- What You Are Actually Studying
- Exam Mechanics: Format, Fees and Remote Proctoring
- The Six Domains and Where the Points Are
- Domain-by-Domain Priorities
- Six Domains vs. 18 Topic Areas
- A Study Sequence Built Around the Weights
- Vetting Study Materials Before You Buy
- After You Pass: Experience, Endorsements and Award
- Frequently Asked Questions
- The exam has 150 multiple-choice questions (120 scored, 30 beta) and a strict three-hour limit with no scheduled breaks.
- NIST Special Publications and NIST Control Families each carry 21%, with the Risk Management Framework close behind at 20%.
- Initial exam fee is US$395; an eligible same-role retest is US$197.50 after a 21-calendar-day wait.
- Passing the exam does not award the credential; experience evidence and two endorsements are assessed afterward.
What You Are Actually Studying
The FITSP-Auditor credential is issued by the Federal IT Security Institute (FITSI) under its Federal IT Security Professional program. The version issued to new candidates is the Next Generation edition, often written FITSP-Auditor-NG, which FITSI introduced in 2020. If you want the background on the credential itself, start with What Is FITSP-Auditor? and What Does FITSP-Auditor Stand For?; this guide assumes you have already decided to sit the exam and need a plan.
The first thing to grasp is that this is a federal security body-of-knowledge exam, not a general audit or generic cybersecurity exam. Questions are drawn from the NIST publication universe, the federal statutes and regulations that govern agency information security, and the assessment-oriented tasks an auditor performs against those sources. Candidates who treat it like a broad vendor-neutral security test tend to underinvest in the one thing that matters most: knowing what specific NIST documents say and how they relate to each other.
FITSI publishes a FITSP-Auditor Certification Competence Breakdown (v3.0) listing the tasks, knowledge and skills for the role. Download it from FITSI's document index and read it first. One caution: the PDF's file metadata mislabels itself as Manager exam objectives, but the cover, contents and task statements are Auditor-specific. Do not let that metadata steer you toward other roles' material.
Exam Mechanics: Format, Fees and Remote Proctoring
Format and timing
The Auditor examination is computer-based, English only, and made up of 150 multiple-choice questions. Of those, 120 are scored and 30 are beta items used by FITSI to evaluate future questions; you will not be told which is which, so treat every question as if it counts. You have three hours in total. That works out to roughly 72 seconds per question across the full set, which is tight for scenario-style items that require you to recall a specific publication's requirements.
Remote proctoring, not a test center
FITSI administers and proctors the exam itself; no third-party test-center network is involved. The registration page still carries pandemic-era wording, but in-person testing is labeled "Currently Not Offered," so plan for remote delivery. Under the Candidate Handbook v3.7 process, you use your own computer plus a separate phone or tablet for monitoring, with Assess.ai, WebLock and Zoom in the workflow. Bring two signed IDs, at least one with a photo, and check in 30 minutes early.
What it costs
| Item | Fee (US$) |
|---|---|
| Initial examination | 395 |
| Eligible same-role retest | 197.50 |
| Rescheduling | 100 |
| Annual maintenance | 75 |
| Incomplete-application processing | 25 |
FITSI membership is not required, and there is no separate member or nonmember exam price. The discounted retest is available once after a failed attempt, after a 21-calendar-day wait and within one year of the initial exam; outside that allowance the initial rate applies. Training and courseware are billed separately. For the full breakdown, see FITSP-Auditor Certification Cost 2026, and for scheduling logistics see FITSP-Auditor Exam Dates 2026.
The Six Domains and Where the Points Are
FITSI's role-specific weighting for the Auditor, effective June 1, 2024, is the single most useful planning document you have. These are the official examination domains, not preparation-curriculum headings:
| Domain | Weight |
|---|---|
| Domain 1: NIST Special Publications (SPs) | 21% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 3: NIST Control Families (CFs) | 21% |
| Domain 4: Governmental Laws and Regulations | 17% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 8% |
Three domains (SPs, Control Families and RMF) together account for 62% of the exam. Add Governmental Laws and Regulations and you reach 79%. That means FIPS and NISTIRs, though not ignorable, are the places where you can afford a lighter, more targeted pass. For a deeper read on each area, see FITSP-Auditor Exam Domains 2026.
Domain-by-Domain Priorities
Domain 1: NIST Special Publications (21%)
This is where memorizing titles pays off. You need to know which SP addresses which problem, and in an audit context, which publication you would cite as the basis for an assessment procedure.
