- How the FITSP-Auditor Blueprint Is Built
- The Six Domains and Their Weights
- Domain 1: NIST Special Publications (21%)
- Domain 2: NIST FIPS (13%)
- Domain 3: NIST Control Families (21%)
- Domain 4: Governmental Laws and Regulations (17%)
- Domain 5: NIST Risk Management Framework (20%)
- Domain 6: NIST Interagency Reports (8%)
- Six Domains vs. 18 Topic Areas
- Exam Format and Registration Mechanics
- Sequencing Your Study by Domain
- After the Exam: Experience Evidence and Certification
- Frequently Asked Questions
- The FITSP-Auditor exam has six official domains; NIST Special Publications and NIST Control Families each carry 21%.
- The NIST Risk Management Framework is the third-heaviest domain at 20%; NISTIRs are the lightest at 8%.
- The weights come from FITSI's Auditor-specific row effective June 1, 2024, not from other FITSP roles.
- The exam has 150 multiple-choice questions (120 scored, 30 beta) in three hours, closed book.
How the FITSP-Auditor Blueprint Is Built
The Federal IT Security Institute (FITSI) administers the Federal IT Security Professional program, and the Auditor exam is one of its role-based examinations. The version issued to new candidates is branded FITSP-Auditor-NG, the Next Generation lineage FITSI introduced in 2020. If you are new to the credential itself, start with What Is FITSP-Auditor? and then come back here for the blueprint.
The first thing to understand is that this blueprint is unlike most security exams. Many certifications organize themselves around job tasks such as "security operations" or "asset security." The FITSP-Auditor blueprint is organized around bodies of federal source material: NIST Special Publications, Federal Information Processing Standards, NIST control families, governmental laws and regulations, the Risk Management Framework, and NIST Interagency Reports. You are being tested on whether you can audit a federal system against those authoritative sources, so the domains mirror the sources.
Two details matter for how you read the official numbers. First, the six domain names and the Auditor-specific weighting row are published in FITSI's Certification Candidate Handbook (v3.7, April 2026) and reflect the weighting change effective June 1, 2024. Second, the weights are exam weights for the Auditor role specifically. Other FITSP roles (Designer, Manager, Operator) use their own weighting rows, so a study resource that quotes a different split is describing a different exam, or an outdated one.
The Six Domains and Their Weights
| Domain | Name | Auditor Weight |
|---|---|---|
| 1 | NIST Special Publications (SPs) | 21% |
| 2 | NIST Federal Information Processing Standards (FIPS) | 13% |
| 3 | NIST Control Families (CFs) | 21% |
| 4 | Governmental Laws and Regulations | 17% |
| 5 | NIST Risk Management Framework (RMF) | 20% |
| 6 | NIST Interagency Reports (NISTIRs) | 8% |
The weights total 100%. Domains 1, 3 and 5 together account for 62% of the exam, which is the clearest signal about where preparation time pays off. Domain 6 is the smallest at 8%, but it is not safe to ignore: on a 120-question scored section, even a small domain can contribute a meaningful handful of items.
Domain 1: NIST Special Publications (21%)
NIST Special Publications (SPs)
Special Publications are NIST's guidance documents on how federal organizations should implement and assess security. For an auditor, the point is not memorizing document numbers in isolation; it is knowing which publication governs which activity, and what an assessor is expected to examine, interview and test.
- Which SPs govern security control selection, assessment procedures, system categorization, contingency planning, incident handling and continuous monitoring
- How assessment guidance frames evidence collection and the assessment objects an auditor works with
- How SPs relate to one another and to the FIPS and laws that make them binding or authoritative
Because this domain is the broadest, the FITSI Federal Body of Knowledge Guide (v2.2) is a useful orientation document. It establishes the federal source boundary across all four FITSP roles. It is a map of the territory, not an instruction to read every listed publication, and its publication list is dated, so do not assume it is a complete 2026 inventory. The Auditor-focused FITSP-Auditor study guide shows how to narrow that boundary into a workable reading plan.
Domain 2: NIST Federal Information Processing Standards (13%)
NIST FIPS
FIPS are mandatory standards for federal systems, in contrast to the advisory tone of many SPs. Questions in this domain tend to test whether you know what a standard requires and when it applies.
- The role of FIPS in system security categorization and in minimum security requirements
- Cryptographic standards and validation concepts relevant to federal systems
- How FIPS requirements connect to the controls and SP guidance you assess against
At 13%, this domain is compact, which makes it one of the more efficient places to gain points. The set of standards is small relative to the SP library, so focused, repeated review tends to pay off quickly.
