- What FITSP-Operator Actually Is
- FITSI and the Operator Role
- How the Exam Is Built and Delivered
- The Six Weighted Domains
- Domains vs. the 18 Cross-Cutting Topic Areas
- Fees and Registration Mechanics
- Experience Requirements and Waivers
- Keeping the Credential Active
- Who Uses It and Where It Fits
- Sequencing Your Study Around the Weights
- Frequently Asked Questions
- FITSP-Operator is the Operator-role credential from the Federal IT Security Institute (FITSI), also written FITSP-O.
- The exam has 150 multiple-choice items: 120 scored, 30 beta, in 3 hours, closed book.
- NIST Control Families is the heaviest domain at 22%; NISTIRs is the lightest at 7%.
- Initial exam costs USD 395; one same-role retest costs USD 197.50 after at least 21 days.
What FITSP-Operator Actually Is
FITSP-Operator is a role-based information-security certification focused on the practical, day-to-day work of operating and protecting federal information systems. It is issued by the Federal IT Security Institute (FITSI) as the Operator track of the Federal IT Security Professional (FITSP) scheme. You will see the shorthand FITSP-O in issuer materials, and FITSI's current handbook refers to the credential as FITSP-Operator-NG (the "NG" denotes the next-generation version of the scheme).
The defining feature is the knowledge base. Instead of testing generic security theory or vendor products, the exam measures how well you know the federal security ecosystem: NIST publications, federal standards, control families, laws and regulations, and the Risk Management Framework. If your work touches federal systems, contractors serving agencies, or compliance with federal mandates, this is the body of knowledge the credential validates.
For deeper definitional angles, see our companion pieces on what FITSP-Operator stands for and what the FITSP-Operator certification involves.
FITSI and the Operator Role
FITSI administers and proctors the computer-based examination. Membership in the organization is optional, so you do not need to join anything to sit for the test or earn the credential.
The FITSP scheme is organized by role, and the Operator role is the one aimed at people who run, maintain and secure systems rather than those who design, manage or audit them. FITSI publishes a FITSP-Operator Certification Competence Breakdown (v3.0, April 30, 2023) that lays out the official task objectives for the role. That document is the best authority on what an "Operator" is expected to be able to do, and it is worth reading before you commit to a study plan.
How the Exam Is Built and Delivered
The exam is a single sitting with a fixed structure:
- 150 multiple-choice items in total.
- 120 scored items and 30 beta items (unscored items being evaluated for future use; you cannot tell which are which).
- 3 hours to complete the exam, and breaks do not pause or extend the timer.
- English only.
- Closed book, with personal calculators prohibited.
Passing method
Passing is based on an Operator-specific cut score established through an Angoff study and approved by FITSI's Scheme Committee. The retrieved handbook does not publish a numeric threshold, so be skeptical of any site that quotes a specific percentage as official. We cover what is and isn't known in our article on the FITSP-Operator passing score.
Remote and in-person delivery
Remote testing uses a personal computer plus a separate phone or tablet for monitoring. You must present two signed IDs, at least one of them a photo ID, and you should connect or arrive 30 minutes early. The handbook describes both in-person and remote delivery, but the registration page has labeled in-person testing as unavailable, so confirm which session types are actually offered before you plan around a testing center. For scheduling realities, see FITSP-Operator exam dates and deadlines.
The Six Weighted Domains
FITSI's candidate handbook (v3.7) defines six official exam domains, with weights effective June 1, 2024. These weights tell you where the points are, and they should drive how you allocate study time.
| Domain | Weight |
|---|---|
| Domain 3: NIST Control Families (CFs) | 22% |
| Domain 1: NIST Special Publications (SPs) | 20% |
| Domain 4: Governmental Laws and Regulations | 19% |
| Domain 5: NIST Risk Management Framework (RMF) | 19% |
| Domain 2: NIST Federal Information Processing Standards (FIPS) | 13% |
| Domain 6: NIST Interagency Reports (NISTIRs) | 7% |
Domain 3: NIST Control Families (22%)
The largest domain rewards candidates who understand what each control family is for and how families relate, not just their names.
- Recognize the purpose and typical controls within each family.
- Match a described scenario to the family that governs it.
- Distinguish technical, operational and management-oriented controls.
Domain 1: NIST Special Publications (20%)
Expect questions on which SP addresses which problem, and what each is meant to accomplish.
- Know the intent and scope of the core security and privacy SPs.
- Understand how SPs support one another in a program.
Domain 4: Governmental Laws and Regulations (19%)
This is the domain where non-federal practitioners often have gaps.
- Understand the major federal security and privacy statutes and what they require.
- Connect legal mandates to the standards and processes that implement them.
Domain 5: NIST Risk Management Framework (19%)
The RMF is a process, and questions often test order and purpose.
- Know each RMF step, its inputs and its outputs.
