- The Short Answer: What the Passing Score Actually Is
- How FITSI Sets the Cut Score
- The Exam Behind the Number: Format and Scored Items
- What Your Result and Score Report Look Like
- Where Your Points Come From: The Six Weighted Domains
- Passing the Exam Is Not the Same as Being Certified
- Passing-Score Claims to Distrust
- If You Miss the Mark: Retest Rules and Costs
- Turning the Weights Into a Study Schedule
- Frequently Asked Questions
- FITSI has not publicly published a numerical FITSP-Auditor passing mark; the cut score comes from an Angoff study.
- The exam has 150 multiple-choice questions: 120 scored items and 30 unscored beta items, in three hours.
- NIST Special Publications and NIST Control Families each carry 21%, with the RMF domain at 20%.
- A failed first attempt qualifies for one US$197.50 retest after 21 calendar days, within one year.
The Short Answer: What the Passing Score Actually Is
Candidates searching for the FITSP-Auditor passing score usually want one number, such as a percentage or a scaled score. Here is the honest answer: a current numerical passing mark for the Auditor exam has not been publicly verified. The Federal IT Security Institute (FITSI), which administers the Federal IT Security Professional (FITSP) program, describes how the threshold is set, but the Auditor-specific figure does not appear in the public handbooks we reviewed.
That matters because many third-party pages state a confident percentage and present it as fact. If a number is not traceable to FITSI's own documents, treat it as unreliable. This article explains what is known, what is not, and how to prepare so that the exact threshold becomes far less important to you.
How FITSI Sets the Cut Score
FITSI's FITSP Certification Scheme Details Handbook (v1.6, effective June 1, 2024) explains that the Auditor exam uses an Angoff cut-score study. In an Angoff process, subject-matter experts review each question and estimate how a minimally competent candidate would perform on it. A psychometrician then aggregates those judgments into a recommended passing threshold, and FITSI's Scheme Committee approves it.
Several practical consequences follow from this method:
- The threshold reflects competence, not a curve. You are not graded against other candidates that month, so a strong or weak cohort does not move the bar.
- The cut score can change when the exam changes. FITSI revised the domain concentrations effective June 1, 2024, and a new cut-score study can accompany a new exam form or weighting.
- The bar is tied to the role. The scheme describes Auditor-specific content and weights, so a threshold quoted for another FITSP role should not be assumed to apply to Auditor.
Example result sheets exist in FITSI materials, but they do not establish this role's threshold. Do not reverse-engineer a number from a sample sheet.
The Exam Behind the Number: Format and Scored Items
Whatever the cut score is, it applies to a specific exam structure. Per the Scheme Details Handbook (printed page 11), the Auditor exam is:
| Feature | FITSP-Auditor Exam |
|---|---|
| Question type | Multiple choice |
| Total questions | 150 |
| Scored questions | 120 |
| Beta (unscored) questions | 30 |
| Time limit | Three hours |
| Delivery | Computer-based, English only |
| Adaptive testing | Not verified |
The 30 beta items are the detail most candidates overlook. You will not know which questions are unscored, so you must treat all 150 as if they count. Practically, a handful of strange or unusually obscure questions may be beta items being tested for future forms, so a few puzzling items should not rattle you. Because only 120 items determine your result, every scored question carries real weight, and there is little room to write off an entire domain.
Pacing is simple arithmetic. Three hours for 150 questions leaves roughly 72 seconds per question, and there are no scheduled breaks. Necessary bathroom breaks do not pause or extend the clock. For a deeper look at the experience of sitting the exam, see How Hard Is the FITSP-Auditor Exam? Complete Difficulty Guide 2026.
What Your Result and Score Report Look Like
FITSI administers and proctors the examination itself; no Pearson VUE, PSI or Prometric provider was identified. According to the FITSP Remote-Proctored Testing page and Candidate Handbook v3.7, candidates test remotely on their own computer, with a separate phone or tablet for monitoring. The process uses Assess.ai, WebLock and Zoom, requires two signed IDs (one with a photo), and asks you to check in 30 minutes early. The exam is closed book, though the platform's digital Notepad is permitted. FITSI's registration page labels in-person testing "Currently Not Offered."
- Immediate result: you receive a pass or fail outcome when you finish.
- Emailed score report: follows in three to five business days.
