- What You Are Actually Buying With This Credential
- The Cost Side of the Ledger
- Time, Effort and the Exam Itself
- The Experience Hurdle Changes the Math
- Where the Value Shows Up
- FITSP-Auditor vs CISA: Different Tools
- What We Can and Cannot Say About Pay
- The Ongoing Cost of Keeping It
- Who Should Pursue It and Who Should Skip It
- Sequencing Your Prep to Protect the Investment
- Frequently Asked Questions
- The initial FITSP-Auditor exam costs US$395, with an eligible same-role retest at US$197.50 and a US$75 annual maintenance fee.
- Passing alone does not award the credential; five years of experience, two endorsements and an application are also assessed.
- Domains 1 and 3 (NIST SPs and Control Families) carry 21% each; RMF follows at 20%.
- No official pass rate or credential-specific salary dataset is public, so be skeptical of any site quoting one.
What You Are Actually Buying With This Credential
The Federal IT Security Professional - Auditor credential, often written FITSP-A, is issued by the Federal IT Security Institute (FITSI). Newly issued certificates carry the -NG extension, which stands for Next Generation and began with FITSI's 2020 program update. If you are still sorting out the naming, our explainers on what FITSP-Auditor is and what the acronym stands for cover the basics.
The question of whether it is worth it hinges on one distinction: this is not a general-purpose security credential. It tests whether you can audit and assess federal information systems against the body of federal guidance: NIST publications, FIPS standards, control families, governing laws and the Risk Management Framework. Its value is concentrated in a specific employment ecosystem. If your career runs through federal agencies or the contractors that support them, the credential speaks your language directly. If it does not, the return shrinks quickly.
The Cost Side of the Ledger
Start with the numbers FITSI actually publishes. Our complete pricing breakdown goes deeper, but the core figures are:
| Cost Item | Amount (US$) | Notes |
|---|---|---|
| Initial examination | 395 | No separate member/nonmember exam price is published |
| Eligible same-role retest | 197.50 | One discounted retest after a 21-day wait, within one year of the first attempt |
| Rescheduling | 100 | Avoid by confirming your date before booking |
| Annual maintenance | 75 | Recurs each year you hold the certification |
| Incomplete-application processing | 25 | Avoidable with a complete submission |
| Associate membership | 75 | Separate from the exam fee; membership is not required |
Training is a separate decision. FITSI's own Training Program Handbook states that FITSP training is optional. As a dated example, a FITSI-authorized three-day Auditor review course and exam bundle scheduled for September 2026 was advertised at US$1,495 for members or US$1,695 for nonmembers, including a US$395 exam voucher valid for one year. That is a historical bundle example, not a promise of future classes. Courseware partner LEXX also lists a five-day Auditor course, and noted no public classes scheduled when we checked.
The practical takeaway: a self-study path costs roughly the exam fee plus whatever study materials you choose, while a guided path adds four figures. Both are defensible, but the ROI math differs sharply depending on whether an employer is footing the bill.
Time, Effort and the Exam Itself
Money is only half the investment. The exam is a computer-based, English-only test of 150 multiple-choice questions with a three-hour limit. Of those, 120 are scored and 30 are beta items, and you will not know which are which. It is closed book. The platform's digital notepad is allowed, but reference materials, papers and calculators are not.
FITSI administers and proctors the exam itself. At the time of our research, the in-person option was labeled "Currently Not Offered," so remote proctoring is the working route. That means your own computer plus a separate phone or tablet for monitoring, two signed IDs (one with a photo), check-in 30 minutes early and continuous monitoring. There are no scheduled breaks, and a bathroom trip does not pause the clock. Results appear immediately as pass or fail, followed by an emailed score report in three to five business days. Details on scheduling are in our exam dates guide.
On difficulty: the exam rewards breadth across federal sources rather than deep hands-on technical skill. Our difficulty guide unpacks why the volume of reference material, not any single concept, is what trips people up.
What the Weights Tell You About Return on Study Hours
Study hours are a cost too, and the official Auditor weights (effective June 1, 2024) tell you where they pay off:
The Two 21% Domains: NIST Special Publications and NIST Control Families
Together these make up 42% of the exam. They reward candidates who can map an audit question to the right publication and the right control family.
