- What a FITSP-Auditor Actually Is
- The Name, the Issuer, and the NG Lineage
- Who Needs This Credential and Where It Gets Used
- The Six Examination Domains and Their Weights
- Six Domains vs. 18 Topic Areas
- Exam Format and Remote Proctoring
- Fees and What They Do Not Include
- Experience, Endorsements, and the Award Sequence
- FITSP-Auditor Compared with ISACA's CISA
- Staying Certified: The Three-Year Cycle
- Sequencing Your Preparation Around the Weights
- Frequently Asked Questions
- FITSP-Auditor is issued by the Federal IT Security Institute (FITSI) and covers auditing against federal security requirements.
- The exam has 150 multiple-choice questions, 120 scored and 30 beta, with a three-hour limit.
- NIST Special Publications and NIST Control Families each carry 21%; the Risk Management Framework follows at 20%.
- Passing the exam does not award the credential; five years of experience, endorsements, and an application are also required.
What a FITSP-Auditor Actually Is
A FITSP-Auditor is a professional who has earned the Auditor version of the Federal IT Security Professional (FITSP) certification. The credential is aimed at people who evaluate whether federal information systems meet the security requirements that apply to them: assessing controls, examining evidence, and judging compliance against NIST publications and federal law. You may also see it written as Federal IT Security Professional - Auditor or abbreviated FITSP-A.
The word "Auditor" matters. FITSI runs a role-based program with four roles: Auditor, Designer, Manager, and Operator. This article covers the Auditor role only. The scope, task statements, and domain weights discussed here are specific to that role, and you should not assume that a fact about another FITSP role applies to the Auditor exam.
If you want a deeper treatment of the title itself, our companion pieces on what FITSP-Auditor is and what the acronym stands for cover the naming in more detail.
The Name, the Issuer, and the NG Lineage
The credential is administered by the Federal IT Security Institute, which uses the acronym FITSI for itself and FITSP for the Federal IT Security Professional program. Be careful here: the same letters appear in other credential names elsewhere in the industry, and information written about a different certification will not describe this exam.
FITSI's handbooks describe two generations of certificate. Original certificates were issued until 2020. Beginning in 2020, FITSI issued "Next Generation" certificates carrying an -NG extension, announced on March 3, 2020. Current issuer handbooks call the version issued to new candidates FITSP-Auditor-NG. FITSI's Certification Holder Handbook states that its general policies apply to both generations unless it distinguishes them.
Who Needs This Credential and Where It Gets Used
The FITSP program is built around the federal information security environment, so the people who benefit most are those working inside or alongside it. Typical settings include:
- Federal agencies where staff assess systems as part of authorization and continuous monitoring activities.
- Contractors and integrators supporting agency security programs and expected to demonstrate familiarity with federal requirements.
- Independent assessment teams performing control evaluations and documenting findings against NIST guidance.
- Civilian-sector security professionals whose work touches federal data or who want a credential grounded in the federal body of knowledge.
FITSI's own eligibility language covers experience in either federal or civilian employment, so a government badge is not a prerequisite. For a discussion of roles and hiring signals, see our overview of FITSP-Auditor jobs. We have not established a credential-specific salary dataset or a measured pay premium, so treat any specific earnings claim you encounter with caution; our salary guide discusses what can and cannot be said.
The Six Examination Domains and Their Weights
FITSI's Candidate Handbook publishes six domains with Auditor-specific weights, effective June 1, 2024. These are the official examination domains, not editorial groupings, and they total 100%.
| Domain | Weight |
|---|---|
| Domain 1: NIST Special Publications (SPs) | 21% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 3: NIST Control Families (CFs) | 21% |
| Domain 4: Governmental Laws and Regulations | 17% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 8% |
Notice what this structure says about the exam. It is organized by source document type rather than by job function. You are being tested on whether you know the federal body of knowledge and can apply it as an auditor, which is why the domain names read like a bibliography. Our complete guide to the six content areas goes through each in more depth.
NIST Special Publications (21%) and NIST Control Families (21%)
These two domains tie for the largest share of the exam, together accounting for 42% of the weighting. They are closely related: the publications describe guidance and methodology, while the control families describe the safeguards being assessed.
- Know which publications address assessment procedures, control selection, and system categorization, and what each is for.
- Be able to place a described control or scenario into the right family and explain what an auditor would examine as evidence.
- Focus on how an auditor uses the material, not just on recalling titles.
NIST Risk Management Framework (20%)
The RMF is the lifecycle around which federal system authorization is organized. As an auditor you should understand each step, who is responsible for what, and which artifacts an assessor would expect to review.
- Trace a system from categorization through authorization and ongoing monitoring.
- Understand where the assessment activity fits and what inputs and outputs surround it.
Governmental Laws and Regulations (17%)
This domain tests familiarity with the statutes and directives that create federal security obligations. Questions tend to reward knowing what a law requires and who it applies to, rather than reciting text.