Because the numerical threshold is not published, do not expect the pass/fail screen to be the place where you learn it. Plan on using the emailed score report to understand your performance, especially if you need to retest.
Where Your Points Come From: The Six Weighted Domains
Since you cannot target a published percentage, the smarter move is to target the blueprint. FITSI's Auditor-specific weighting, effective June 1, 2024 per Candidate Handbook v3.7, distributes the exam as follows:
| Domain | Weight |
|---|---|
| NIST Special Publications (SPs) | 21% |
| NIST Federal Information Processing Standards (FIPS) | 13% |
| NIST Control Families (CFs) | 21% |
| Governmental Laws and Regulations | 17% |
| NIST Risk Management Framework (RMF) | 20% |
| NIST Interagency Reports (NISTIRs) | 8% |
These are official examination domains with role-specific weights, not editorial study categories. Three of them (SPs, Control Families and RMF) together account for 62% of the exam. Full domain-by-domain coverage is in FITSP-Auditor Exam Domains 2026: Complete Guide to All 6 Content Areas.
NIST Special Publications (21%) and NIST Control Families (21%)
These two domains tie for the largest share. For an Auditor, the emphasis is on assessing whether controls are implemented and effective, not on designing them.
- Know which NIST publications govern assessment, security controls and risk, and what each is used for.
- Be fluent across the control topic areas, including Access Control, Audit and Accountability, Configuration Management, Incident Response, and Security Assessment and Authorization.
- Practice recognizing what evidence would demonstrate that a given control is working.
NIST Risk Management Framework (20%)
The RMF domain is the lifecycle backbone of federal system authorization. Auditors need to understand each step, who performs it, and what artifacts result.
- Trace how categorization, control selection, implementation, assessment, authorization and monitoring connect.
- Understand where the assessor's work sits in that lifecycle.
Governmental Laws and Regulations (17%)
This domain rewards candidates who can connect a statute or policy to its security purpose. Study what each requires and which agencies or roles it affects, rather than memorizing citations in isolation.
FIPS (13%) and NISTIRs (8%)
These are the smaller domains, but they still contribute scored items. FIPS questions tend to reward precise recall of what each standard mandates, while NISTIR questions lean on awareness of what the interagency reports address. Do not skip them; at 21% of the exam combined, they can swing a close result.
A subtle point: FITSI also describes 18 intersecting IT security topic areas, such as Awareness and Training, Contingency Planning and Media Protection. These are not 18 extra exam domains. They cut across the six domains. The Candidate Handbook also refers to both 20 and 18 control families in adjacent sentences, an inconsistency in the source, so rely on the six-domain structure for planning.
Passing the Exam Is Not the Same as Being Certified
A common misunderstanding is that the passing score is the last gate. It is not. Passing the exam alone does not award the FITSP-Auditor credential. FITSI separately assesses your experience after the exam.
- Meet the experience requirement: five years of information-security experience in federal or civilian employment. Waivers can reduce this: one year for an accredited bachelor's degree in any discipline, a second year for an accredited IT or information-assurance master's degree, and one further year for holding listed complementary security certifications, with no more than three years waived in total. FITSI's examples of listed certifications include Security+, CISSP, CISM, CISA and others.
- Submit the application: the complete application, a current resume or CV, and two professional third-party endorsements verifying your experience.
- Agree to the FITSI Code of Ethics.
- Wait for the decision: FITSI describes an assessment process of up to 60 days for a complete submission.
You have five years after passing to submit your application and supporting documents. See FITSP-Auditor Requirements 2026: Eligibility, Prerequisites & How to Qualify for the full eligibility picture. And once certified, the credential is valid for three years, requiring 60 CPE credits per held certification in each cycle (or a retake), plus annual fees.
Passing-Score Claims to Distrust
The gap left by FITSI's non-disclosure of a numerical threshold is filled by marketplace content of uneven quality. When you evaluate any claim about the passing score, apply these filters:
- Check the issuer name. At least one exact-keyword prep landing page we reviewed misnames the issuer, which is a strong signal that its other numbers (passing rate, fees, prerequisites) were not drawn from FITSI's documents.
- Compare against the 150/120/30 structure. A claimed cut score that implies a different question count or ignores unscored beta items was not written about this exam.
