- What the FITSP-Designer Credential Actually Is
- Who Issues It and What the Role Means
- The Six Weighted Exam Domains
- Exam Format and Question Style
- Fees, Registration and Test-Day Mechanics
- Eligibility: Experience, Endorsements and Waivers
- Keeping the Credential Active
- Who Hires for This Credential
- A Domain-Driven Study Sequence
- Frequently Asked Questions
- FITSP-Designer is a Federal IT Security Institute (FITSI) credential focused on the Designer role, with the shorthand FITSP-D.
- The exam has 150 multiple-choice items, 120 scored and 30 beta, in 3 hours, closed book.
- NIST Control Families carries the largest weight at 22%, followed by NIST SPs and the RMF at 20% each.
- The initial exam costs USD 395; one same-role retest is USD 197.50 after at least 21 days.
What the FITSP-Designer Credential Actually Is
FITSP-Designer is a role-based certification for professionals who design security into federal information systems. It is one of the role credentials within the Federal IT Security Professional (FITSP) scheme, and it is aimed at people whose daily work involves translating federal requirements into system and security architecture decisions. Issuer documents abbreviate it as FITSP-D, and the current handbook materials refer to the next-generation version as FITSP-Designer-NG.
What sets this credential apart from many vendor-neutral security certifications is its subject matter. Instead of surveying broad security theory, it tests how well you know the federal compliance universe: the NIST publication families, federal standards, control catalogs, risk management process and the statutes that drive all of it. If your career sits in or near federal systems, that focus is the point. If you work mostly outside that world, you should read our ROI analysis of the FITSP-Designer certification before committing.
For other short explainers on the name and terminology, see what FITSP-Designer stands for and the overview at What Is FITSP-Designer?.
Who Issues It and What the Role Means
The credential is issued by the Federal IT Security Institute (FITSI). FITSI administers and proctors the computer-based examination, and membership in the organization is optional: you do not need to join to sit the exam or earn the certification.
The "Designer" label matters. FITSI's role-based approach assigns each certification a competence breakdown describing the tasks someone in that role is expected to perform. For the Designer, those tasks center on specifying, architecting and documenting security controls and requirements during system design, rather than operating, auditing or managing programs. The official FITSP-Designer Certification Competence Breakdown is the document that lays out these task objectives, and it is worth reading early because it tells you how the exam authors think about the job.
The Six Weighted Exam Domains
The current weights took effect June 1, 2024, and they come from the FITSI Certification Candidate Handbook. Older courseware and reference lists may show different breakdowns; where they conflict, the current handbook wins. For a deeper walkthrough, see our complete guide to all six FITSP-Designer content areas.
| Domain | Weight | What It Rewards |
|---|---|---|
| Domain 3: NIST Control Families (CFs) | 22% | Knowing what each control family does and how controls fit a design |
| Domain 1: NIST Special Publications (SPs) | 20% | Recognizing which SP addresses which problem |
| Domain 5: NIST Risk Management Framework (RMF) | 20% | Sequencing and purpose of RMF steps |
| Domain 4: Governmental Laws and Regulations | 19% | Matching statutes and directives to obligations |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% | Understanding mandatory federal standards and their scope |
| Domain 6: NIST Interagency Reports (NISTIRs) | 6% | Familiarity with the research-oriented report series |
Domain 3: NIST Control Families (22%)
The single heaviest domain. Designers must understand the organization of security and privacy controls into families and be able to reason about which controls address a stated requirement.
- Know the purpose of each family, not just its name
- Practice mapping a design requirement to the family that satisfies it
- Understand how baselines and tailoring affect which controls apply
Domain 1: NIST Special Publications (20%)
Questions here test recognition: given a security need, which publication provides the guidance? Breadth matters more than memorizing text.
- Group publications by purpose: risk, controls, assessment, architecture, privacy
- Know how the guidance documents relate to each other
- Learn which publications support design decisions specifically
Domain 5: NIST Risk Management Framework (20%)
The RMF is the process backbone of federal system authorization. A designer needs to know how design work feeds each step and what artifacts the process expects.
- Know the purpose and order of the steps
- Understand categorization and how it drives control selection
- Connect design documentation to authorization outcomes
Domain 4: Governmental Laws and Regulations (19%)
Nearly one in five scored questions rewards knowing the legal and policy framework. Candidates from purely technical backgrounds often underinvest here.
- Learn what each major statute or directive requires and of whom
- Understand how legal mandates connect to NIST publications
- Be ready for scenario questions that ask which authority applies
Domain 2: NIST FIPS (13%)
FIPS are federal standards, and unlike many guidance documents they carry mandatory weight for federal systems. Focus on what each standard covers and when it applies.
Domain 6: NIST Interagency Reports (6%)
The smallest domain, but the question style is the same: identify the report and its purpose. Treat it as low-cost points once your other domains are solid.
Key Takeaway
Three domains (Control Families, SPs and RMF) account for 62% of the exam combined. Add Laws and Regulations and you are at 81%. Spend your first study weeks there.
Exam Format and Question Style
The exam is delivered by computer in English only. It contains 150 multiple-choice items: 120 are scored and 30 are beta items used by FITSI to evaluate future questions. You will not know which items are which, so treat every question as if it counts. You have 3 hours, which works out to a little over a minute per item, and breaks do not extend the timer.
