- What "Qualifying" Actually Means for FITSP-Operator
- Two Gates: The Exam and the Certification Application
- The Five-Year Experience Requirement and How Waivers Work
- Building Your Application Package
- Exam-Day Requirements and Testing Rules
- Fees You Should Budget For
- The Knowledge You Are Required to Demonstrate
- Staying Certified: Three-Year Cycle and CPE
- A Domain-Driven Preparation Sequence
- Who Benefits From This Credential
- Frequently Asked Questions
- FITSP-Operator certification requires five years of information-security experience, but passing the exam is a separate step from being certified.
- A bachelor's degree, an IT/IA master's, and a listed security certification can each waive one year, up to three total.
- The initial exam costs USD 395; one same-role retest is USD 197.50 after 21 days and within one year.
- Submit your certification application within five years of passing the exam, with two professional endorsements and a current resume.
What "Qualifying" Actually Means for FITSP-Operator
The Federal IT Security Professional - Operator credential, issued by the Federal IT Security Institute (FITSI), is built for practitioners who run and maintain federal information systems day to day. In FITSI's shorthand it appears as FITSP-O, and the current handbook family is titled FITSP-Operator-NG. If you are still getting oriented, our overview What Is FITSP-Operator? explains the role-based design, and What Is FITSP-Operator Certification? covers the credential's purpose.
When people search for "requirements," they usually mean one of three things: who is allowed to sit the exam, what is needed to be awarded the certification, and what is needed to keep it. These are distinct questions with distinct answers. Mixing them up is the most common source of confusion, and it can cost candidates money or time. This guide separates them clearly and gives you the exact mechanics from FITSI's published documents.
Two Gates: The Exam and the Certification Application
Think of FITSP-Operator qualification as two gates you must pass through.
Gate One: The Examination
FITSI administers and proctors the computer-based exam. It consists of 150 multiple-choice items delivered in 3 hours, in English only. Of those 150 items, 120 are scored and 30 are beta items used to evaluate future questions; you cannot tell which is which, so treat every question as live. The exam is closed book, and personal calculators are prohibited. FITSI membership is optional, so you do not need to join anything to register.
Gate Two: The Certification Application
Separately from the exam, certification requires five years of information-security experience, a completed application, a current resume or CV, two professional endorsements, and agreement to the Code of Ethics. The application must be submitted within five years of passing the exam. That five-year window is generous, but it is not infinite, so do not let a passed exam sit idle while you accumulate experience without tracking the deadline.
| Requirement | Exam Gate | Certification Gate |
|---|---|---|
| Core test | 150 questions, 3 hours | Not applicable |
| Experience | No stated prerequisite for sitting | Five years of information-security experience (waivers possible) |
| Documentation | Two signed IDs on test day | Application, current resume/CV, two endorsements |
| Ethics | Not applicable | Agree to the Code of Ethics |
| Timing rule | Retest after 21+ days, within one year | Apply within five years of passing |
The Five-Year Experience Requirement and How Waivers Work
The baseline is five years of information-security experience. FITSI allows certain education and certification credentials to reduce that figure, up to a maximum of three years waived in total:
- Accredited bachelor's degree: waives one year.
- Master's degree in IT or information assurance: waives a second year.
- An issuer-listed security certification: waives one more year.
Stack all three and you reach the three-year ceiling, which would leave a minimum of two years of hands-on experience. Note the wording carefully: the certification waiver applies to certifications on FITSI's listed set, not to any security credential you happen to hold, and the master's waiver is tied to an IT or information-assurance field. Confirm your specific degree and certification against the current list on the FITSI requirements page before assuming a waiver will apply.
What Counts as Information-Security Experience
For the Operator role, relevant experience is typically hands-on work operating, configuring, monitoring, and maintaining systems within a security-governed environment, as opposed to purely managerial or purely theoretical work. FITSI's FITSP-Operator Certification Competence Breakdown lays out the role's official task objectives, and it is a useful lens for describing your experience in your application. If your resume describes patching, configuration management, access control administration, audit log review, or contingency operations in a federal or federal-contractor setting, those map naturally onto Operator duties. Our FITSP-Operator jobs page shows the kinds of positions where this experience is gained.
