- What FITSP-Auditor Actually Is
- The Naming Trail: FITSP-A, Auditor-NG and Original Certificates
- Who Issues It and Who Tests You
- How the Exam Is Built
- The Six Domains and Their Weights
- Six Domains vs. 18 Topic Areas
- Experience, Endorsements and Award
- What You Pay and When
- Staying Certified: The Three-Year Cycle
- Where the Credential Fits Professionally
- FITSP-Auditor vs. CISA
- Sequencing Your Preparation by Domain
- Frequently Asked Questions
- FITSP-Auditor is issued by the Federal IT Security Institute (FITSI) and targets auditing of federal information systems.
- The exam has 150 multiple-choice questions (120 scored, 30 beta) and a three-hour limit.
- NIST Special Publications and NIST Control Families each carry 21%; the Risk Management Framework follows at 20%.
- Passing the exam does not award the credential; you must also document five years of experience and submit endorsements.
What FITSP-Auditor Actually Is
FITSP-Auditor is a role-based certification from the Federal IT Security Institute (FITSI), part of the Federal IT Security Professional (FITSP) program. It is also written as FITSP-A or Federal IT Security Professional - Auditor. Its focus is the assessment side of federal cybersecurity: verifying that controls described in federal standards are actually implemented, documented and effective.
The word "Auditor" matters. FITSI's program is organized around four roles, and each role has its own examination. This article covers only the Auditor version, whose content is weighted toward the standards, controls, laws and processes an assessor must know cold. If you want the long-form definition angle, see our companion pages on what FITSP-Auditor certification is and what FITSP-Auditor stands for.
The Naming Trail: FITSP-A, Auditor-NG and Original Certificates
You will see several labels for this credential, and they are easy to confuse:
- FITSP-Auditor / FITSP-A: the general role name.
- FITSP-Auditor-NG: the "Next Generation" version. FITSI announced its Next Generation program on March 3, 2020, and its current handbooks describe the -NG version as the one issued to new candidates.
- Original certificates: FITSI's Certification Holder Handbook says original certificates were issued until 2020, with -NG certificates beginning in 2020. Its general policies apply to both unless a document says otherwise.
This lineage is a practical concern when buying study material. Some courseware and books are labeled "Next Generation" but carry 2020 copyright dates, which predate the exam weights that took effect on June 1, 2024. Always check the publication date and the role label before you buy. Our FITSP-Auditor study guide walks through how to vet materials against the current scope.
Who Issues It and Who Tests You
FITSI both certifies and administers the examination. No third-party commercial test center network was identified for this exam. Instead, FITSI uses remote proctoring:
- You take the exam on your own computer, with a separate phone or tablet used for monitoring.
- The Candidate Handbook describes the Assess.ai platform, WebLock and Zoom.
- You present two signed IDs, at least one with a photo, and check in 30 minutes early.
- The exam is closed book. Papers, reference materials and calculators must be put away, though the platform's digital Notepad is allowed.
- Monitoring runs for the whole session. There are no scheduled breaks, and a bathroom break does not pause or extend the clock.
FITSI's registration page describes an in-person option but labels it "Currently Not Offered," so plan on remote delivery. For scheduling mechanics, see FITSP-Auditor exam dates and scheduling.
How the Exam Is Built
The Auditor-specific section of FITSI's FITSP Certification Scheme Details Handbook (v1.6, effective June 1, 2024) defines the format:
| Feature | FITSP-Auditor Detail |
|---|---|
| Question count | 150 multiple-choice questions |
| Scored vs. beta | 120 scored, 30 beta (unscored trial items) |
| Time limit | Three hours |
| Delivery | Computer-based, remote-proctored, English only |
| Results | Immediate pass/fail, then an emailed score report in three to five business days |
| Passing standard | Set through an Angoff cut-score study with psychometrician and subject-matter-expert input, approved by the Scheme Committee |
Two points deserve emphasis. First, the 30 beta items are not identified to you, so treat every question as if it counts. Second, a current numerical passing mark for the Auditor exam was not publicly verified, and FITSI does not publish candidate pass rates that we could confirm. Be skeptical of any site quoting a precise passing percentage or pass rate. Our pages on the passing score and pass-rate evidence explain what is and is not known.
Time pressure is real but manageable: three hours across 150 questions averages out to roughly 72 seconds per item. Because the questions draw on named publications and defined processes, recall speed matters more than long calculation. For a frank look at difficulty, read how hard the FITSP-Auditor exam is.
The Six Domains and Their Weights
The six domain names and the Auditor-specific weights come from FITSI's Candidate Handbook (v3.7), reflecting the weighting row effective June 1, 2024. These are official examination domains, not editorial groupings.
| Domain | Weight |
|---|---|
| Domain 1: NIST Special Publications (SPs) | 21% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 3: NIST Control Families (CFs) | 21% |
| Domain 4: Governmental Laws and Regulations | 17% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 8% |
Domain 1: NIST Special Publications (21%)
Tied for the largest share. Expect questions that ask which publication addresses a given activity and what it prescribes.
