FITSP-Auditor Requirements 2026: Eligibility, Prerequisites & How to Qualify

The Requirements at a Glance

The FITSP-Auditor credential, also written FITSP-A and issued to new candidates today in its Next Generation form (FITSP-Auditor-NG), is administered by the Federal IT Security Institute (FITSI). Its requirements are unusual among security certifications because they are split into two separate gates: an examination and a certification application built on documented professional experience. Many candidates assume that a passing score is the finish line. For this credential, it is the midpoint.

Here is the whole picture in one table, drawn from FITSI's published handbooks and requirements page:

If you want the broader orientation first, our explainers on what FITSP-Auditor is and the FITSP-Auditor certification cover the credential's purpose and lineage. This article focuses squarely on who qualifies and how.

Two Gates: Passing the Exam vs. Earning the Certificate

The most important structural fact about FITSP-Auditor requirements is that examination success and certification award are different events. FITSI's process works like this:

1. Register for and pass the Auditor examination. You can sit the exam before your experience paperwork is assembled.
2. Submit your application after passing. This includes the complete application, a current resume or CV, and two professional third-party endorsements verifying your experience.
3. Agree to the FITSI Code of Ethics.
4. Wait for the assessment decision. FITSI describes a process of up to 60 days for a complete submission.

Candidates have five years after passing to submit the application and supporting documents. That is a generous runway, but it is not a reason to delay: endorsers change jobs, resumes go stale, and the knowledge you used to pass fades. Most candidates will want to begin collecting endorsements while the exam is still fresh.

One practical wrinkle: the current Candidate Handbook and the FITSP Requirements page both describe a 17-page application, while an older scheme document refers to 15 pages. Use the current application you download from FITSI rather than treating the older page count as controlling.

The Five-Year Experience Rule and How Waivers Work

The core prerequisite is five years of information-security experience in federal or civilian employment. FITSI then allows that requirement to be reduced through three separate waivers, capped at a combined three years:

The arithmetic is simple but the ceiling is firm: no more than three years may be waived in total. That means the minimum documented hands-on experience is two years, even for a candidate with a bachelor's, a qualifying master's and a listed certification.

Three Candidate Profiles

To make the waiver rules concrete, here are three illustrative profiles built only from the published rules. They are examples of how the arithmetic works, not FITSI case determinations.

A subtle point for degree holders: a bachelor's in an unrelated discipline still earns the first waived year, which makes the credential more reachable for career-changers who entered security from other fields. But the master's waiver specifically requires an IT or information-assurance focus, so a general business master's would not carry the same benefit under the published language.

If you are weighing whether the investment is worthwhile once you qualify, see our analysis in Is the FITSP-Auditor Certification Worth It?, and for the career angle, FITSP-Auditor jobs.

Registering for the Exam: Format, ID and Environment

FITSI administers and proctors the examination itself; no third-party testing vendor such as Pearson VUE, PSI or Prometric was identified in the issuer materials. The registration page describes two delivery formats, but it explicitly labels in-person testing as "Currently Not Offered," so remote proctoring is the practical route today. The older in-person procedures in the handbook should not be read as evidence of available appointments.

The Remote-Proctored Setup

• Equipment: your own computer plus a separate phone or tablet used for monitoring.
• Software: the Candidate Handbook describes Assess.ai, WebLock and Zoom.
• Identification: two signed IDs, at least one of which must be a photo ID.
• Check-in: begin 30 minutes before your scheduled start.
• Closed book: reference materials, papers and calculators must be put away; the platform's digital Notepad is allowed.
• Monitoring: continues throughout the session.
• Breaks: none are scheduled, and necessary bathroom breaks do not pause or extend the three-hour clock.

Results appear immediately as pass or fail, followed by an emailed score report within three to five business days. For scheduling specifics and testing windows, see FITSP-Auditor exam dates; note that 2020-era quarterly appointment pages do not establish current availability.

What the Exam Will Ask of You

Qualifying on paper only matters if you can pass the test, and the Auditor exam is built around six official domains with Auditor-specific weights effective June 1, 2024. These are examination domains, not preparation headings, and they sum to 100%:

Two domains tie for the largest share at 21%: NIST Special Publications and NIST Control Families. The RMF follows closely at 20%. Together those three account for 62% of the exam.

