What Is FITSP-Designer?

The Short Answer: What FITSP-Designer Actually Is

FITSP-Designer is a professional certification from the Federal IT Security Institute (FITSI) that validates a practitioner's ability to design security into federal information systems. The "FITSP" stands for Federal IT Security Professional, and "Designer" identifies the specific role within that scheme. FITSI also uses the shorthand FITSP-D, and its current handbook refers to the credential as FITSP-Designer-NG.

Unlike certifications that test knowledge of a vendor's firewall or a general security philosophy, this credential is anchored to the body of standards and law that governs how the U.S. federal government secures its information systems. The questions come from NIST publications, federal statutes and regulations, and the risk management process agencies use to authorize systems. If your work touches federal systems, or you want it to, that focus is the whole point.

If you want other angles on the same question, our pages on what FITSP-Designer certification is and what FITSP-Designer stands for cover the naming and definition details separately.

Who Issues It and Who Runs the Exam

FITSI both issues the credential and administers and proctors the computer-based examination. Membership in FITSI is optional, so you do not need to join the organization to sit for the exam or earn the certification.

FITSI publishes a set of governing documents that candidates should treat as primary sources: the Certification Candidate Handbook, the FITSP Certification Scheme Details Handbook, the Designer Certification Competence Breakdown, the Federal Body of Knowledge Guide, a fee schedule, and a Certification Holder Handbook. When third-party courseware, older forum posts, and the current handbook disagree, the current handbook wins. The domain weights discussed below took effect June 1, 2024, so any study material that predates that change deserves a cross-check.

What "Designer" Means in the FITSP Scheme

The FITSP scheme is organized by role, and Designer is one of them. The Designer role centers on the work of specifying and shaping security for a system: selecting appropriate controls, aligning the design with applicable standards and law, and ensuring the architecture supports the risk management process rather than fighting it. FITSI documents the role's expectations in the FITSP-Designer Certification Competence Breakdown, which lists the official task objectives.

In practical terms, a Designer is the person who can look at a proposed system and say which NIST controls apply, how they map to the system's categorization, what federal requirements constrain the design, and how the result will hold up during assessment and authorization. That is a different emphasis from an operator who runs a system day to day or an auditor who evaluates one after the fact. It is also why the exam leans so heavily on frameworks and publications: a designer's decisions have to be traceable to them.

The Six Weighted Exam Domains

The exam draws from six official weighted domains. The weights below come from FITSI's current candidate handbook, effective June 1, 2024.

For a deeper walk through each area, see our complete guide to all six FITSP-Designer content areas.

Domains vs. the 18 Cross-Cutting Topic Areas

One point trips up many candidates reading FITSI's materials: the six weighted domains are distinct from the 18 cross-cutting security topic areas. The domains are how the exam is scored and weighted. The topic areas are subject categories that cut across the domains, so a single question might be about a topic area such as access control while being sourced from, say, Control Families or an SP.

Do not confuse the two lists when planning your time. Weights belong to the six domains. If you build a study plan by topic area alone, you may over-invest in a subject while under-covering a high-weight domain. Use the domains to allocate hours and the topic areas to check that no subject is a blind spot.

Exam Format: 150 Items, 3 Hours, Closed Book

The exam contains 150 multiple-choice items. Of those, 120 are scored and 30 are beta items, and you will not know which are which. You have 3 hours, the exam is offered in English only, and it is closed book. Personal calculators are prohibited.

Passing is determined against a Designer-specific cut score established through an Angoff study and approved by the Scheme Committee. FITSI's retrieved handbook does not publish a numeric threshold, so be skeptical of any site that claims an exact percentage. Our passing score page explains what is and is not publicly known.

Remote Testing Logistics

Remote delivery uses a personal computer plus a separate phone or tablet for monitoring. You need two signed IDs, including one photo ID, and you should connect or arrive 30 minutes early. Breaks do not extend the timer, so plan accordingly. The handbook describes both in-person and remote delivery, but the registration page has still labeled in-person testing unavailable, so check actual session availability before you plan around a testing center. Our exam dates and scheduling page covers the practical side.

Fees and Registration Mechanics

The discounted retest applies to the same role and is available once, which makes the first attempt worth preparing for properly. The 21-day minimum gap also means a failed attempt costs you at least three weeks, so a retest is a recovery plan rather than a scheduling strategy. For the full picture of what you will spend over time, see the FITSP-Designer certification cost breakdown.

Experience, Endorsements, and Waivers

Passing the exam is one component. To be certified, you also need:

• Five years of information-security experience
• A completed application and a current resume or CV
• Two professional endorsements
• Agreement to the FITSI Code of Ethics

You must submit the application within five years of passing the exam.

How Waivers Reduce the Experience Requirement

The five-year requirement can shrink by up to three years in total:

• An accredited bachelor's degree can waive one year
• An IT or information-assurance master's degree can waive a second year
• An issuer-listed security certification can waive one more year

That means a candidate with all three could potentially satisfy the experience requirement with two years of work. Details and edge cases are covered in our FITSP-Designer requirements guide.

Keeping the Credential Current

Certification is valid for three years. To maintain it, you can recertify by earning 60 CPE credits per certification over that cycle, or retest at the end of it. You must also observe the Code of Ethics and pay the USD 75 annual maintenance fee.

Be careful with older information here. FITSI's March 3, 2020 NG FAQ described a six-year cycle, but that was superseded by a May 3, 2024 announcement, effective June 1, 2024. The three-year validity period is the current rule, and the 2025 Holder Handbook covers both legacy and NG credentials.

Who Hires for This Credential

The credential is most relevant where federal information systems are built, authorized, and operated. That includes federal agencies themselves, defense and civilian contractors, and consulting firms that support agency security programs. Job postings in this space often ask for fluency in NIST controls, the RMF, and federal compliance requirements, which maps directly onto the exam's domains.

Typical roles include security architect, systems security engineer, information assurance analyst, and compliance or authorization specialist. The Designer role fits people who shape system security rather than only assess it. For more on the job market, see our overview of FITSP-Designer jobs, and for a measured look at return on the investment, read whether the certification is worth it. We deliberately avoid quoting salary numbers here; the salary guide discusses compensation qualitatively.

A Domain-Ordered Preparation Sequence

Because the exam is weighted by domain, schedule your time in an order that builds knowledge logically rather than in the order the domains are numbered. The laws and the RMF give you the "why" and the process; the control families and SPs give you the detail.

For a fuller plan, our FITSP-Designer study guide goes deeper, and the cheat sheet works well for last-minute review. When you are ready to test yourself under realistic conditions, our practice tests mirror the multiple-choice format.

If you are weighing how demanding all this is, see how hard the FITSP-Designer exam is, and for what data does and does not exist, the pass rate page explains why no verified figure is available.

Frequently Asked Questions