- Know the purpose and scope of the SPs that govern security control selection, assessment procedures and system authorization.
- Be able to connect an auditing task to the publication that supports it.
Domain 2: NIST FIPS (13%)
A smaller but concrete domain focused on mandatory federal standards.
- Understand what FIPS publications establish, including how they relate to categorizing information and systems and to minimum security requirements.
- Distinguish mandatory standards from advisory guidance.
Domain 3: NIST Control Families (21%)
The other 21% domain, and the one most directly tied to day-to-day audit work.
- Know what each family is for, what its controls are meant to achieve and how an assessor would gather evidence of implementation.
- See the section below on how families relate to FITSI's 18 topic areas.
Domain 4: Governmental Laws and Regulations (17%)
Statutory and policy knowledge that frames why federal security programs exist.
- Learn which laws and regulations drive federal information security obligations and what each requires of agencies.
- FITSI's Federal Body of Knowledge Guide (v2.2) sets the source boundary, but it is not a mandate to read every listed publication.
Domain 5: NIST Risk Management Framework (20%)
The lifecycle process that ties categorization, control selection, implementation, assessment, authorization and monitoring together.
- Understand each RMF step and, from an auditor's perspective, what evidence and artifacts each step should produce.
- Pay special attention to the assessment and authorization portions.
Domain 6: NIST Interagency Reports (8%)
The smallest domain, but still roughly one in twelve scored questions.
- Know what NISTIRs are, how they differ from Special Publications and the topics they commonly address.
Together, Domains 1, 3 and 5 account for 62% of the weighting, so the largest share of your study time belongs on the SPs, the control families and the RMF. For a deeper walk through each area, see the complete FITSP-Auditor domains guide.
Six Domains vs. 18 Topic Areas
FITSI's FITSP Domains page separates the six examination domains from 18 intersecting IT security topic areas. The 18 topics are not 18 additional domains. They are a lens that cuts across the six domains:
- Access Control
- Audit and Accountability
- Awareness and Training
- Configuration Management
- Contingency Planning
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Personnel Security
- Physical and Environmental Protection
- Planning
- Program Management
- Risk Assessment
- Security Assessment and Authorization
- System and Communications Protection
- System and Information Integrity
- System and Services Acquisition
In practice, this means a single question might touch a domain (say, the RMF) and a topic (say, Security Assessment and Authorization) at the same time. Study each topic across multiple publications rather than in isolation.
Experience, Endorsements and Award
FITSP-Auditor separates passing the exam from earning the credential. That distinction trips up many candidates, so it is worth being precise. Full details are in our FITSP-Auditor requirements guide; the essentials are:
- Experience baseline: five years of information-security experience in federal or civilian employment.
- Possible waivers (up to three years in total): one year for an accredited bachelor's degree in any discipline; a second year for an accredited IT or information-assurance master's degree; and one further year for holding one or more listed complementary security certifications. FITSI's published examples include CASP+, CySA+, Security+, CEH, GIAC, CISM, CISA, CISSP, CAP and SSCP, and the names appear as FITSI lists them.
- After passing: submit a complete application, a current resume or CV, and two professional third-party endorsements verifying your experience, and agree to the FITSI Code of Ethics.
- Timing: you have five years after passing to submit your application and supporting documents. FITSI describes an assessment process of up to 60 days for a complete submission.
The current Candidate Handbook and Requirements page describe a 17-page application, while an older scheme document says 15. Use the current application rather than the older figure. No compulsory degree or minimum training-hour total was verified, and FITSP training is explicitly optional according to FITSI's Training Program Handbook.
Key Takeaway
Start gathering endorsement contacts and experience documentation before you sit the exam. Passing is only half the process; your experience evidence is assessed afterward, and the credential is not awarded on exam results alone.
What You Pay and When
FITSI's Fees page and Fee Schedule (v1.3) list these Auditor-relevant charges:
| Item | Amount |
|---|---|
| Initial examination | US$395 |
| Eligible same-role retest | US$197.50 |
| Rescheduling | US$100 |
| Annual maintenance | US$75 |
| Incomplete-application processing | US$25 |
Membership is not required to sit the exam, and no separate member/nonmember exam price is published. The US$75 associate-membership fee is a separate item from the exam fee. The retest discount has conditions: one discounted retest is allowed after a failed attempt, following a 21-calendar-day wait and within one year of the initial exam. Outside that allowance, the initial rate applies.