- Beware of user-uploaded "complete answers" documents. Marketplace listings claiming actual or verified exam content lack issuer confirmation, and one sampled preview of an "Auditor-NG practice exam" discussed generic financial statements, not federal IT security objectives.
- Watch for the wrong credential. The acronym is shared by other credentials. Any figure that does not trace to FITSI's own FITSP-Auditor materials may describe something else entirely.
- Check dates and versions. A study book labeled Next Generation but dated 2020 predates the June 2024 weight changes and may not match the current blueprint.
The same caution applies to candidate pass-rate claims: no official FITSP-Auditor pass-rate figure has been established. Our write-up in FITSP-Auditor Pass Rate 2026: What the Data Shows covers what can and cannot be said.
Key Takeaway
If a source gives you a precise FITSP-Auditor passing percentage without citing a FITSI document, version and date, do not build your study plan around it. Plan against the six official domain weights instead.
If You Miss the Mark: Retest Rules and Costs
Because the threshold is undisclosed, it is worth understanding the downside scenario. Per FITSI's Fee Schedule and Candidate Handbook v3.7:
| Item | Amount or Rule |
|---|---|
| Initial examination | US$395 |
| Eligible same-role retest | US$197.50 |
| Rescheduling | US$100 |
| Annual maintenance | US$75 |
| Incomplete-application processing | US$25 |
The discounted retest is available once after a failed exam, only after a 21-calendar-day wait and within one year of the initial examination. Outside that allowance, the initial rate applies. Membership is not required, and no separate member or nonmember exam price is published. Training and courseware are charged separately. A historical example course bundle, advertised at US$1,495 for members or US$1,695 for nonmembers, included a US$395 exam voucher, but it was a dated bundle and not a standalone exam fee. Full pricing detail is in FITSP-Auditor Certification Cost 2026: Complete Pricing Breakdown.
The mandatory 21-day gap is useful if you fail: use your emailed score report to see where you were weakest, then spend those three weeks on those domains specifically.
Turning the Weights Into a Study Schedule
Since your real lever is domain coverage, here is one way to sequence study time in proportion to the blueprint. It is a template, so adjust it to your background; auditors with strong RMF experience may compress Week 3, for example.
NIST Special Publications (21%)
- Build a one-line purpose summary for each publication on the FITSI source list.
- Note which publications address assessment versus implementation.
NIST Control Families (21%)
- Work through the control topic areas one at a time.
- For each, write what an auditor would examine as evidence.
NIST Risk Management Framework (20%)
- Map each RMF step to its inputs, outputs and responsible roles.
- Connect the assessment step to the earlier control work.
Laws and Regulations (17%)
- Pair each law or policy with its security purpose and who it applies to.
FIPS (13%) and NISTIRs (8%)
- Review the smaller domains, then take timed mixed sets to practice the roughly 72-second pace.
Why this order? The two 21% domains and the 20% RMF domain make up the bulk of scored items, and the control and RMF material reinforces itself. The full approach, including source-tracing advice, is in FITSP-Auditor Study Guide 2026: How to Pass on Your First Attempt. When you are ready to test yourself against realistic multiple-choice items, try the FITSP-Auditor practice test and review any domain where your results lag.
The main practice test site is built around the six official domains, so you can drill the heavy domains first and then widen out.
Frequently Asked Questions
A current numerical Auditor passing mark has not been publicly verified. FITSI describes using an Angoff cut-score study with psychometrician and subject-matter-expert input, approved by its Scheme Committee, but the specific figure is not published in the handbooks reviewed.
The exam has 150 multiple-choice questions in three hours. Of these, 120 are scored and 30 are unscored beta items. You will not be told which are which, so treat every question as if it counts.
You receive an immediate pass or fail result at the end of the exam. A score report follows by email in three to five business days.
No. After passing, you must submit a complete application, a current resume or CV, and two professional third-party endorsements, and agree to the Code of Ethics. FITSI assesses your experience evidence for certification award, with a decision process of up to 60 days for a complete submission.
You may take one discounted retest at US$197.50 after waiting 21 calendar days, provided it falls within one year of your initial exam. After that allowance, the initial US$395 rate applies. For context on exam difficulty, see our difficulty guide, and for the bigger picture on value, Is the FITSP-Auditor Certification Worth It? Complete ROI Analysis 2026.