Building Your Application Package
Because the application is a formal review of your professional record, treat it as a deliverable that deserves the same care as exam prep.
Current Resume or CV
Your resume should make the experience math easy for a reviewer. Include dates, employers, and descriptions of security responsibilities. If you are claiming waivers, make the degree and any qualifying certification visible so the reviewer does not have to hunt for them.
Two Professional Endorsements
You need two professional endorsements. Choose endorsers who can speak credibly to your information-security work, such as supervisors, senior colleagues, or clients who have observed your performance. Give them lead time and a short summary of the role you are pursuing; a rushed endorsement is the most common reason application packages stall.
Code of Ethics Agreement
You must agree to the FITSI Code of Ethics as part of the application, and you must continue to observe it for as long as you hold the credential. Read it before you apply instead of treating it as a checkbox.
Key Takeaway
Start collecting your endorsements and polishing your resume while you study, not after you pass. Because the application window runs five years from your exam date, there is no rush, but a ready package turns a passed exam into a certification quickly.
Exam-Day Requirements and Testing Rules
The exam itself has logistical requirements that trip up otherwise well-prepared candidates.
- Identification: Two signed IDs are required, and one must be a photo ID.
- Arrival or connection time: Connect or arrive 30 minutes early.
- Breaks: Breaks do not extend the timer, so the 3 hours keep running.
- Materials: The exam is closed book, and personal calculators are not allowed.
- Remote setup: Remote testing uses a personal computer plus a separate monitoring phone or tablet.
Delivery Availability: Check Before You Plan
FITSI's handbook describes both in-person and remote delivery. However, the registration page has still labeled in-person testing as unavailable, so actual session availability must be checked directly rather than assumed from the handbook. Review the registration page before you commit to a plan, and read our FITSP-Operator exam dates guide for scheduling considerations.
Fees You Should Budget For
| Item | Amount | Notes |
|---|---|---|
| Initial exam | USD 395 | One attempt |
| Same-role retest | USD 197.50 | Discounted; at least 21 calendar days after, within one year of the initial exam |
| Annual maintenance | USD 75 | Due each year while certified |
The retest discount is conditional. It applies to the same role (Operator), and the retest must be taken no sooner than 21 calendar days after your first attempt and no later than one year after it. Miss that window and you would presumably be back to standard pricing. Fees come from FITSI's published schedule, so check the current Fee Schedule before paying. For a fuller financial picture, including how the maintenance fee fits into long-term cost, see FITSP-Operator certification cost.
The Knowledge You Are Required to Demonstrate
Eligibility paperwork gets you to the exam; the exam itself tests a defined body of federal security knowledge across six weighted domains. These domains are distinct from FITSI's broader set of 18 cross-cutting security topic areas, which describe subject matter rather than exam structure. Weights below are effective from June 1, 2024, per the Candidate Handbook.
| Domain | Weight |
|---|---|
| Domain 1: NIST Special Publications (SPs) | 20% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 3: NIST Control Families (CFs) | 22% |
| Domain 4: Governmental Laws and Regulations | 19% |
| Domain 5: NIST Risk Management Framework (RMF) | 19% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 7% |
Domain 3: NIST Control Families (22%)
The largest domain. Operators live in the controls, so expect questions on how families such as access control, audit and accountability, configuration management, contingency planning, and system and communications protection are implemented and maintained in practice.
- Know what each control family is for and how families interact.
- Focus on operational application, not memorizing control numbers in isolation.
Domain 1: NIST Special Publications (20%)
Be able to identify which publication addresses which problem, such as security controls, assessment, continuous monitoring, or contingency planning, and what an operator is expected to do with each.