Training is optional and priced separately. As a dated example only, a FITSI-authorized three-day Auditor review course and exam bundle scheduled for September 22-24, 2026 was advertised at US$1,495 for members or US$1,695 for nonmembers, including a US$395 exam voucher valid for one year. That is a course bundle, not a standalone exam fee, and it does not guarantee a future class. The three-day course and its 21 CPEs do not change the three-hour exam. See the full FITSP-Auditor cost breakdown and our overview of training options.
Staying Certified: The Three-Year Cycle
FITSI's Certification Holder Handbook (v2.5) sets the current maintenance rules. Certification is valid for three years. During each cycle you must earn and report 60 CPE credits per held certification, or retake the applicable exam at the end of the cycle. You must also keep up annual fees and comply with the Code of Ethics.
FITSI's "Earning CPE Units" handbook (v2.2) adds rules about how credits are earned:
- Activities must be relevant to your held role and its domains.
- You need supporting records and must report through FITSI's portal.
- At least 30% of credits must come from structured education or training.
- No more than 50% may come from self-directed reading or independent study.
Older statements you may encounter, such as a six-year cycle, 20 CPEs per year or a US$45 annual fee, reflect earlier program rules. FITSI's May 3, 2024 announcement documented the move to a three-year NG cycle effective June 1, 2024. The current handbooks and US$75 fee schedule control. For more, see our overview of the FITSP-Auditor certification.
Where the Credential Fits Professionally
Because the content is built on the federal body of knowledge, the credential aligns most naturally with roles that assess, authorize or oversee federal information systems. That includes:
- Federal agency security assessment and compliance teams
- Contractors who support federal assessment and authorization work
- Internal auditors and inspectors reviewing federal IT controls
- Professionals moving from general IT audit into federal-specific assurance
Be careful with compensation claims. No credential-specific FITSP-Auditor salary dataset or causal salary premium was established, so any exact figure you see online should be treated as unverified. Our salary guide and jobs overview explain what can responsibly be said, and the worth-it analysis frames the decision around your own career path.
FITSP-Auditor vs. CISA
"CISA" here means ISACA's Certified Information Systems Auditor credential, not the U.S. agency. FITSI itself lists CISA among the certifications that can count toward an experience waiver, so the two are complementary rather than strict rivals.
| Dimension | FITSP-Auditor | CISA (ISACA) |
|---|---|---|
| Issuer | Federal IT Security Institute (FITSI) | ISACA |
| Core orientation | Federal IT security auditing built on NIST publications, federal laws and the RMF | Broader information systems audit, control and assurance |
| Best-fit context | Federal agencies and federal contractors | Public and private sector audit and governance roles |
| Credential award | Exam plus documented experience and endorsements | See ISACA's own requirements |
For current CISA exam and experience requirements, consult ISACA directly at isaca.org/credentialing/cisa. If your work is squarely in federal system assessment, FITSP-Auditor's NIST-heavy blueprint is more targeted; if you need portability across industries, a broader credential may serve you better, and holding both is reasonable.
Sequencing Your Preparation by Domain
Study methods are a secondary topic here, but one principle follows directly from the blueprint: order your work by weight and by dependency. The RMF organizes the other material, so learn its flow early, then layer the publications and control families onto it. A sample sequence:
Frame the process (Domain 5, 20%)
- Learn each RMF step and the artifacts it produces.
- Map the six domains to the 18 topic areas so later reading has a home.
Publications and families (Domains 1 and 3, 21% each)
- Work through the Special Publications supporting assessment and authorization.
- Study each control family's purpose and how an assessor would verify it.
Standards and law (Domains 2 and 4, 13% and 17%)
- Review what the FIPS publications mandate.
- Tie each statute or regulation to the obligation it creates.
Interagency reports and consolidation (Domain 6, 8%)
- Cover the NISTIR material, then take timed mixed-domain practice.
Because the exam is closed book and the clock does not stop, practice recall under time limits. You can test yourself with questions on the FITSP-Auditor practice test site, and our cheat sheet offers a compact review of must-know facts. When you evaluate any practice material, check whether it aligns with the current six-domain weighting and whether it actually addresses federal IT security rather than generic audit content.
Frequently Asked Questions
The Federal IT Security Institute (FITSI) issues it as part of the Federal IT Security Professional (FITSP) program. FITSI also administers and proctors the exam, using a remote-proctored format.
There are 150 multiple-choice questions, of which 120 are scored and 30 are unscored beta items. You have three hours, and the exam is computer-based and offered in English only.
Not by itself. After passing, you must submit an application, a current resume or CV and two third-party endorsements verifying at least five years of qualifying experience (less if eligible waivers apply), and agree to the Code of Ethics.
NIST Special Publications and NIST Control Families each carry 21%, and the NIST Risk Management Framework carries 20%. Together they make up 62% of the exam weighting.
Three years. To renew, you earn and report 60 CPE credits per held certification during the cycle, or retake the exam, while keeping up annual fees and Code of Ethics compliance.