Domain 3: NIST Control Families (21%)
NIST Control Families (CFs)
This domain tests your command of the security control families as an auditor uses them: what each family is meant to protect, what a well-implemented control looks like, and what evidence demonstrates it works.
- The purpose and scope of each family, from access control and audit and accountability through system and information integrity
- How to distinguish a control's intent from its implementation, and a policy from an operating practice
- Which evidence an auditor would request for a given control (documentation, configuration, logs, interviews)
- How controls are selected, tailored and inherited across systems
One source quirk is worth knowing. FITSI's Candidate Handbook refers to 20 control families in one sentence and 18 in an adjacent one. That inconsistency exists in the source itself, so do not be alarmed if you see both figures in different study materials; build your understanding from the control content and the issuer's own documents rather than from a single count.
Domain 4: Governmental Laws and Regulations (17%)
Governmental Laws and Regulations
Federal IT security exists because of statute and policy, and an auditor must be able to trace a requirement back to its legal authority. This domain tests whether you understand the legal and regulatory framework that gives NIST guidance its force.
- The major federal laws and policies governing information security, privacy and federal system oversight
- Roles and responsibilities assigned to agencies and officials under those authorities
- How legal mandates cascade into standards, guidance and audit expectations
Candidates from commercial backgrounds often underestimate this domain because it reads as "memorization," whereas technical candidates tend to over-invest in controls. At 17% it is larger than FIPS and nearly as large as the two top domains, so give it dedicated time. The strongest approach is to connect each law to the practical obligations it creates, not to memorize titles and dates in isolation.
Domain 5: NIST Risk Management Framework (20%)
NIST Risk Management Framework (RMF)
The RMF is the lifecycle that ties the rest of the exam together: categorize, select, implement, assess, authorize and monitor. As an auditor, your lens is assessment and authorization, but you need fluency across the whole cycle.
- The steps of the RMF and the artifacts produced at each stage
- How assessment findings feed authorization decisions and plans of action
- The relationships among system categorization, control selection and continuous monitoring
- The responsibilities of the roles involved in the authorization process
At 20%, the RMF is the third-largest domain, and it is also the one that most rewards genuine understanding over recall. Scenario-style questions often hinge on knowing where in the lifecycle a given activity belongs. If you have ever worked on an authorization package, you already have an advantage; if not, walking through the lifecycle with a concrete system in mind is the fastest way to build intuition.
Domain 6: NIST Interagency Reports (8%)
NIST Interagency Reports (NISTIRs)
NISTIRs capture research and technical findings, often on emerging topics or on the details behind other guidance. They are the lightest-weighted domain, but they reward candidates who know how this document type differs from SPs and FIPS.
- What a NISTIR is, and where it sits relative to SPs and FIPS in the NIST publication hierarchy
- Which security topics are addressed in the NISTIRs relevant to federal auditing
Six Domains vs. 18 Topic Areas
Candidates frequently confuse the exam's six domains with the 18 IT security topic areas that FITSI also publishes. They are different things. The six domains define how the exam is weighted; the 18 topic areas are subject matter that cuts across the domains. FITSI's FITSP Domains page lists them: Access Control; Audit and Accountability; Awareness and Training; Configuration Management; Contingency Planning; Identification and Authentication; Incident Response; Maintenance; Media Protection; Personnel Security; Physical and Environmental Protection; Planning; Program Management; Risk Assessment; Security Assessment and Authorization; System and Communications Protection; System and Information Integrity; and System and Services Acquisition.
Think of it as a grid. A question about, say, Incident Response might be asked through the lens of a Special Publication, a control family, a federal law or the RMF. The topic area tells you the subject; the domain tells you which authoritative source family the question draws from. These topics are not 18 additional examination domains, and no weighting is published for them.
If you want to see how this plays out in practice, the FITSP-Auditor cheat sheet condenses the structure into a one-page review.
Exam Format and Registration Mechanics
Knowing the domains is only half the picture; the delivery format shapes how you prepare. Per FITSI's Certification Scheme Details Handbook (v1.6, effective June 1, 2024), the Auditor exam consists of 150 multiple-choice questions, of which 120 are scored and 30 are beta items, with a three-hour time limit. You will not know which items are the unscored betas, so treat every question as if it counts. The exam is computer-based and English only.
- Proctoring: FITSI administers and proctors the exam itself. Its registration page labels in-person testing as currently not offered, so plan on the remote-proctored route.