Domain 4 and Domain 5: Laws and the RMF (19% each)
Together these account for 38% of the exam. Candidates must connect federal statutes and regulations to the Risk Management Framework lifecycle, and understand where an operator's tasks fit within each RMF step.
Domain 2 and Domain 6: FIPS and NISTIRs (13% and 7%)
Smaller in weight but still testable. FIPS questions center on mandatory federal standards, while NISTIR coverage is the lightest area, though it rewards candidates who know the terminology.
For a detailed walkthrough of each area, see FITSP-Operator exam domains: complete guide to all 6 content areas. Reference inventories such as the Federal Body of Knowledge Guide can help you scope reading, but current handbook weights take precedence over older reference and courseware lists.
Staying Certified: Three-Year Cycle and CPE
Meeting the requirements once is not the end. Certification is valid for three years. To maintain it, you have two paths at the end of the cycle: earn 60 CPE credits per certification over that cycle, or retest. Throughout, you must observe the Code of Ethics and pay the USD 75 annual maintenance fee.
Because the CPE target is tied to the three-year window, it is smart to log relevant training, conferences, and professional activity as you go instead of reconstructing it at the deadline.
A Domain-Driven Preparation Sequence
You do not need a generic study calendar, but sequencing by domain weight and dependency helps. One reasonable ordering for a roughly eight-week plan:
Frameworks First: RMF and Laws
- Learn the RMF lifecycle (Domain 5) since it organizes everything else.
- Map federal laws and regulations (Domain 4) onto each RMF step.
The Heavy Hitters: Controls and SPs
- Work through control families (Domain 3, 22%) with operational scenarios.
- Pair them with the NIST SPs (Domain 1, 20%) that define and assess them.
Standards and Reports
- Cover FIPS (Domain 2) and NISTIRs (Domain 6).
- Take timed practice sets in the 150-question format.
Review and Logistics
- Revisit weak domains and rehearse exam-day procedures.
- Confirm ID, remote setup, and delivery availability.
This sequencing puts the highest-weighted and most interconnected material in the middle of your timeline, where you have the most time to revisit it. For deeper tactics, see the FITSP-Operator study guide, and when you are ready to measure yourself, try the practice tests to simulate the time pressure of 150 questions in 3 hours. If you want a sense of difficulty before committing, read how hard the FITSP-Operator exam is.
Who Benefits From This Credential
FITSP-Operator is aimed at people who operate and maintain systems in federal environments, including federal employees and contractors supporting agency systems. The credential signals familiarity with NIST guidance, federal law, and the RMF, which is exactly the vocabulary used in federal authorization and compliance work. If you are weighing whether the investment makes sense for your career, is the FITSP-Operator certification worth it walks through the return analysis, and the FITSP-Operator training page covers preparation options. For the exam's scoring approach, including how the Operator-specific cut score is set, see FITSP-Operator passing score.
Frequently Asked Questions
The five-year information-security experience requirement applies to certification, not to sitting the exam. You can pass the exam first and then submit your application, provided you do so within five years of passing and can document the required experience.
An accredited bachelor's degree can waive one year, an IT or information-assurance master's can waive a second, and an issuer-listed security certification can waive one more. The maximum total waiver is three years, so check how FITSI credits your specific credentials.
FITSI offers one discounted same-role retest at USD 197.50. You must wait at least 21 calendar days after your initial attempt and take it within one year of that attempt.
No. Membership is optional. The initial exam costs USD 395, and FITSI administers and proctors the computer-based test regardless of membership status.
Certification is valid for three years. To recertify you earn 60 CPE credits per certification over that cycle or retest at its end, while observing the Code of Ethics and paying the USD 75 annual maintenance fee.
Meeting FITSP-Operator requirements is a matter of clearing the exam, documenting your experience, and committing to ongoing maintenance. Verify every detail against FITSI's current handbooks before you act, since policies such as the renewal cycle have changed in recent years.