FIPS (13%) and NISTIRs (8%)
The mandatory standards in the FIPS series and the more specialized Interagency Reports carry smaller weights but are not safe to skip. Their questions can be quite specific, and a candidate who ignores them gives away points that are easy to earn with focused review.
Six Domains vs. 18 Topic Areas
A frequent point of confusion: FITSI's domains page distinguishes the six domains from 18 intersecting IT security topic areas. The topic areas are not 18 extra exam domains. They are subject threads that cut across the six source-based domains. They are:
- Access Control; Audit and Accountability; Awareness and Training
- Configuration Management; Contingency Planning; Identification and Authentication
- Incident Response; Maintenance; Media Protection
- Personnel Security; Physical and Environmental Protection; Planning
- Program Management; Risk Assessment; Security Assessment and Authorization
- System and Communications Protection; System and Information Integrity; System and Services Acquisition
A practical way to hold this together: a single question might sit in the Control Families domain while touching the Incident Response topic, or sit in the Special Publications domain while touching Security Assessment and Authorization. When you study, tag your notes both ways.
Exam Format and Remote Proctoring
According to FITSI's scheme documentation, the Auditor examination consists of 150 multiple-choice questions: 120 scored items and 30 beta items, with a three-hour time limit. The test is computer-based and offered in English only. You will not be told which items are beta, so treat every question as if it counts. We did not verify whether the exam is adaptive.
How delivery works
FITSI administers and proctors its own examination; we identified no third-party testing network such as Pearson VUE, PSI, or Prometric in the published materials. FITSI's registration page describes two delivery formats but marks in-person testing as currently not offered, so remote-proctored delivery is the practical route. Based on the Candidate Handbook and FITSI's remote-proctoring page:
- You use your own computer plus a separate phone or tablet for monitoring.
- The handbook describes use of Assess.ai, WebLock, and Zoom.
- You present two signed IDs, at least one with a photo.
- Check-in begins 30 minutes before your start time.
- The exam is closed book. Reference materials, papers, and calculators must be put away. The platform's digital Notepad is permitted.
- Monitoring continues throughout. There are no scheduled breaks, and a necessary bathroom break does not pause or extend the three-hour clock.
You receive an immediate pass or fail result, followed by an emailed score report in three to five business days. For scheduling specifics, see our page on exam dates and scheduling; older quarterly appointment pages from 2020 do not describe current availability.
Key Takeaway
With 150 questions in 180 minutes, you have roughly 72 seconds per question and no break time to spare. Practice sustained, uninterrupted question sets under a timer, and set up your two-device environment in advance so check-in problems do not eat into your focus.
Fees and What They Do Not Include
FITSI's fee schedule lists these charges:
| Item | Fee (US$) |
|---|---|
| Initial examination | 395 |
| Eligible same-role retest | 197.50 |
| Rescheduling | 100 |
| Annual maintenance | 75 |
| Incomplete-application processing | 25 |
Membership is not required, and no separate member or nonmember examination price is published. The US$75 associate-membership fee is separate from the exam fee. The discounted retest is available once after a failed attempt, after a 21-calendar-day wait and within one year of the initial exam; outside that allowance the initial rate applies.
Training and courseware are optional and charged separately. FITSI has advertised a three-day authorized review course bundled with an exam voucher at a combined price, but that was a dated course example, not a standalone exam fee or a promise of a future class. Courseware partner LEXX also lists a longer course package, and its training hours should not be confused with the exam's three-hour timer. For a full breakdown, read our certification cost guide.
Experience, Endorsements, and the Award Sequence
Many candidates assume that passing the exam makes them certified. For FITSP-Auditor, it does not. The exam is one step in a sequence:
- Meet the experience requirement. The baseline is five years of information-security experience in federal or civilian employment.
- Pass the examination.
- Submit your application. This includes the complete application, a current resume or CV, and two professional third-party endorsements verifying your experience, along with agreement to the FITSI Code of Ethics.
- Experience review and award. FITSI assesses your evidence after the exam. It describes a decision process of up to 60 days for a complete submission.
How experience years can be waived
FITSI's requirements page allows up to three years to be waived in total:
- One year for an accredited bachelor's degree in any discipline.
- A second year for an accredited master's degree in IT or information assurance.
- One further year for holding one or more listed complementary security certifications. FITSI's published examples include CASP+, CySA+, Security+, CEH, GIAC, CISM, CISA, CISSP, CAP, and SSCP.
After passing, you have five years to submit the application and supporting documents. Note that the current handbook and requirements page cite a 17-page application, while an older scheme document says 15; use the current application. A compulsory degree or minimum training-hour total was not verified, and FITSI's Training Program Handbook explicitly describes FITSP training as optional. Our requirements guide walks through qualification in detail.
