- What the FITSP-Auditor Credential Actually Is
- Original vs. Next Generation: Why You See "-NG"
- Exam Format and Delivery
- The Six Weighted Domains
- Six Domains vs. 18 Topic Areas
- Experience Requirements and the Award Sequence
- Fees and What They Cover
- Sequencing Your Preparation by Domain
- Vetting Study Materials Before You Buy
- Keeping the Credential: Three-Year Renewal
- FITSP-Auditor and CISA: Different Tools
- Frequently Asked Questions
- FITSP-Auditor is issued by the Federal IT Security Institute (FITSI); new candidates receive the Next Generation (-NG) version.
- The exam has 150 multiple-choice questions (120 scored, 30 beta) in three hours, remotely proctored.
- NIST Special Publications and NIST Control Families each carry 21%; the Risk Management Framework follows at 20%.
- Passing the exam does not award the credential; experience evidence and two endorsements are reviewed afterward.
What the FITSP-Auditor Credential Actually Is
The FITSP-Auditor certification, also written Federal IT Security Professional - Auditor or FITSP-A, is administered by the Federal IT Security Institute (FITSI) as one role within its Federal IT Security Professional program. It is built around the work of someone who evaluates whether federal information systems meet security requirements, which makes it a very different animal from general-purpose security certifications. Rather than testing broad technology knowledge, it tests whether you can work inside the federal security rulebook: NIST publications, federal standards, control families, statutes and the Risk Management Framework.
If you are new to the terminology, our explainers on what FITSP-Auditor is and what the acronym stands for cover the basics. This article focuses on the full picture of the certification: how the exam is built, what it costs, what you need to qualify and how to prepare.
Original vs. Next Generation: Why You See "-NG"
FITSI's Certification Holder Handbook explains that original certificates were issued until 2020, and that Next Generation certificates carrying the -NG extension began in 2020. FITSI documented the change in its March 3, 2020 announcement of the Next Generation FITSP program. Current issuer handbooks describe the version issued to new candidates as FITSP-Auditor-NG, which is why you will see search results and study materials using both labels.
The practical consequence for you is version hygiene. Materials written for the pre-2020 certificate, or for earlier Next Generation editions, may not reflect the exam weights that took effect on June 1, 2024. FITSI's May 3, 2024 announcement established those changes to domain concentrations, along with a shorter renewal cycle for NG holders. Always check the date and the role label on anything you plan to study from.
Exam Format and Delivery
According to FITSI's Certification Scheme Details Handbook (v1.6, effective June 1, 2024), the Auditor exam consists of 150 multiple-choice questions with a three-hour time limit. Of those, 120 are scored and 30 are beta items. You will not be told which are which, so treat every question as if it counts. The exam is computer-based and offered in English only.
| Feature | FITSP-Auditor Detail |
|---|---|
| Question format | Multiple choice |
| Total questions | 150 (120 scored, 30 beta) |
| Time limit | Three hours |
| Language | English only |
| Administered and proctored by | FITSI |
| Results | Immediate pass/fail; emailed score report in three to five business days |
Remote Proctoring Mechanics
FITSI's registration page lists two delivery formats but labels in-person testing as currently not offered, so plan on the remote-proctored route. Per the Candidate Handbook, you test on your own computer while a separate phone or tablet provides monitoring. The process uses Assess.ai, WebLock and Zoom. You need two signed IDs, at least one with a photo, and you should check in 30 minutes early.
For pacing, 150 questions in 180 minutes works out to just over a minute and a half per item on average. Because the questions draw on specific NIST publications, laws and control details, speed comes from recall, not from working problems out. For a realistic sense of the challenge, see our difficulty guide.
The Six Weighted Domains
FITSI's Candidate Handbook (v3.7) publishes Auditor-specific weights effective June 1, 2024. These are the official examination domains, not study-guide headings invented by prep vendors. They total 100%.
| Domain | Weight |
|---|---|
| NIST Special Publications (SPs) | 21% |
| NIST Federal Information Processing Standards (FIPS) | 13% |
| NIST Control Families (CFs) | 21% |
| Governmental Laws and Regulations | 17% |
| NIST Risk Management Framework (RMF) | 20% |
| NIST Interagency Reports (NISTIRs) | 8% |
Domain 1: NIST Special Publications (21%)
Tied for the heaviest weight. Auditors are expected to know which publication governs which activity, and to apply it to an audit scenario.
- Know what each major SP is for: security control catalogs, assessment procedures, system lifecycle guidance
- Be able to match a scenario (assessing a control, categorizing a system, handling an incident) to the publication that addresses it
- Focus on assessment-oriented guidance, since your role is evaluating rather than designing
Domain 2: NIST FIPS (13%)
Federal Information Processing Standards are mandatory for federal systems, which makes them fair game for specific, factual questions.
- Understand what each FIPS standardizes and where it applies
- Connect FIPS to the RMF steps and to control selection decisions
Domain 3: NIST Control Families (21%)
The other 21% domain. Expect questions that ask what a family covers, how controls relate and what evidence demonstrates implementation.