- Map each major SP to its purpose: control catalogs, assessment procedures, categorization guidance, contingency planning, incident handling, and so on.
- Know the difference between guidance that tells you what controls exist and guidance that tells you how to assess them.
- Be ready for "which publication would an auditor use to..." style questions.
Domain 3: NIST Control Families (21%)
Tied with SPs at the top weight. Candidates should be able to recognize a control's family from its description and explain what evidence would show it is working.
- Learn the family names and the intent behind each, from Access Control through System and Information Integrity.
- Practice translating a scenario (for example, a missing log review) into the family it implicates.
- Think like an auditor: for each family, ask what artifact, interview or test would verify implementation.
Domain 5: NIST Risk Management Framework (20%)
The RMF is the lifecycle that ties categorization, control selection, implementation, assessment, authorization and monitoring together. Auditors are expected to know where their work sits inside it.
- Know the ordered steps and what each produces.
- Understand the roles involved in authorization decisions and who owns which artifact.
- Connect the assessment step to the evidence an auditor reviews and the reports that result.
Domain 4: Governmental Laws and Regulations (17%)
This domain rewards precise recall. Know the major federal information security statutes and policies by name, what each requires, and which agencies or officials carry responsibility under them.
- Pair each law with its core obligation in one sentence.
- Note which laws drive reporting, which drive privacy, and which drive agency security programs.
- Use FITSI's Federal Body of Knowledge Guide as the boundary of what is in scope rather than reading everything adjacent.
Domain 2: FIPS (13%) and Domain 6: NISTIRs (8%)
Smaller, more bounded domains. For FIPS, focus on what each standard mandates (categorization, minimum requirements, cryptographic module validation, and similar) and how they feed the RMF. For NISTIRs, aim for recognition of the topics these reports cover and why an auditor might reference them, rather than deep detail.
Six Domains vs. 18 Topic Areas
This trips up many candidates. FITSI's Domains page describes six domains intersecting with 18 IT security topic areas: Access Control; Audit and Accountability; Awareness and Training; Configuration Management; Contingency Planning; Identification and Authentication; Incident Response; Maintenance; Media Protection; Personnel Security; Physical and Environmental Protection; Planning; Program Management; Risk Assessment; Security Assessment and Authorization; System and Communications Protection; System and Information Integrity; and System and Services Acquisition.
These 18 topics are not 18 additional exam domains. They are the subject matter that runs through all six. A single question in the NIST Special Publications domain might concern Incident Response; one in Control Families might concern Media Protection. Study each topic area as a thread that appears across domains.
A Study Sequence Built Around the Weights
Generic study methods matter less than allocating time where the points are. Here is one way to sequence an eight-week plan against the official weights; adjust the pace to your experience. If you are unsure how demanding the exam will feel, read How Hard Is the FITSP-Auditor Exam? first.
Domain 5 (RMF) and Domain 1 (SPs)
- Learn the RMF lifecycle first, because it gives every other publication a place to sit.
- Build a one-page map of major SPs and the RMF step each supports.
Domain 3 (Control Families)
- Cover the families in batches, writing an audit-evidence question for each.
- Cross-reference each family with the SP that assesses it.
Domain 4 (Laws and Regulations) and Domain 2 (FIPS)
- Create a law-to-obligation table and a FIPS-to-purpose table.
- Link each to the RMF steps it drives.
Domain 6 (NISTIRs) and gap review
- Skim NISTIR topics for recognition-level familiarity.
- Revisit whichever heavy domain felt weakest.
Timed simulation
- Take at least one full-length, three-hour practice session with no notes.
- Rehearse the remote-proctoring setup and ID check, not just the content.
Use timed practice throughout, not only at the end. Our FITSP-Auditor practice tests are built to help you drill the high-weight domains under realistic time pressure. For a compressed final-week reference, pair them with the FITSP-Auditor Cheat Sheet.
Vetting Study Materials Before You Buy
The market for FITSP-Auditor preparation is small and uneven. Several categories of resources exist, and each has caveats worth knowing before you spend money.
- Authorized courseware and training. FITSI identifies LEXX (formerly 30 Bird Media / Phoenix TS) as its courseware partner. Training is explicitly optional under FITSI's Training Program Handbook. A historical FITSI-authorized bundle advertised a three-day course with 21 CPEs and a US$395 exam voucher, but that is a dated example, not a standing offer, and course hours are distinct from the three-hour exam timer.