- Know which Special Publications govern assessment, authorization and control selection
- Be fluent in the 18 intersecting topic areas, such as Access Control, Audit and Accountability, and Configuration Management
NIST Risk Management Framework (20%)
The RMF domain is the third heaviest. Auditors must understand the lifecycle that systems move through and where assessment evidence fits.
- Security Assessment and Authorization is both an RMF activity and one of the 18 topic areas
- Expect scenario-style thinking about what an assessor examines and why
Governmental Laws and Regulations (17%)
This domain is memorization-heavy and uniquely federal. It is where generalist security professionals often feel least prepared.
NIST FIPS (13%) and NIST Interagency Reports (8%)
Smaller weights, but not skippable. FIPS questions tend toward standards-based facts; NISTIRs are the lightest slice and a reasonable place to economize if time is short.
For the full breakdown of all six areas, see our exam domains guide.
The Experience Hurdle Changes the Math
Here is the factor most ROI discussions miss: passing the exam does not make you certified. FITSI requires five years of information-security experience in federal or civilian employment. Waivers can reduce this: one year for an accredited bachelor's degree in any discipline, a second year for an accredited IT or information-assurance master's degree, and one more year for holding one or more listed complementary certifications (the issuer's examples include CISA, CISSP, CISM, Security+, CASP+, CySA+, CEH, GIAC, CAP and SSCP). The maximum waiver is three years in total. Our requirements guide walks through qualification in detail.
After the exam, you submit a complete application, a current resume or CV and two professional third-party endorsements verifying your experience, and you agree to the FITSI Code of Ethics. FITSI describes a decision process of up to 60 days for a complete submission, and you have five years after passing to submit.
Where the Value Shows Up
The credential's value is most plausible in roles that audit, assess or authorize federal systems: government security assessment teams, contractors supporting agency authorization work and compliance-focused roles where RMF and NIST control fluency is a daily expectation. These are the settings where the six exam domains map to actual job tasks rather than trivia. Our jobs overview looks at the role types in more detail.
The credential also functions as a signal. A candidate who has passed an exam built on federal sources and had their experience verified by third-party endorsers demonstrates something a generic certification does not: familiarity with the specific vocabulary of federal assurance work. For hiring managers screening federal-facing resumes, that signal can be meaningful.
What we cannot claim: that employers universally require it, that it guarantees interviews or that it produces a quantifiable hiring advantage. No such data has been established, and anyone promising it is guessing.
FITSP-Auditor vs CISA: Different Tools
The most common comparison is with ISACA's Certified Information Systems Auditor (CISA), the credential, not the U.S. agency. FITSI itself lists CISA among the certifications that can earn an experience waiver, which tells you the two are viewed as complementary rather than rivals.
| Factor | FITSP-Auditor | ISACA CISA |
|---|---|---|
| Issuer | Federal IT Security Institute (FITSI) | ISACA |
| Scope focus | Federal security auditing: NIST publications, FIPS, control families, federal laws, RMF, NISTIRs | Broader IT audit, control and assurance practice (see ISACA's credential page for current scope) |
| Natural fit | Federal agencies and their contractors | Audit roles across many sectors |
| Waiver relationship | Accepts CISA as a listed complementary certification toward an experience waiver | Governed by ISACA's own requirements |
The decision logic: if your work is rooted in federal systems and NIST-based assessment, FITSP-Auditor is aligned more tightly with the daily vocabulary. If you want portability across industries and geographies, a broader audit credential may serve you better. Many professionals hold both, and the waiver pathway makes that sequence efficient. Verify current CISA details directly at ISACA before deciding.
What We Can and Cannot Say About Pay
This is where many ROI articles overreach. No credential-specific FITSP-Auditor salary dataset has been established, and no causal salary premium has been demonstrated. Some preparation sites publish confident salary figures; in our review, at least one such page also contained basic errors such as the wrong issuer acronym, and its pass-rate, fee and prerequisite claims conflicted with FITSI's own documents. Treat unsourced pay numbers accordingly.