The Auditor role's task statements, found in FITSI's Auditor Competence Breakdown, emphasize assessing and verifying controls rather than designing or operating them. That orientation shapes how questions are framed: expect scenarios about evidence, assessment procedures and compliance with federal requirements rather than hands-on configuration. For a full walkthrough of each content area, read our complete guide to the six FITSP-Auditor exam domains.

The exam is also deliberately broad. FITSI's Federal Body of Knowledge Guide establishes the federal source boundary across all four FITSP roles, but it is not an instruction to read every listed publication, and its publication list is dated, so it should not be treated as a current 2026 inventory of laws or standards. Candidates who want a realistic sense of difficulty can consult how hard the FITSP-Auditor exam is.

Fees That Touch Your Qualification Path

The published fee schedule is straightforward, and notably FITSI does not require membership or publish separate member and nonmember exam prices. The costs that bear on qualifying are:

The discounted retest has conditions: it applies once after a failed exam, only after a 21-calendar-day wait, and only within one year of the initial examination. Outside that allowance, the initial rate applies. The US$25 incomplete-application fee is a quiet reminder of why a complete package matters: submitting an application missing endorsements or resume details costs money and time.

Training and courseware are priced separately and are entirely optional. As a dated example only, FITSI listed a September 22-24, 2026 authorized review course bundle at US$1,495 for members or US$1,695 for nonmembers, including a US$395 exam voucher valid for one year. That is a bundle illustration, not a standalone exam fee, and not evidence of an upcoming class. For the full picture, including budgeting for maintenance, see FITSP-Auditor certification cost, and for training options, FITSP-Auditor training.

Building the Application Package

Because the experience assessment happens after the exam, your application package is where qualification is actually proven. Prepare these components:

1. The complete application. Download the current version from FITSI; it runs 17 pages in the current handbook and requirements page.
2. A current resume or CV. Make it map to the experience claims in the application. Describe security responsibilities in terms of assessment, authorization, control evaluation and compliance where they genuinely applied.
3. Two professional third-party endorsements. These must verify your experience. "Third-party" signals that the endorsers should be professionals who can credibly attest to your work, rather than people with a personal stake in your application.
4. Agreement to the FITSI Code of Ethics.
5. Evidence for any waivers. If you are claiming a degree or certification waiver, have transcripts or certificates ready.

Employers that hire for this credential are generally in the federal and federal-contractor space, where assessing systems against NIST-based requirements is a daily activity. If your experience is mostly in that environment, your endorsements and resume will likely align naturally with what FITSI wants to see.

Sequencing Your Preparation Around the Domains

Since you can take the exam before assembling paperwork, many candidates run both tracks in parallel. A domain-weighted sequence tied to the official percentages keeps effort proportional to exam value. This is one possible plan, not an issuer-prescribed schedule:

Our FITSP-Auditor study guide expands on this approach, and the one-page FITSP-Auditor cheat sheet is useful for last-week review. When you are ready to test yourself against realistic questions, try our FITSP-Auditor practice tests.

After You Qualify: Three-Year Maintenance

Qualifying is not the end of the requirements. The current NG certificate is valid for three years. During each cycle you must earn and report 60 CPE credits per held certification, or retake the applicable examination at the end of the cycle, while keeping annual fees current and complying with the Code of Ethics.

• CPE activities must be relevant to the held role and its domains, supported by records and reported through FITSI's portal.
• At least 30% of credits must come from structured education or training.
• No more than 50% may come from self-directed reading or independent study.
• Annual maintenance is US$75.

Qualification Paths Compared: FITSP-Auditor and CISA

Candidates often ask how FITSP-Auditor compares with ISACA's Certified Information Systems Auditor (CISA), the credential, not the federal agency. They are issued by different bodies and serve different emphases. FITSP-Auditor centers on federal security auditing grounded in NIST publications, FIPS, the RMF and governmental laws, while CISA is a broader information systems audit credential from ISACA. Consult ISACA's own credential page for CISA's current experience and exam terms rather than assuming parity with FITSI's rules.

The two are not mutually exclusive: FITSI explicitly lists CISA among the complementary certifications that can earn the one-year experience waiver, so holding CISA can shorten your FITSP-Auditor experience requirement.

Frequently Asked Questions