- Learn the families by purpose, not by memorized acronym alone
- Practice translating a control requirement into the audit evidence you would request
Domain 4: Governmental Laws and Regulations (17%)
This domain rewards knowing the federal legal landscape that gives the technical standards their authority.
- Know the purpose and scope of the key federal information security statutes and policies
- Understand who is responsible for what under those authorities
Domain 5: NIST Risk Management Framework (20%)
The RMF is the connective tissue between publications, standards and controls, and it is where an auditor's judgment is most visible.
- Know each step, its purpose, its inputs and its outputs
- Understand the authorization decision and the role of continuous monitoring
Domain 6: NIST Interagency Reports (8%)
The smallest slice, but not one to ignore: NISTIRs are narrower, so a few targeted hours can secure these points.
- Learn what NISTIRs are and how they differ from SPs and FIPS
- Be able to recognize the topics the most relevant reports address
Our companion piece on the six content areas goes deeper on each domain.
Six Domains vs. 18 Topic Areas
A common source of confusion: FITSI's FITSP Domains page distinguishes the six examination domains from 18 intersecting IT security topic areas. The topics are not 18 additional domains. They are the subject-matter threads that run through the domains, and a single question might touch a domain (say, Control Families) and a topic (say, Incident Response) at once.
The 18 topic areas are: Access Control; Audit and Accountability; Awareness and Training; Configuration Management; Contingency Planning; Identification and Authentication; Incident Response; Maintenance; Media Protection; Personnel Security; Physical and Environmental Protection; Planning; Program Management; Risk Assessment; Security Assessment and Authorization; System and Communications Protection; System and Information Integrity; and System and Services Acquisition.
The Auditor Competence Breakdown (v3.0) is the best look at how tasks, knowledge and skills are framed for this role. Note that its web and PDF metadata mislabel it as FITSP-Manager exam objectives, but the 17-page document's cover, contents and task statements identify Auditor. If you download it, trust the content, not the file properties.
Experience Requirements and the Award Sequence
This is the part most competitor pages blur. Earning FITSP-Auditor is a two-stage process: pass the exam, then have your experience verified. Passing alone does not award the credential.
The Experience Requirement
FITSI's requirements call for five years of information security experience in federal or civilian employment. Waivers can reduce that:
- One year waived for an accredited bachelor's degree in any discipline
- A second year for an accredited IT or information assurance master's degree
- One further year for holding one or more listed complementary security certifications
- No more than three years may be waived in total
FITSI's published examples of qualifying complementary certifications include CASP+, CySA+, Security+, CEH, GIAC, CISM, CISA, CISSP, CAP and SSCP. No compulsory degree and no minimum training-hour total was identified. For eligibility details, see our requirements guide.
After You Pass
- Submit the complete application (the current handbook and requirements page cite 17 pages; use the current application, not the older scheme's 15-page figure)
- Include a current resume or CV
- Provide two professional third-party endorsements verifying your experience
- Agree to the FITSI Code of Ethics
FITSI describes an assessment and decision process of up to 60 days for a complete submission, and applicants have five years after passing to submit. That window is generous, but there is no reason to leave endorsements until the last minute; line up your endorsers while you study.
Fees and What They Cover
FITSI's fee pages and Fee Schedule (v1.3) list the following Auditor-relevant charges:
| Item | Amount (US$) |
|---|---|
| Initial examination | $395 |
| Eligible same-role retest | $197.50 |
| Rescheduling | $100 |
| Annual maintenance | $75 |
| Incomplete-application processing | $25 |
Membership is not required, and no separate member versus nonmember exam price is published. The $75 associate-membership fee is separate from the exam fee. The discounted retest is available once after a failed exam, following a 21-calendar-day wait and within one year of the initial attempt; outside that allowance, the initial rate applies. Training and courseware are charged separately and are optional per FITSI's Training Program Handbook.
Key Takeaway
Treat the $395 exam fee as the baseline, then add only what you need. A historical FITSI-authorized three-day course bundle was advertised at $1,495 for members or $1,695 for nonmembers and included a $395 exam voucher. That is a dated example, not a current price list. Our full cost breakdown separates every line item.
Sequencing Your Preparation by Domain
Because the weights are published, your calendar should follow them. Here is one sequencing approach that front-loads the heavy domains and uses the RMF as the integrating layer. Adjust the pace to your own experience; a seasoned federal assessor may compress the early weeks.
NIST Special Publications (21%)
- Map each major publication to its purpose and the audit activity it supports
- Build a one-page matrix: publication, scope, who uses it, when
NIST Control Families (21%)
- Study families by purpose and by the evidence an auditor would examine
- Cross-reference to the 18 topic areas to see where they overlap
Risk Management Framework (20%)
- Walk each step with inputs, outputs and responsible roles
- Tie RMF steps back to the SPs and control families you already studied
Laws and Regulations (17%) and FIPS (13%)
- Learn each statute's purpose and what it requires of agencies
- Memorize what each FIPS standardizes and where it applies
NISTIRs (8%) and Full Review
- Cover the Interagency Reports in a focused block
- Take timed practice sets under the three-hour, closed-book conditions
The reason for putting the RMF after the publications and controls is that it makes more sense once you know the building blocks it orchestrates. For a deeper plan, see the complete study guide, and keep the cheat sheet nearby for final review. When you are ready to test recall under realistic conditions, our FITSP-Auditor practice tests let you drill the weighted domains.
