- What FITSP-Auditor Actually Is
- FITSP-Auditor vs. FITSP-Auditor-NG: Untangling the Names
- Who Issues It and Who It Is Built For
- The Six Exam Domains and Their Weights
- Six Domains, Eighteen Topic Areas
- Exam Format and Remote Proctoring
- What the Exam Costs
- Passing the Exam Is Not the Same as Being Certified
- Staying Certified: Three-Year Cycle
- How It Differs from ISACA's CISA
- Sequencing Your Preparation Around the Weights
- Frequently Asked Questions
- FITSP-Auditor is issued by the Federal IT Security Institute (FITSI) and focuses on auditing federal IT security.
- The exam has 150 multiple-choice questions (120 scored, 30 beta) and a three-hour limit.
- NIST Special Publications and NIST Control Families each carry 21%; the RMF domain follows at 20%.
- Passing the exam does not award the credential; experience evidence and endorsements are assessed afterward.
What FITSP-Auditor Actually Is
FITSP-Auditor is a role-based certification for professionals who assess and audit information security in federal and federal-adjacent environments. It belongs to the Federal IT Security Professional (FITSP) program run by the Federal IT Security Institute (FITSI). You will also see it written as Federal IT Security Professional - Auditor, or simply FITSP-A.
The credential tests whether you can apply the federal security body of knowledge from an auditor's point of view: evaluating whether controls are implemented correctly, whether processes follow the NIST Risk Management Framework, and whether a system's security posture aligns with applicable standards and law. It is not a generic cybersecurity credential and it is not a vendor product certification. Its content is anchored in NIST publications and federal requirements.
If you want a shorter, definition-first treatment of the same ground, see What Is FITSP-Auditor? and What Does FITSP-Auditor Stand For?. This article goes further into how the certification is structured and what earning it involves in practice.
FITSP-Auditor vs. FITSP-Auditor-NG: Untangling the Names
A common source of confusion is the "-NG" suffix. FITSI's Certification Holder Handbook explains that original FITSP certificates were issued until 2020. Starting in 2020, FITSI began issuing Next Generation certificates carrying the -NG extension. FITSI documented that transition in its March 3, 2020 announcement of the Next Generation FITSP program. Current issuer handbooks call the version issued to new candidates FITSP-Auditor-NG.
FITSI states that its general policies apply to both certificate generations unless a document distinguishes them. In practical terms, if you are a new candidate today, the credential you are working toward is the NG version, and you should check any study material for the "Auditor" role label, the NG designation, and a publication date before relying on it.
Who Issues It and Who It Is Built For
FITSI administers the FITSP program and also administers and proctors the examination itself. No third-party testing network was identified as the delivery provider. That makes FITSI's handbooks the controlling source for exam rules, fees, and policies.
The Auditor role fits people whose work involves examining evidence rather than building or operating systems. Typical settings include federal agencies and the contractors that support them, assessment and authorization teams, internal and external audit functions, and compliance-oriented security roles. Because the content is rooted in federal law and NIST guidance, it is most relevant to those working inside or alongside the U.S. federal ecosystem.
For a look at the employer side, see FITSP-Auditor Jobs. If you are weighing the investment, Is the FITSP-Auditor Certification Worth It? works through the return-on-investment question, and the FITSP-Auditor Salary Guide covers earnings. Note that no credential-specific salary dataset or official pass-rate figure has been published by the issuer, so be skeptical of any site quoting precise numbers.
The Six Exam Domains and Their Weights
The Auditor exam is organized into six domains. The names and weights below come from FITSI's Candidate Handbook and reflect the Auditor-specific weighting effective June 1, 2024. They total 100%.
| Domain | Weight |
|---|---|
| Domain 1: NIST Special Publications (SPs) | 21% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 3: NIST Control Families (CFs) | 21% |
| Domain 4: Governmental Laws and Regulations | 17% |
| Domain 5: NIST Risk Management Framework (RMF) | 20% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 8% |
These are official examination domains with role-specific weights, not editorial groupings. Notice what the distribution tells you: NIST Special Publications and NIST Control Families are tied at the top with 21% each, and the Risk Management Framework is close behind at 20%. Together those three domains account for 62% of the exam. For a deeper walk through each area, read the FITSP-Auditor Exam Domains guide.
NIST Special Publications (21%)
The SP series is the backbone of federal security guidance. Auditors need to know which publication governs which activity.
- Know what each major publication is for, not just its number
- Connect guidance on assessing controls to the evidence an auditor would examine
- Be ready to identify the right source document for a described scenario
NIST Control Families (21%)
This domain tests your command of the control families and what each is meant to accomplish.
- Understand the purpose and typical safeguards within each family
- Distinguish related families that candidates commonly confuse
- Think like an assessor: what would demonstrate that a control is working?
NIST Risk Management Framework (20%)
RMF is the process that ties categorization, control selection, implementation, assessment, authorization, and monitoring together.