- Older book editions. Be careful with books whose revision predates the June 2024 weight changes. A Next Generation title with a 2020 copyright is not automatically aligned with current weights.
- Independent practice-question books. Some publishers disclaim any FITSI affiliation. That is fine, but it means accuracy and alignment to the current blueprint are your responsibility to judge.
- User-upload marketplaces and flashcard decks. Listings claiming "complete questions and all answers" have no issuer confirmation, and sampled previews have included off-topic content such as generic financial statements. Treat them as unverified.
- SEO landing pages. At least one exact-keyword page misnames the issuer entirely. Do not rely on pass-rate, salary or fee claims from sources that cannot name FITSI correctly.
Key Takeaway
Before buying anything, check three labels: does it say Auditor (not Designer, Manager or Operator), does it say NG, and does the publication date postdate June 1, 2024? Then compare its topic coverage to the six official domains and weights above.
Also treat pass-rate and salary figures cautiously. FITSI does not publish an Auditor pass rate, and no credential-specific salary dataset was verified, so anything stated with false precision should be ignored. See FITSP-Auditor Pass Rate 2026 and FITSP-Auditor Salary Guide 2026 for what can and cannot be said.
After You Pass: Experience, Endorsements and Award
Many candidates assume a passing result means they hold the credential. It does not. FITSI assesses your experience evidence after the exam, and passing alone does not award certification.
- Meet the experience standard. The baseline is five years of information-security experience in federal or civilian employment. Up to three of those years can be waived in total: one for an accredited bachelor's degree in any discipline, a second for an accredited IT or information-assurance master's degree, and one more for holding listed complementary certifications (FITSI's examples include CASP+, CySA+, Security+, CEH, GIAC, CISM, CISA, CISSP, CAP and SSCP).
- Submit the application. Include the complete application (use the current version, which FITSI describes as 17 pages), a current resume or CV, and two professional third-party endorsements verifying your experience. You also agree to the FITSI Code of Ethics.
- Mind the deadline. You have five years after passing to submit the application and supporting documents. FITSI describes an assessment and decision process of up to 60 days for a complete submission.
Read FITSP-Auditor Requirements 2026 to confirm you qualify, and lean on FITSP-Auditor Certification for the overall pathway.
Staying certified
The credential is valid for three years. Over each cycle you must earn and report 60 CPE credits per held certification, or retake the applicable exam at the end of the cycle, while keeping up the US$75 annual maintenance fee and Code of Ethics compliance. CPE activities must be relevant to your role and domains, backed by records, and reported through FITSI's portal. At least 30% of credits must come from structured education or training, and no more than 50% may come from self-directed reading. Older six-year retest and 20-CPE-per-year statements, and the old US$45 fee, are superseded.
Where it fits against CISA
Candidates often weigh this credential against ISACA's Certified Information Systems Auditor (CISA), the private-sector credential, not the U.S. agency. The two have different issuers and different centers of gravity: FITSP-Auditor is organized around the NIST and federal-law body of knowledge, while CISA is ISACA's broader information systems audit credential. FITSI actually lists CISA among the certifications that can count toward an experience waiver. If you are deciding where to invest, our ROI analysis walks through the trade-offs, and FITSP-Auditor Jobs covers the federal and contractor roles where it is most relevant.
Frequently Asked Questions
The exam has 150 multiple-choice questions, of which 120 are scored and 30 are unscored beta items, with a three-hour limit. There are no scheduled breaks, and bathroom breaks do not stop the clock.
FITSI sets the Auditor cut score through an Angoff study with psychometrician and subject-matter-expert input, approved by its Scheme Committee. A current numerical passing mark for this role was not publicly verified, so treat any specific figure you see online with caution. See our passing score guide for details.
NIST Special Publications and NIST Control Families each carry 21%, and the Risk Management Framework carries 20%. Together with Governmental Laws and Regulations (17%), these make up the large majority of the exam. FIPS is 13% and NIST Interagency Reports is 8%.
No. Training is optional and membership is not required; there is no separate member or nonmember exam price. The initial exam fee is US$395, and the optional associate membership is a separate charge. See the training overview for what courses involve.
You can take one discounted retest at US$197.50 after waiting 21 calendar days, provided it falls within one year of your initial exam. Outside that allowance, the initial rate applies. Review the domain weights before retesting so you can concentrate on the areas that carried the most points.
For the broadest single reference as you build your plan, revisit this FITSP-Auditor study guide alongside the domain breakdown, then test yourself on the main practice test site until the three-hour format feels routine.