and English only, and breaks do not extend the timer.
Yes. Certification requires five years of information-security experience, an application, a current resume or CV, two professional endorsements and agreement to the Code of Ethics. A bachelor's degree, a relevant master's degree and an issuer-listed security certification can each waive one year, up to three years total.
The initial exam is USD 395. One discounted same-role retest costs USD 197.50 and requires waiting at least 21 calendar days and retesting within one year of the initial exam.
It is valid for three years. To maintain it you need 60 CPE credits per certification over the cycle or a retest at its end, adherence to the Code of Ethics and payment of the USD 75 annual maintenance fee. Older references to a six-year cycle have been superseded.
For more background on the credential as a whole, you can also read our overviews of FITSP-Designer certification and how hard the exam is.