FITSP-Auditor Compared with ISACA's CISA
The most common comparison is with the Certified Information Systems Auditor from ISACA. Here, CISA means ISACA's credential, not the U.S. agency of the same acronym. FITSI itself lists CISA among the certifications that can count toward an experience waiver, which signals that the two are viewed as complementary rather than interchangeable.
| Aspect | FITSP-Auditor | ISACA CISA |
|---|---|---|
| Issuer | Federal IT Security Institute (FITSI) | ISACA |
| Orientation | Federal security: NIST publications, FIPS, control families, federal law, RMF | Information systems audit, control, and assurance across sectors |
| Exam structure | Six source-based domains with published Auditor weights | Defined by ISACA; see its credential page |
| Natural fit | Federal and federal-adjacent assessment work | Broad IT audit careers in many industries |
If your day-to-day work is assessing systems against NIST guidance for federal customers, FITSP-Auditor maps closely to that vocabulary. If you want portability across industries and audit functions, CISA's scope may fit better. Many practitioners hold both. We have not established exam-difficulty rankings between them, so check ISACA's official credential page for its current requirements before deciding. See also our analysis of whether the credential is worth it for your situation.
Staying Certified: The Three-Year Cycle
Under FITSI's current Certification Holder Handbook, FITSP certification is valid for three years. To renew, you earn and report 60 CPE credits per held certification during each three-year cycle, or retake the applicable examination at the end of the cycle. You also keep annual maintenance fees current and comply with the Code of Ethics.
FITSI's CPE handbook adds important constraints:
- Activities must be relevant to your held role and domains, with supporting records, reported through FITSI's portal.
- At least 30% of credits must come from structured education or training.
- No more than 50% may come from self-directed reading or independent study.
Older sources mention six-year cycles, a 20-CPE-per-year rule, and a US$45 annual fee. Those statements are superseded by the current handbooks and the US$75 fee schedule. FITSI announced the June 1, 2024 changes, including the move for NG renewal from six years to three, in a May 3, 2024 notice.
Sequencing Your Preparation Around the Weights
Generic study advice is easy to find. What is more useful is ordering your effort by what the exam actually weights. Here is one way to sequence a roughly six-week plan, assuming you already have working audit or security experience.
Framework first: RMF (20%)
- Learn the lifecycle end to end, since it gives context for everything else.
- Note where assessment activities and artifacts appear.
The two 21% domains
- Work through NIST Special Publications and the Control Families together.
- Tag each control family to the 18 topic areas as you go.
Governmental Laws and Regulations (17%)
- Focus on what each law requires and to whom it applies.
FIPS (13%) and NISTIRs (8%)
- Smaller domains, but specific questions reward targeted review.
Timed full-length practice
- Sit 150-question sets in three hours with no breaks.
- Review misses by domain to find weak spots.
Two supporting resources are worth knowing about. FITSI's Auditor Certification Competence Breakdown (v3.0) lays out task, knowledge, and skill statements for the role; note that its web and PDF metadata mislabel it as Manager exam objectives, though the cover and contents identify Auditor. FITSI's Federal Body of Knowledge Guide sets the broad source boundary across the four roles, but it is not an instruction to read every publication listed, and its publication list is not a current inventory. Use it to understand scope, not as a reading assignment.
For a fuller approach, see our study guide, and when you are ready to test yourself under realistic conditions, try the FITSP-Auditor practice tests and check how you perform across each domain. If you are weighing the challenge, our piece on how hard the exam is sets expectations.
Frequently Asked Questions
A FITSP-Auditor holds the Auditor-role certification from the Federal IT Security Institute and is qualified to evaluate whether federal information systems meet applicable security requirements, drawing on NIST publications, control families, the Risk Management Framework, and federal law.
No. After passing, you must submit a complete application, a current resume or CV, and two third-party endorsements verifying your experience, and agree to the Code of Ethics. FITSI then assesses your experience evidence before awarding the certification.
FITSI describes an Angoff cut-score study approved by its Scheme Committee, but we could not verify a current public numerical passing mark for the Auditor exam, and no official pass rate is published. See our pieces on the passing score and pass rate for what is and is not known.
Three years. To renew, earn and report 60 CPE credits per held certification in each cycle, or retake the applicable exam, while keeping annual fees and Code of Ethics compliance current.
A compulsory degree or minimum training-hour total was not verified. The baseline is five years of information-security experience, with up to three years waivable through education and listed certifications. FITSI describes training as optional.
In short, FITSP-Auditor is a role-specific federal security credential whose exam rewards command of the NIST body of knowledge and federal requirements, followed by a documented experience review before the certificate is awarded. Understanding that two-stage structure, and the weights behind the six domains, is the clearest foundation for deciding whether it fits your career. For a broader overview of the certification itself, see our FITSP-Auditor certification page.