The test is closed book, and personal calculators are prohibited. Because the content is largely recognition and application of federal publications, the challenge is breadth. You are less likely to be asked to derive something than to identify the correct publication, control family, RMF step or legal authority from a scenario.
FITSI sets the Designer-specific cut score through an Angoff study approved by its Scheme Committee. A numeric threshold is not published in the handbook we reviewed, so be wary of any source quoting an exact percentage. We explain what is and is not known on our FITSP-Designer passing score page, and our guide to exam difficulty covers how the format feels in practice. For the pass-rate question specifically, see what the data shows.
Fees, Registration and Test-Day Mechanics
Exam fees
The initial exam fee is USD 395. If you need a second attempt in the same role, FITSI offers one discounted retest at USD 197.50, available after at least 21 calendar days and within one year of the initial exam. A full breakdown of costs, including maintenance, is in our FITSP-Designer certification cost guide.
| Item | Amount | Condition |
|---|---|---|
| Initial exam | USD 395 | First attempt |
| Same-role retest | USD 197.50 | After 21+ calendar days, within one year of initial exam |
| Annual maintenance fee | USD 75 | Paid each year while certified |
Remote and in-person delivery
The handbook describes both in-person and remote delivery. However, the registration page still labels in-person testing as unavailable, so confirm which session types are actually offered before you plan. Remote testing requires a personal computer plus a separate phone or tablet for monitoring.
Identification and arrival
- Bring two signed IDs, at least one of which must be a photo ID
- Connect or arrive 30 minutes before your session
- Remember that breaks do not pause the timer
Scheduling windows and deadlines are covered in our exam dates guide.
Eligibility: Experience, Endorsements and Waivers
Passing the exam is one part of becoming certified. FITSI requires a documented professional background as well, and the structure is unusual enough that many candidates are surprised by it.
- Experience: five years of information-security experience
- Application: a completed application and a current resume or CV
- Endorsements: two professional endorsements
- Ethics: agreement to the Code of Ethics
- Timing: submit the application within five years of passing the exam
How the experience requirement can be reduced
Education and other certifications can waive part of the five-year requirement, up to three years in total:
- An accredited bachelor's degree can waive one year
- An IT or information-assurance master's degree can waive a second year
- An issuer-listed security certification can waive one more year
The practical consequence is that you can sit the exam before you satisfy the experience requirement, but you cannot call yourself certified until the application is approved. Our FITSP-Designer requirements guide goes through the eligibility pathway in detail.
Keeping the Credential Active
Certification is valid for three years. To renew, you can earn 60 continuing professional education (CPE) credits per certification over that cycle, or retest at the end of it. Throughout, you must observe the Code of Ethics and pay the USD 75 annual maintenance fee.
Who Hires for This Credential
The credential's value tracks the federal and federal-contractor market. Typical employers include federal agencies themselves and the contractors that build, integrate and authorize systems for them. Roles where it tends to be relevant include security architects, systems security engineers, information security analysts working on authorization packages and compliance-focused designers on federal programs.
Because the content is about NIST publications, the RMF and federal statute, it signals fluency in the vocabulary that appears in solicitations and statements of work. That is a different value proposition from a general-purpose credential, which is why you should weigh it against your target employers rather than the market at large. For position-specific detail, see our pages on FITSP-Designer jobs and the earnings analysis.
A Domain-Driven Study Sequence
Because weights are so uneven, order matters more than hours. This sequence front-loads the domains that carry the most points and uses the smaller domains as reinforcement.
Control Families and RMF
- Learn each control family's purpose (22% of the exam)
- Walk the RMF steps and tie controls to them (20%)
NIST SPs and Laws and Regulations
- Build a purpose-to-publication map for SPs (20%)
- Match each statute to its obligations (19%)
FIPS and NISTIRs
- Cover the standards and report series (13% and 6%)
Timed practice
- Take full-length timed sets of 150 questions
- Revisit weak domains by weight, heaviest first
A fuller plan is in our FITSP-Designer study guide, and a quick-reference summary lives in the cheat sheet. When you are ready to test yourself under realistic conditions, the FITSP-Designer practice tests mirror the multiple-choice format and domain spread.
Key Takeaway
Use the official competence breakdown and the current handbook weights as your syllabus. Older reference lists can drift from what is tested today.
Frequently Asked Questions
The Federal IT Security Institute (FITSI) issues it and administers and proctors the computer-based exam. Membership in FITSI is optional.
There are 150 multiple-choice items in 3 hours. Of these, 120 are scored and 30 are beta items. The exam is closed book, and breaks do not extend the timer.
The initial exam is USD 395. One discounted same-role retest costs USD 197.50 and is available after at least 21 calendar days and within one year of the initial exam.
Yes. Certification requires five years of information-security experience, an application, a current resume, two professional endorsements and agreement to the Code of Ethics. A bachelor's degree, a qualifying master's degree and an issuer-listed certification can each waive a year, up to three in total.
It is valid for three years. You renew with 60 CPE credits per certification over the cycle or by retesting, while observing the Code of Ethics and paying the USD 75 annual maintenance fee.
For a broader overview of the topic, see our main page on FITSP-Designer certification, and compare it with the shorter explainer What Is FITSP-Designer Certification? for a quick refresher before you begin preparing.