- What This Cheat Sheet Covers (and What It Doesn't)
- The Exam at a Glance
- The Six Domains and Their Weights
- Six Domains vs. 18 Topic Areas
- Domain-by-Domain Must-Knows
- Test-Day Rules That Trip People Up
- The Money Sheet: Fees at a Glance
- After You Pass: Experience, Endorsements, Award
- Renewal Sheet: Three Years, 60 CPEs
- A Weighted Review Plan
- Stale Facts to Ignore
- FAQ
- The exam is 150 multiple-choice questions (120 scored, 30 beta) in a three-hour, closed-book, remote-proctored session.
- Domain weights: NIST SPs 21%, NIST Control Families 21%, RMF 20%, Laws and Regulations 17%, FIPS 13%, NISTIRs 8%.
- Initial exam fee is US$395; an eligible same-role retest is US$197.50 after a 21-day wait.
- Passing the exam does not award the credential; experience evidence and two endorsements are assessed afterward.
What This Cheat Sheet Covers (and What It Doesn't)
This page condenses the verifiable, issuer-sourced facts about the FITSP-Auditor credential into one scannable review. FITSP-Auditor is the Auditor role within the Federal IT Security Professional program administered by the Federal IT Security Institute (FITSI). It is also written FITSP-A, and the version issued to new candidates is FITSP-Auditor-NG, the Next Generation line that FITSI began issuing in 2020.
Everything here concerns the Auditor role only. The FITSP program has other role tracks, and their weights and scope do not apply to this exam. If you want the long-form treatment of any topic below, the FITSP-Auditor study guide and the complete guide to all six content areas go deeper. For hands-on repetition, the FITSP-Auditor practice test is the place to drill.
One honest limit up front: FITSI has not publicly verified a numerical Auditor passing mark or published a pass rate, so this sheet does not invent either. See the passing score article and the pass rate article for what is and is not known.
The Exam at a Glance
| Item | FITSP-Auditor Fact |
|---|---|
| Question format | Multiple choice |
| Total questions | 150 (120 scored + 30 beta items) |
| Time limit | Three hours |
| Delivery | Computer-based, English only; adaptive testing not verified |
| Administrator / proctor | FITSI itself (no Pearson VUE, PSI or Prometric provider identified) |
| Current delivery route | Remote-proctored; in-person testing is labeled "Currently Not Offered" |
| Open or closed book | Closed book; digital Notepad permitted |
| Results | Immediate pass/fail; emailed score report in three to five business days |
| Passing mark | Set by Angoff cut-score study and Scheme Committee approval; numeric Auditor threshold not publicly verified |
For a frank read on how demanding that format feels in practice, see how hard the FITSP-Auditor exam really is.
The Six Domains and Their Weights
These are the official examination domains and the Auditor-specific weighting row effective June 1, 2024. They are exam domains and role-specific weights, not editorial study categories.
| Domain | Weight |
|---|---|
| Domain 1: NIST Special Publications (SPs) | 21% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 3: NIST Control Families (CFs) | 21% |
| Domain 4: Governmental Laws and Regulations | 17% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 8% |
Together, the three heaviest domains (SPs, Control Families and RMF) account for 62% of the exam. NISTIRs, the lightest at 8%, still deserve a skim, but not at the expense of the big three.
Six Domains vs. 18 Topic Areas
Candidates routinely confuse two different structures. FITSI's domains page distinguishes the six examination domains above from 18 intersecting IT security topic areas. The 18 topics are not 18 additional exam domains; they cut across the six domains as subject matter you will meet inside them.
The 18 topic areas are: Access Control; Audit and Accountability; Awareness and Training; Configuration Management; Contingency Planning; Identification and Authentication; Incident Response; Maintenance; Media Protection; Personnel Security; Physical and Environmental Protection; Planning; Program Management; Risk Assessment; Security Assessment and Authorization; System and Communications Protection; System and Information Integrity; and System and Services Acquisition.
Domain-by-Domain Must-Knows
The Auditor competence breakdown frames this role around examining, testing and evaluating controls rather than designing or running them. Read each domain through an assessor's eyes: what evidence would show the control is implemented and operating?
Domain 1: NIST Special Publications (21%)
The SP series is the working library of federal security practice. For an auditor, the point is knowing which publication governs which activity.