Vetting Study Materials Before You Buy
Public search results for this credential are thin and uneven, so provenance matters more than usual. Before spending money, check the following:
- Role label: Confirm the material is for Auditor, not another FITSP role. FITSI's other roles have different weights and scope.
- Version and date: Anything predating the June 1, 2024 weight changes may emphasize the wrong domains. A courseware book revision from 2020 is not evidence of alignment with current weights.
- Source claims: Be skeptical of any page that claims "actual exam questions" or "verified answers." FITSI has not endorsed third-party question dumps, and user-upload marketplaces mix useful and irrelevant content; one sampled Auditor-NG listing previewed generic financial-statement questions with no obvious link to federal IT security.
- Basic facts: One exact-keyword landing page we reviewed misnamed the issuer entirely. If a page gets the certifying body wrong, discount everything else on it.
The authoritative anchors are FITSI's own documents: the Candidate Handbook, the Competence Breakdown, the Federal Body of Knowledge Guide and the domains page. The Body of Knowledge Guide (v2.2, 2021) spans all four FITSP roles and defines the broad federal source boundary; it is not an instruction to read every publication listed, and its publication list is not a current inventory of every federal law or standard.
Optional commercial courseware exists through FITSI's authorized courseware partner, and independent practice-question books have been published with explicit disclaimers of FITSI affiliation. Their paid content could not be reviewed for accuracy, so evaluate samples carefully and compare them against the official domain list. FITSI states plainly that training is optional.
Keeping the Credential: Three-Year Renewal
Per the Certification Holder Handbook (v2.5), the credential is valid for three years. During each cycle you must earn and report 60 CPE credits per held certification, or retake the applicable examination at the end of the cycle, while keeping up annual fees and Code of Ethics compliance. Older materials mentioning a six-year cycle, a 20-CPE-per-year requirement or a $45 annual fee do not reflect current handbooks; the current annual maintenance fee is $75.
FITSI's CPE handbook (v2.2, April 2026) adds structure:
- Activities must be relevant to your held role and its domains
- Keep supporting records and report through FITSI's portal
- At least 30% of credits must come from structured education or training
- No more than 50% may come from self-directed reading or independent study
No separate 20-CPE annual minimum should be inferred from the 60-per-three-years rule. Plan your CPE as a three-year budget. See also the return-on-investment analysis for how ongoing costs factor into the value picture.
FITSP-Auditor and CISA: Different Tools
Candidates often ask how this credential compares to ISACA's Certified Information Systems Auditor (CISA), which is a credential from ISACA, not the U.S. agency of the same acronym. They overlap in the auditing mindset, but they point in different directions.
| Aspect | FITSP-Auditor | CISA (ISACA) |
|---|---|---|
| Issuer | Federal IT Security Institute (FITSI) | ISACA |
| Orientation | Federal IT security: NIST publications, FIPS, control families, federal law, RMF | Broader information systems audit, control and assurance |
| Natural fit | Assessors working within federal or federal-contractor security programs | Auditors across industries and sectors |
| Relationship | FITSI lists CISA among credentials that can earn an experience waiver | Verify current requirements directly with ISACA |
The two can be complementary rather than competing: holding CISA can count toward a one-year experience waiver for FITSP-Auditor under FITSI's published rules. For CISA's current requirements, rely on ISACA's own credentialing page rather than secondhand summaries.
Frequently Asked Questions
The exam has 150 multiple-choice questions, of which 120 are scored and 30 are beta items. You have three hours, and the exam is computer-based and English only.
FITSI uses an Angoff cut-score study with psychometrician and subject-matter-expert input, approved by its Scheme Committee. A current numerical Auditor passing mark was not publicly verified, so be wary of sites that state one. See our passing score article for what is and is not known.
No. Membership is not required, and no separate member or nonmember exam price is published. The initial exam fee is US$395; associate membership is a separate fee.
Not by itself. After passing, you submit the application, resume or CV and two third-party endorsements, and agree to the Code of Ethics. FITSI then assesses your experience, with a decision process of up to 60 days for a complete submission.
One discounted same-role retest at US$197.50 is available after a 21-calendar-day wait and within one year of the initial exam. Outside that allowance, the initial rate applies. Rescheduling carries a separate US$100 fee.
No official FITSP-Auditor pass rate or credential-specific salary dataset was established, so claims of either deserve skepticism. Our pages on pass rate and salary explain what can responsibly be said.
The FITSP-Auditor-NG rewards candidates who treat it as a federal-standards exam first and an audit exam second: know the NIST publication landscape, learn the control families by purpose, anchor everything to the RMF, and start collecting your experience endorsements early. Official FITSI documents are your source of truth; everything else should be checked against them.