- Know the sequence of RMF activities and the outputs of each
- Understand where the assessor's role fits in the lifecycle
- Recognize how authorization decisions depend on assessment results
Governmental Laws and Regulations (17%)
Auditors work within a legal framework, so the exam expects you to recognize the major federal statutes and policies that drive security requirements and what each one requires of agencies.
NIST FIPS (13%) and NIST Interagency Reports (8%)
FIPS are mandatory standards for federal systems, so expect questions on what they require and when they apply. NISTIRs carry the smallest weight, but at 8% they are still worth targeted review rather than being skipped.
Six Domains, Eighteen Topic Areas
FITSI's FITSP Domains page distinguishes the six exam domains from 18 intersecting IT security topic areas. These topic areas are not additional exam domains. They are the subject matter that cuts across the domains:
- Access Control; Audit and Accountability; Awareness and Training
- Configuration Management; Contingency Planning; Identification and Authentication
- Incident Response; Maintenance; Media Protection
- Personnel Security; Physical and Environmental Protection; Planning
- Program Management; Risk Assessment; Security Assessment and Authorization
- System and Communications Protection; System and Information Integrity; System and Services Acquisition
The practical implication is that you should study each topic area through multiple lenses. For example, incident response may appear in a question about a Special Publication, a control family, a legal requirement, or the RMF.
FITSI also publishes a FITSP-Auditor Certification Competence Breakdown (v3.0) with task, knowledge, and skill statements, and a Federal Body of Knowledge Guide that sets the broad federal source boundary across the FITSP roles. The Body of Knowledge Guide is a boundary, not a reading list: it is not an instruction to read every publication it mentions, and its publication list is dated.
Exam Format and Remote Proctoring
Per FITSI's scheme documentation, the Auditor examination consists of 150 multiple-choice questions: 120 scored items and 30 beta (unscored) items. You have three hours. The exam is computer-based and offered in English only. You will not be able to tell which items are beta, so treat every question as if it counts.
FITSI's registration page lists two delivery formats but labels in-person testing as currently not offered. Remote proctoring is the route in practice. Candidate Handbook v3.7 describes the process:
- You use your own computer plus a separate phone or tablet for monitoring.
- The platform uses Assess.ai, WebLock, and Zoom.
- You present two signed IDs, one of which must be a photo ID.
- Check-in begins 30 minutes before your start time.
- The exam is closed book. Reference materials, papers, and calculators must be put away; the platform's digital Notepad is allowed.
- Monitoring runs throughout. There are no scheduled breaks, and a bathroom break does not pause or extend the three-hour clock.
You receive an immediate pass/fail result, followed by an emailed score report within three to five business days.
Key Takeaway
With no scheduled breaks and a running clock, practice sitting through long sets of questions under timed conditions before exam day. Roughly 150 questions in three hours leaves little room to dwell on any single item.
On scoring: FITSI uses an Angoff cut-score study with psychometrician and subject-matter-expert input, followed by Scheme Committee approval. A current numerical Auditor passing mark was not publicly verified, so treat any specific percentage you see online with caution. See the FITSP-Auditor Passing Score and Pass Rate articles for how to interpret what is and is not known. For scheduling mechanics, see FITSP-Auditor Exam Dates.
What the Exam Costs
FITSI's published fee schedule lists the following charges:
| Item | Fee (USD) |
|---|---|
| Initial examination | $395 |
| Eligible same-role retest | $197.50 |
| Rescheduling | $100 |
| Annual maintenance | $75 |
| Incomplete-application processing | $25 |
Membership is not required, and no separate member versus nonmember exam price is published. The $75 associate-membership fee is a separate item from the exam fee. The discounted retest is available once after a failed attempt, after a 21-calendar-day wait and within one year of the initial exam; outside that allowance the initial rate applies.
Training and courseware are separate costs. As a dated example, a FITSI-authorized three-day Auditor review course scheduled for September 22-24, 2026 advertised $1,495 for members or $1,695 for nonmembers, including a $395 exam voucher valid for one year. That is a course bundle, not a standalone exam fee, and it does not indicate an open class today. The full cost picture is in the FITSP-Auditor Certification Cost breakdown, and options are covered in FITSP-Auditor Training. FITSI's own Training Program Handbook states that FITSP training is optional.
Passing the Exam Is Not the Same as Being Certified
This is one of the most misunderstood points about FITSP-Auditor. Passing the exam is a necessary step, but it does not by itself award the credential. FITSI separately evaluates your professional experience.
Experience requirement
The baseline is five years of information-security experience in federal or civilian employment. FITSI's Requirements page allows certain waivers, capped at three years in total:
- One year waived for an accredited bachelor's degree in any discipline.
- A second year waived for an accredited IT or information-assurance master's degree.
- One further year waived for holding one or more listed complementary security certifications.
FITSI's published examples of qualifying certifications include CASP+, CySA+, Security+, CEH, GIAC, CISM, CISA, CISSP, CAP, and SSCP. These names reflect the issuer's stated list. A compulsory degree and a minimum training-hour total were not verified as requirements.
