- What This Cheat Sheet Covers (and What It Doesn't)
- Exam Format at a Glance
- The Six Domains and Their Weights
- Must-Know Facts by Domain
- Fees, Registration and Exam-Day Rules
- Eligibility and Experience Waivers
- Staying Certified: The Three-Year Cycle
- Sequencing Your Final Review
- Common Traps and Outdated Information
- Frequently Asked Questions
- The exam has 150 multiple-choice items (120 scored, 30 beta) in 3 hours, closed book, English only.
- NIST Control Families is the heaviest domain at 22%; NISTIRs is the lightest at 7%.
- Initial exam is USD 395; one same-role retest costs USD 197.50 after at least 21 days.
- Certification lasts three years, with 60 CPE credits and a USD 75 annual maintenance fee.
What This Cheat Sheet Covers (and What It Doesn't)
This page condenses the facts that matter most for the Federal IT Security Professional - Operator credential, issued by the Federal IT Security Institute (FITSI). It is the Operator role specifically, shortened by FITSI as FITSP-O, with the current handbook naming the program FITSP-Operator-NG. Other FITSI roles exist, and other credentials elsewhere share similar letters, so everything below is tied to the Operator exam and the official FITSI documents behind it.
Think of this as a verification sheet rather than a teaching document. If you are new to the credential, start with What Is FITSP-Operator Certification? and then return here for the condensed review. If you need a full preparation plan, the FITSP-Operator Study Guide walks through the process in depth.
Exam Format at a Glance
| Item | FITSP-Operator Detail |
|---|---|
| Question type | Multiple choice |
| Total items | 150 (120 scored + 30 beta) |
| Time allowed | 3 hours; breaks do not extend the timer |
| Language | English only |
| Reference materials | Closed book; personal calculators prohibited |
| Passing method | Operator-specific cut score set through an Angoff study and approved by the Scheme Committee |
| Published numeric threshold | Not published in the handbook retrieved |
| Delivery | Computer-based, administered and proctored by FITSI |
Two points deserve emphasis. First, you will not know which 30 items are the unscored beta questions, so treat every item as if it counts. Second, because no numeric passing percentage is published, avoid any source that claims to know the exact score needed. The page on the FITSP-Operator passing score explains what is and is not publicly documented.
With 150 items in 180 minutes, you have roughly 72 seconds per question on average. That pace is workable for recall-based items but tight for scenario questions that require you to map a situation to a specific publication, control family or RMF step. Practice at that pace, not at a leisurely one.
The Six Domains and Their Weights
The exam is built on six official weighted domains. These are distinct from the 18 cross-cutting security topic areas FITSI also uses to organize the body of knowledge, so do not confuse the two lists when reading older materials.
| Domain | Weight |
|---|---|
| Domain 1: NIST Special Publications (SPs) | 20% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 3: NIST Control Families (CFs) | 22% |
| Domain 4: Governmental Laws and Regulations | 19% |
| Domain 5: NIST Risk Management Framework (RMF) | 19% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 7% |
The first thing to notice is how concentrated the exam is in NIST material. Four of the six domains are NIST-centered, and the fifth, laws and regulations, is where the NIST framework gets its federal authority. For a deeper breakdown of how these areas are tested, see the complete guide to all six FITSP-Operator content areas.
A practical way to read the weights: Domains 1, 3 and 4 together account for 61% of the exam, and adding Domain 5 brings you to 80%. Nothing in the lighter domains is optional, but if your time is limited, protect the heavy ones first.
Must-Know Facts by Domain
Domain 3: NIST Control Families (22%)
The largest domain rewards candidates who can recognize a security control and its family from a short description. Operator-level questions lean toward how controls are applied and operated in day-to-day environments.
- Know the control families by name and what each one governs, such as access control, audit and accountability, configuration management, contingency planning and incident response.
- Be able to match an operational activity (reviewing logs, applying patches, managing accounts) to the family that owns it.
- Understand how baselines, tailoring and control enhancements relate to one another.
Domain 1: NIST Special Publications (20%)
The Special Publications are the working library of federal security practice. Candidates need to know which publication answers which question.
- Associate core publications with their purpose: control catalogs, assessment procedures, risk assessment, system categorization, contingency planning and incident handling.
- Know the difference between publications that define requirements and those that provide guidance.
- Expect questions that describe a task and ask which publication supports it.
Domain 4: Governmental Laws and Regulations (19%)
This domain covers the statutory and policy backdrop for federal information security.
- Know the major federal information security statutes, what each requires and which agencies are responsible for oversight.
- Understand how Office of Management and Budget guidance and presidential directives translate law into agency obligations.
- Be able to distinguish a law from a standard from a guideline, since the exam tests that hierarchy.
Domain 5: NIST Risk Management Framework (19%)
The RMF is a process, and the exam tests it as one. Memorize the order of the steps and what is produced at each.
- Know the sequence from preparation through monitoring, including categorize, select, implement, assess, authorize and monitor.
- Associate each step with its outputs and the roles responsible.
- Understand continuous monitoring as an ongoing activity rather than a final step.
Domain 2: NIST FIPS (13%)
The Federal Information Processing Standards are mandatory for federal systems, which makes them a compact, high-yield area.
- Know the purpose of the FIPS on security categorization, minimum security requirements and cryptographic module validation.
- Be able to recall what each standard mandates versus what a Special Publication merely recommends.