What you can do instead is reason from role context. Federal security assessment and authorization work is a defined job family, and pay in it depends on your agency or employer, clearance, location and seniority far more than on any single certification. For a fuller discussion of how to think about this, see our salary guide. The same caution applies to pass rates: FITSI describes an Angoff cut-score process with psychometrician and subject-matter-expert input, but a current numerical Auditor passing mark and candidate pass rates are not publicly verified. Our pages on the passing score and pass rate explain what is and is not known.
Key Takeaway
Do not build your decision on a quoted salary bump or pass rate. Build it on whether your employer or target employer values federal-specific assurance credentials, and whether you already meet the experience requirement.
The Ongoing Cost of Keeping It
Certification is a recurring commitment. The Auditor-NG certification is valid for three years. During each cycle you must earn and report 60 CPE credits per held certification, or retake the applicable exam at the end of the cycle, while paying the US$75 annual fee and staying in compliance with the Code of Ethics.
FITSI's CPE handbook adds structure: activities must be relevant to your held role and domains, supported by records and reported through FITSI's portal. At least 30% of credits must come from structured education or training, and no more than 50% may come from self-directed reading or independent study. Older sources mention a six-year retest cycle, 20 CPEs per year and a US$45 annual fee; those are superseded by the current handbooks and fee schedule, so do not plan around them.
Over a three-year cycle, the maintenance fees alone total US$225, plus the time and any cost of earning CPEs. Professionals who already attend relevant training, conferences or webinars may find the CPE load easy to absorb; those who do not should budget for it.
Who Should Pursue It and Who Should Skip It
Strong Candidates
- Federal employees and contractors who perform or support security assessments and already meet the five-year experience bar
- Professionals whose employers reimburse exam fees or fund FITSI-authorized training
- Auditors moving into federal work who want a credential that speaks NIST and RMF vocabulary
Weaker Candidates
- Early-career professionals who would pass the exam but wait years for the experience requirement
- Anyone targeting purely commercial audit roles where federal frameworks are rarely referenced
- Candidates whose primary motivation is a promised salary jump, since no such effect is documented
If you are weighing it against alternatives, a low-risk approach is to read the official FITSI domain documents first. If the six domains describe work you already do or want to do, the credential likely fits. If they read as foreign territory with no connection to your career path, that is useful information too.
Sequencing Your Prep to Protect the Investment
Failing costs money, and only one discounted retest is available (US$197.50, after a 21-day wait and within one year of your first attempt). A deliberate sequence lowers the odds of paying twice. This is the one place for a brief study plan, tied to the weights:
Control Families and Special Publications (42% combined)
- Anchor everything to the 18 topic areas, then connect each to relevant NIST publications
- Front-load these because they are the largest and feed other domains
Risk Management Framework (20%)
- Study the lifecycle with an assessor's eye: what evidence confirms each step
Laws and Regulations (17%), then FIPS (13%)
- Use repetition for the fact-heavy legal material
NISTIRs (8%) and timed practice
- Take full-length practice sessions under a three-hour limit to rehearse the no-break format
Our study guide expands this plan, and the cheat sheet is useful for last-pass review. When evaluating any third-party material, check provenance first: confirm it is labeled for the Auditor role (not another FITSP role), the Next Generation version and a recent publication date. In our review, some listings were built on 2020-era courseware or showed previews with no apparent connection to federal IT security, so alignment with the June 2024 weights should never be assumed. For realistic exam-style repetition, try the FITSP-Auditor practice tests and compare your results against the domain weights above.
Frequently Asked Questions
It can be, if your work is federal-facing. FITSI lists both as complementary certifications that can count toward an experience waiver, and FITSP-Auditor adds NIST- and RMF-specific depth. If your work is not federal, the added value is less clear.
No. After passing you must submit the application, a current resume or CV and two professional third-party endorsements verifying your experience, and agree to the Code of Ethics. FITSI assesses experience evidence for certification award after the exam.
The initial exam is US$395, with a US$197.50 eligible retest and a US$75 annual maintenance fee. Training and courseware are separate and optional. See the cost breakdown for the full picture.
No credential-specific salary data or causal premium has been established, so any specific figure you see should be treated skeptically. Pay in federal security assessment depends heavily on employer, clearance, location and seniority.
No. FITSI's Training Program Handbook describes FITSP training as optional. A self-study path is permitted, though some candidates choose a guided course for structure. Read about options in our training overview.