Application steps after passing
- Submit the complete application (the current Candidate Handbook and Requirements page describe it as 17 pages; an older scheme document says 15, so use the current application).
- Provide a current resume or CV.
- Provide two professional third-party endorsements verifying your experience.
- Agree to the FITSI Code of Ethics.
You have five years after passing to submit the application and supporting documents. FITSI describes an assessment and decision process of up to 60 days for a complete submission. Full eligibility details are in the FITSP-Auditor Requirements guide.
Staying Certified: Three-Year Cycle
Certification is valid for three years. A May 3, 2024 FITSI announcement established, effective June 1, 2024, the NG renewal cycle moving from six years to three. Under the current Certification Holder Handbook, you maintain certification by:
- Earning and reporting 60 CPE credits per held certification during each three-year cycle, or retaking the applicable exam at cycle end.
- Paying the annual maintenance fee ($75 per the current fee schedule).
- Complying with the Code of Ethics.
FITSI's CPE handbook adds constraints: activities must be relevant to your held role and domains, supported by records, and reported through FITSI's portal. At least 30% of CPE credits must come from structured education or training, and no more than 50% may come from self-directed reading or independent study. Older statements about six-year mandatory retests, 20 CPEs per year, and a $45 annual fee are superseded by the current handbooks and fee schedule.
How It Differs from ISACA's CISA
Readers often ask how FITSP-Auditor compares with ISACA's Certified Information Systems Auditor (CISA), the audit credential from a different issuer. (Here CISA means the ISACA credential, not the U.S. agency.) The two overlap in that both address auditing, and FITSI itself lists CISA among the certifications that can earn an experience waiver. The difference is orientation.
| Aspect | FITSP-Auditor | CISA |
|---|---|---|
| Issuer | Federal IT Security Institute (FITSI) | ISACA |
| Orientation | Federal IT security auditing grounded in NIST publications, FIPS, control families, RMF, and federal law | Broader information systems audit, control, and assurance |
| Typical fit | Federal agencies and contractors needing NIST-aligned assessment skills | Audit and assurance roles across many industries |
For CISA's own requirements and exam details, consult ISACA's credentialing page directly rather than relying on third-party summaries. Many professionals pursue the two for different reasons, and holding one can support the experience-waiver pathway toward the other.
Sequencing Your Preparation Around the Weights
Because the domains are weighted so unevenly, the order in which you study matters more than the number of hours. This is the one place where we will talk about scheduling, and it is tied directly to the blueprint. The FITSP-Auditor Study Guide goes deeper on technique.
Build the RMF spine first
- Learn the RMF lifecycle end to end (20%), since it gives context to everything else
- Map where assessment activities and authorization decisions occur
Control families and Special Publications
- Work through control families (21%) alongside the SPs (21%) that guide them
- Pair each family with the 18 topic areas to see cross-cutting themes
Law and standards
- Cover Governmental Laws and Regulations (17%) and FIPS (13%)
- Finish with NISTIRs (8%) so lower-weight material does not get skipped
Timed practice
- Take full-length timed sets that mimic 150 questions in three hours
- Review misses by domain to find where weight and weakness overlap
When you evaluate study materials, check provenance carefully. Confirm the role label says Auditor, that the version is NG-aligned, and that the publication date postdates the June 2024 weight changes. Some marketplace listings advertise "actual exam questions" without issuer confirmation, and a published Auditor-NG courseware listing from 2020 predates the current weights. Unofficial practice resources can be useful for rehearsing question style, but they should supplement the official blueprint, not replace it. To pressure-test your knowledge, use the FITSP-Auditor practice tests, and for a quick fact refresher see the FITSP-Auditor Cheat Sheet. If you are wondering about difficulty, How Hard Is the FITSP-Auditor Exam? sets realistic expectations. You can also explore the broader exam prep resources on the main site.
Frequently Asked Questions
It refers to the Federal IT Security Professional - Auditor credential, abbreviated FITSP-A, issued under the FITSP program of the Federal IT Security Institute (FITSI). See FITSP-Auditor Meaning for more.
The exam has 150 multiple-choice questions, of which 120 are scored and 30 are unscored beta items. The time limit is three hours, with no scheduled breaks.
FITSI administers and proctors the exam itself. In-person testing is labeled currently not offered, so candidates use FITSI's remote-proctored process with their own computer and a separate monitoring device.
No. After passing, you must submit an application, a resume, two third-party endorsements verifying experience, and agree to the Code of Ethics. FITSI then assesses your experience, with a decision process of up to 60 days for a complete submission.
Three years. To renew, you earn and report 60 CPE credits per held certification in each cycle, or retake the applicable exam, while paying the annual maintenance fee and following the Code of Ethics.
FITSP-Auditor is a specialized, federally oriented audit credential with a clearly published blueprint, a defined exam format, and a two-stage path from passing to certification. Start from the six weighted domains, verify every study source against current issuer documents, and treat the exam as the first half of the process, not the whole of it. For the formal eligibility rules, continue with FITSP-Auditor Certification and What Is FITSP-Auditor Certification?.