- Match each SP to its purpose: control catalogs, assessment procedures, risk guidance, system categorization and so on.
- Be able to say which publication an assessor would use to build an assessment plan versus one used to select controls.
- Know the Auditor-relevant guidance on assessing security controls, since that is the core of your role.
Domain 2: NIST FIPS (13%)
FIPS are mandatory standards for federal systems, so questions tend to be precise and definitional.
- Know what each FIPS standardizes and why it is binding on federal agencies.
- Understand how FIPS-driven categorization and minimum requirements feed the rest of the framework.
- Expect recognition-style questions: which standard addresses which problem.
Domain 3: NIST Control Families (21%)
This is where the 18 topic areas live. Tied for the largest weight, it rewards breadth.
- Be able to place a described control or scenario in the correct family.
- Think "what would I examine, interview or test?" for each family, such as audit logging under Audit and Accountability.
- Distinguish look-alike families, for example Contingency Planning versus Incident Response, or Maintenance versus Configuration Management.
Domain 4: Governmental Laws and Regulations (17%)
Auditors are accountable to the legal framework that makes the controls mandatory in the first place.
- Know which federal laws and regulations drive security requirements and what each one requires.
- Be able to connect a statute to the oversight or reporting obligation it creates.
- Remember that FITSI's Federal Body of Knowledge Guide (v2.2, 2021) sets the broad source boundary; it is a boundary, not a reading assignment for every document listed.
Domain 5: NIST Risk Management Framework (20%)
RMF is the process backbone, and the Assess and Authorize steps sit squarely in an auditor's territory.
- Know the RMF steps in order and the outputs each step produces.
- Understand the role of assessment findings in the authorization decision.
- Be ready for scenario questions asking what happens next, or which artifact is missing.
Domain 6: NIST Interagency Reports (8%)
The smallest slice, but easy points if you have at least seen the major reports.
- Learn what the commonly referenced NISTIRs cover at a high level.
- Prioritize recognition over memorizing details.
Because the issuer's public source list was last dated 2021, don't assume newer NIST revisions have automatically changed the exam syllabus. Study the materials FITSI points you to, and cross-check against the domains guide for how to prioritize.
Test-Day Rules That Trip People Up
- Remote proctoring: You use your own computer plus a separate phone or tablet for monitoring. The Candidate Handbook (v3.7) describes the Assess.ai platform, WebLock and Zoom.
- Identification: Two signed IDs, at least one with a photo.
- Check-in: Begin 30 minutes before your start time.
- Closed book: Reference materials, papers and calculators must be put away. Only the platform's digital Notepad is allowed.
- Monitoring is continuous for the entire session.
- No scheduled breaks. A necessary bathroom break does not pause or extend the three-hour clock.
The Money Sheet: Fees at a Glance
| Item | Amount (USD) |
|---|---|
| Initial examination | $395 |
| Eligible same-role retest | $197.50 |
| Rescheduling | $100 |
| Annual maintenance | $75 |
| Incomplete-application processing | $25 |
| Associate membership (separate, optional) | $75 |
Key rules: membership is not required to sit the exam, and no separate member/nonmember exam price is published. The discounted retest is allowed once after a failed attempt, after a 21-calendar-day wait and within one year of the initial exam; outside that allowance, the initial rate applies.
Training is separate and optional. FITSI's own Training Program Handbook explicitly describes FITSP training as optional. A dated example: a September 22-24, 2026 FITSI Authorized Training bundle advertised US$1,495 for members or US$1,695 for nonmembers, including a US$395 Auditor exam voucher valid one year. Treat that as a historical bundle example, not a standalone exam price and not proof of a future class. The full breakdown is in the certification cost guide.
After You Pass: Experience, Endorsements, Award
The most common misunderstanding about this credential is that passing the exam makes you certified. It doesn't. Passing the exam and being awarded the certification are separate steps.
- Pass the exam. You get an immediate pass/fail, then an emailed score report in three to five business days.
- Submit the complete application with a current resume/CV and two professional third-party endorsements verifying your experience, and agree to the FITSI Code of Ethics.
- Experience is assessed. FITSI describes a decision process of up to 60 days for a complete submission.