- Setup: You use your own computer plus a separate phone or tablet for monitoring. The Candidate Handbook describes Assess.ai, WebLock and Zoom, and requires two signed IDs including one photo ID, with check-in 30 minutes early.
- Closed book: Reference materials, papers and calculators must be put away. The platform's digital notepad is permitted, and monitoring continues throughout.
- No scheduled breaks: Necessary bathroom breaks do not pause or extend the three-hour clock.
- Results: You receive an immediate pass/fail result, followed by an emailed score report in three to five business days.
On cost, FITSI's fee schedule lists an initial Auditor examination fee of US$395, with an eligible same-role retest at US$197.50 and rescheduling at US$100. Membership is not required. The discounted retest is available once, after a 21-calendar-day wait and within one year of the initial exam. Optional training and courseware are priced separately; the full picture is in the FITSP-Auditor certification cost breakdown.
FITSI describes a Angoff cut-score study with psychometrician and subject-matter-expert input for setting the pass standard, but a current numerical Auditor passing mark was not publicly verified. For what is and is not known, see the FITSP-Auditor passing score article. For availability, see exam dates and scheduling.
Sequencing Your Study by Domain
You do not need a generic schedule; you need one tied to how these domains depend on each other. The logic below follows that dependency chain, and you can stretch or compress it to fit your timeline.
Laws, then the RMF skeleton
- Start with Governmental Laws and Regulations (17%) so you know why the guidance exists
- Map the RMF lifecycle (20%) and note the artifacts each step produces
The two 21% domains together
- Work through the control families (21%) alongside the SPs that define and assess them (21%)
- For each family, write down the evidence an auditor would request
FIPS and NISTIRs
- Cover the FIPS (13%) as a compact, standards-focused block
- Add a short NISTIR review (8%) and practice distinguishing publication types
Mixed practice under timing
- Run timed sets that mix all six domains, since the real exam does not group questions by domain
- Review misses by domain to decide where to spend the remaining time
Practice questions that mirror the federal audit context are the highest-value activity in the last phase. You can drill domain by domain on the FITSP-Auditor practice test platform and use timed mixed sets to build pacing. The exam gives you three hours for 150 questions, so the pace is comfortable on paper, but scenario items reward careful reading. For a candid view of difficulty, see how hard the FITSP-Auditor exam is.
Key Takeaway
Build your plan around the weights: roughly three-fifths of the exam sits in SPs, Control Families and the RMF. Give those the most hours, cover Laws deliberately, and treat FIPS and NISTIRs as efficient, bounded reviews.
After the Exam: Experience Evidence and Certification
Passing the exam does not by itself award the credential. FITSI assesses experience evidence after you pass. The baseline requirement is five years of information-security experience in federal or civilian employment, with up to three years waivable in total: one for an accredited bachelor's degree in any discipline, a second for an accredited IT or information-assurance master's degree, and one more for holding one or more listed complementary security certifications (FITSI's published examples include CISA, CISSP, CISM, Security+ and others).
After passing you submit a complete application, a current resume or CV and two professional third-party endorsements verifying your experience, and you agree to the FITSI Code of Ethics. You have five years after passing to submit these, and FITSI describes an assessment process of up to 60 days for a complete submission. The details are covered in FITSP-Auditor requirements and eligibility.
Once certified, the credential is valid for three years. You earn and report 60 CPE credits during each cycle (or retake the applicable exam), pay the annual maintenance fee of US$75 and stay in compliance with the Code of Ethics. At least 30% of CPE credits must come from structured education or training, and no more than 50% from self-directed reading. If you are weighing whether the investment makes sense for your career, read whether the FITSP-Auditor certification is worth it.
Frequently Asked Questions
Six: NIST Special Publications (21%), NIST FIPS (13%), NIST Control Families (21%), Governmental Laws and Regulations (17%), the NIST Risk Management Framework (20%) and NIST Interagency Reports (8%). The weights total 100% and reflect FITSI's Auditor-specific row effective June 1, 2024.
No. The 18 topic areas, such as Access Control and Incident Response, are subject matter that intersects the six domains. They are not additional domains and carry no separate weighting.
NIST Special Publications and NIST Control Families are tied for the largest weight at 21% each, followed by the Risk Management Framework at 20%. Together they make up 62% of the exam, so they merit the most study time.
No. The weights described here are the Auditor-specific row. The Designer, Manager and Operator exams use their own weighting, so do not apply figures from those roles to your preparation.
Yes, you get an immediate pass or fail result at the end of the three-hour session, followed by an emailed score report in three to five business days. Passing the exam is one step; certification is awarded only after FITSI assesses your experience evidence and application.