Domain 6: NIST Interagency Reports (7%)
The smallest domain still contributes meaningfully on a 120-item scored exam. Focus on what the key NISTIRs address and the topics they cover rather than memorizing fine detail.
- Know the general subject areas of the commonly referenced reports.
- Understand how NISTIRs differ from Special Publications in purpose and audience.
The Operator role emphasizes hands-on implementation and operation rather than program-level governance, and the official task objectives are laid out in the FITSP-Operator Certification Competence Breakdown (v3.0). Reading that document alongside your study materials helps calibrate how deep to go on each topic.
Fees, Registration and Exam-Day Rules
Fee Summary
| Item | Amount |
|---|---|
| Initial exam | USD 395 |
| Discounted same-role retest | USD 197.50 |
| Annual maintenance fee | USD 75 |
The retest discount applies to one retest of the same role, available after at least 21 calendar days and within one year of the initial exam. FITSI membership is optional. For the full financial picture, including maintenance over a certification cycle, see the FITSP-Operator certification cost breakdown.
Delivery and Identity Rules
- Remote testing requires a personal computer plus a separate phone or tablet for monitoring.
- Two signed IDs are required, and at least one must be a photo ID.
- Arrive or connect 30 minutes early to complete check-in.
- Breaks are allowed but the exam timer keeps running.
- No personal calculators and no reference materials.
One detail to verify directly: the handbook describes both in-person and remote delivery, but the registration page still labels in-person testing as unavailable. Check the registration page before you plan around a particular format, and review current exam dates and scheduling guidance for session availability.
Eligibility and Experience Waivers
Passing the exam is one part of becoming certified. FITSI also requires a documented professional background, and the application has to be submitted within five years of passing the exam.
Certification Requirements
- Five years of information-security experience
- A completed application and a current resume or CV
- Two professional endorsements
- Agreement to the FITSI Code of Ethics
Ways to Reduce the Experience Requirement
| Credential | Experience Waived |
|---|---|
| Accredited bachelor's degree | One year |
| IT or information-assurance master's degree | A second year |
| Issuer-listed security certification | One more year |
The waivers are capped at three years total, so the minimum experience requirement is two years. The details, including how to document experience, are covered in the FITSP-Operator requirements guide.
Staying Certified: The Three-Year Cycle
Once you are certified, the credential is valid for three years. To keep it, you have two paths: earn 60 continuing professional education (CPE) credits per certification over the cycle, or retest at the end of it. In either case you must observe the Code of Ethics and pay the USD 75 annual maintenance fee.
Sequencing Your Final Review
If you have several weeks before the exam, order your review by weight and by dependency. Start with the framework that ties everything together, then fill in the material that feeds it. A sample sequence tied to the domains:
RMF and Laws
- Learn the RMF step order and outputs (Domain 5).
- Map statutes and policy directives to the obligations they create (Domain 4).
Control Families
- Work through every family and what it governs (Domain 3, 22%).
- Connect each family to the RMF step where it is selected and assessed.
Publications and Standards
- Match Special Publications to their purposes (Domain 1).
- Review the FIPS and what they mandate (Domain 2).
NISTIRs and Timed Practice
- Cover the Interagency Reports (Domain 6).
- Take full-length timed sets at roughly 72 seconds per question.
The reasoning is simple: the RMF and the laws give you the structure, control families are the largest single block of points, and the lighter domains are easier to absorb once the framework is in place. Timed practice at the end builds the pacing the 3-hour limit demands. You can run through realistic sets on the FITSP-Operator practice test site, and the difficulty guide explains where candidates typically struggle.
Common Traps and Outdated Information
- Confusing domains with topic areas. The exam uses six weighted domains. The 18 cross-cutting security topic areas are a separate organizing structure and do not carry their own weights on the exam.
- Trusting old weights. Courseware built on the 2021 Body of Knowledge Guide may not reflect the weights effective June 1, 2024.
- Assuming a published passing percentage. The handbook does not publish a numeric threshold. Be skeptical of any source that states one. See the pass rate discussion for what can and cannot be said.
- Mixing credentials. Similar acronyms exist elsewhere in the security field. Fees, domains and renewal rules for any other credential do not apply here.
- Ignoring the application deadline. Passing the exam starts a five-year window to submit the certification application.
- Skipping ID preparation. Two signed IDs with at least one photo ID are required, and a mismatch can end your session before it begins.
Frequently Asked Questions
The exam has 150 multiple-choice items: 120 are scored and 30 are unscored beta items. You are given 3 hours, and the exam is closed book and offered in English only.
NIST Control Families is the largest domain at 22%, followed by NIST Special Publications at 20%. Governmental Laws and Regulations and the NIST Risk Management Framework each carry 19%.
One discounted same-role retest costs USD 197.50. It must be taken at least 21 calendar days after the initial attempt and within one year of it. The initial exam is USD 395.
Yes. Certification requires five years of information-security experience, which can be reduced by up to three years through a bachelor's degree, a relevant master's degree and an issuer-listed security certification. You also need two endorsements and a resume. See the ROI analysis if you are weighing whether the effort pays off.
Three years. You can recertify by earning 60 CPE credits over the cycle or by retesting at the end, and you must pay the USD 75 annual maintenance fee and follow the Code of Ethics. The older six-year cycle no longer applies.
Use this sheet as a checklist rather than a substitute for study: confirm the format, internalize the domain weights, verify your eligibility and fees against current FITSI documents, then spend your remaining time on the control families, publications and RMF steps that carry the most points.