- Mind the clock: You have five years after passing to submit the application and supporting documents.
Experience requirement math
The baseline is five years of information-security experience in federal or civilian employment. Waivers can reduce it:
- One year waived for an accredited bachelor's degree in any discipline.
- A second year for an accredited IT or information-assurance master's degree.
- One further year for holding one or more listed complementary security certifications.
- No more than three years may be waived in total.
FITSI's published examples of qualifying certifications include CASP+, CySA+, Security+, CEH, GIAC, CISM, CISA, CISSP, CAP and SSCP. A compulsory degree or minimum training-hour total was not verified. The current Candidate Handbook and Requirements page cite a 17-page application, while an older scheme document says 15; use the current application. Details are in the requirements guide.
Renewal Sheet: Three Years, 60 CPEs
Under the current Certification Holder Handbook (v2.5), the cycle is three years. You must earn and report 60 CPE credits per held certification in each cycle (or retake the applicable exam at the end), pay annual fees and stay in compliance with the Code of Ethics.
- CPE activities must be relevant to your held role and domains, supported by records and reported through FITSI's portal.
- At least 30% of credits must come from structured education or training.
- No more than 50% may come from self-directed reading or independent study.
- Do not infer a separate 20-CPE annual minimum from the current 60-per-three-years rule.
Key Takeaway
Plan your CPE mix from day one: with a 30% floor for structured training and a 50% cap on self-study, you cannot satisfy the 60-credit requirement by reading alone.
A Weighted Review Plan
If you want one short, weight-driven plan rather than generic advice, allocate time to match the blueprint. A compact four-block sequence:
Control Families first (21%)
- Walk all 18 topic areas, noting what an assessor would examine, interview and test in each.
RMF and Special Publications (20% + 21%)
- Learn the RMF steps and outputs, then map SPs to the step each supports.
Laws and FIPS (17% + 13%)
- Pair each statute or standard with the obligation it creates.
NISTIRs, then timed practice (8%)
- Skim the reports, then sit a full-length practice session in three-hour, no-break conditions.
The study order mirrors the weights, so your effort lands where the points are. For a fuller schedule and resource-vetting advice, see the study guide.
Stale Facts to Ignore
Older and lower-quality web pages mix up details. Discard these:
- Six-year renewal cycles, mandatory retests, 20 CPEs per year and a US$45 annual fee: these predate the June 1, 2024 changes. The current standards are the three-year cycle, 60 CPEs and the US$75 annual maintenance fee.
- Wrong issuer names: one commercial landing page used an incorrect issuer acronym. The issuer is FITSI, the Federal IT Security Institute.
- Quoted pass rates and salary figures: no official Auditor pass rate or credential-specific salary dataset has been established. Treat precise numbers from unsourced pages with suspicion.
- Old courseware: a book labeled "Revision 2.0" with a 2020 copyright is not the current exam version and doesn't establish alignment with the June 2024 weights.
- User-upload "actual exam" dumps: marketplace listings claiming complete or verified exam content lack issuer confirmation, and a sampled "NG" preview discussed generic financial statements rather than federal IT security.
Before buying any prep material, check the role label (Auditor, not another FITSP role), the NG version and the publication date. If you're weighing the investment, the ROI analysis and salary guide explain what can and cannot be claimed.
FAQ
The exam has 150 multiple-choice questions: 120 scored and 30 unscored beta items, with a three-hour time limit. You cannot tell which items are beta.
NIST Special Publications and NIST Control Families tie at 21% each. NIST Risk Management Framework follows at 20%, then Governmental Laws and Regulations at 17%, NIST FIPS at 13% and NIST Interagency Reports at 8%.
No. After passing, you must submit a complete application, a current resume/CV and two professional third-party endorsements verifying your experience, and agree to the Code of Ethics. Certification is awarded after FITSI assesses that evidence.
The initial exam is US$395. One discounted same-role retest at US$197.50 is allowed after a 21-calendar-day wait and within one year of the initial exam. Rescheduling is US$100. Training and courseware are separate optional costs.
It runs on a three-year cycle. Earn and report 60 CPE credits (or retake the exam), pay the US$75 annual maintenance fee and comply with the Code of Ethics. At least 30% of CPEs must be structured education, and no more than 50% may be self-directed study.