- Recognize who does what at each stage.
Domain 2: NIST FIPS (13%)
Federal Information Processing Standards are mandatory for federal systems and tend to be more concrete.
- Know what each relevant FIPS standardizes.
- Understand how FIPS drive categorization and cryptographic requirements.
Domain 6: NIST Interagency Reports (7%)
The smallest domain, but still worth a focused pass rather than a skip.
- Understand the role of NISTIRs relative to SPs and FIPS.
- Be familiar with the topics the key reports cover.
For a domain-by-domain walkthrough, read our complete guide to all six FITSP-Operator content areas.
Domains vs. the 18 Cross-Cutting Topic Areas
One point that trips up new candidates: FITSI's scope includes 18 cross-cutting security topic areas in addition to the six weighted exam domains. These are different things. The domains are how the exam is weighted and scored; the topic areas are subject themes (such as access control or incident response) that cut across the domains. A question in the Control Families domain, for instance, can touch a topic area that also surfaces in an RMF or SP question.
Fees and Registration Mechanics
The published fee schedule is straightforward:
- Initial exam: USD 395.
- Discounted same-role retest: USD 197.50, available after at least 21 calendar days and within one year of the initial exam.
- Annual maintenance fee: USD 75 once certified.
The retest rules reward planning. You cannot immediately rebook after a failed attempt, and the discount only applies to a retest for the same role within the one-year window. Registration runs through FITSI's exam registration page, and the session-type caveat above applies: verify what is actually available before you assume a delivery option. Our FITSP-Operator certification cost breakdown walks through the full financial picture.
Experience Requirements and Waivers
Passing the exam is only part of earning the credential. Certification requires:
- Five years of information-security experience.
- A completed application with a current resume or CV.
- Two professional endorsements.
- Agreement to FITSI's Code of Ethics.
You must submit the application within five years of passing the exam, so passing early without a plan to meet the experience requirement can create a deadline problem.
| Waiver | Years credited |
|---|---|
| Accredited bachelor's degree | 1 |
| IT or information-assurance master's degree | 1 more |
| Issuer-listed security certification | 1 more |
Waivers stack up to a maximum of three years total, which means even a fully credentialed candidate still needs at least two years of hands-on experience. See FITSP-Operator requirements for eligibility details.
Keeping the Credential Active
Once certified, the credential is valid for three years. To keep it current you can either earn 60 continuing professional education (CPE) credits per certification over that cycle or retest at the end of it. Either way, you must observe the Code of Ethics and pay the USD 75 annual maintenance fee.
Who Uses It and Where It Fits
Because the exam content is anchored in NIST guidance, federal standards and federal law, the credential is most relevant to people working in or for the federal space: agency staff, government contractors, and operators of systems that must meet federal security requirements. Typical job families include system and security administrators, information-assurance and compliance staff, and technical staff supporting authorization and continuous monitoring activities. Roles that never touch federal frameworks will find less direct use for the specific knowledge tested.
We discuss the market side in FITSP-Operator jobs, the salary guide, and whether the certification is worth it. We deliberately avoid quoting unsourced salary or pass-rate numbers here; for the evidence that does exist, see what the data shows on pass rates.
Sequencing Your Study Around the Weights
You do not need an elaborate method. The most useful principle is to let the domain weights and the dependencies between domains decide your order. One workable sequence, assuming you study several weeks:
Foundations: Laws and FIPS
- Domain 4 (19%) and Domain 2 (13%) give you the "why" and the mandatory standards that everything else rests on.
Process and Publications: RMF and SPs
- Domain 5 (19%) and Domain 1 (20%) together; the RMF steps make far more sense once you know the SPs that support them.
Controls, the heaviest domain
- Domain 3 (22%) benefits from having the RMF and SP context already in place.
NISTIRs and timed practice
- A focused pass on Domain 6 (7%), then full-length timed practice against the 3-hour limit.
Use timed practice to build stamina for 150 questions in three hours, and review every miss by domain so you can see where the gaps actually are. For a fuller plan, see the FITSP-Operator study guide, the one-page cheat sheet, and our assessment of how hard the exam is. When you are ready to test yourself, try the FITSP-Operator practice tests and compare your results across domains.
Key Takeaway
Treat the six weighted domains as your study map, the 18 topic areas as connective themes, and the handbook as the final authority. Confirm exam logistics and any unpublished details directly with FITSI before you book.
Frequently Asked Questions
The Federal IT Security Institute (FITSI) issues it and also administers and proctors the exam. The issuer shorthand is FITSP-O, and the current handbook name is FITSP-Operator-NG. Membership in FITSI is optional.
There are 150 multiple-choice items in 3 hours: 120 scored and 30 unscored beta items. The exam is closed book, English only, and breaks do not extend the timer.
FITSI uses an Operator-specific cut score set through an Angoff study and approved by its Scheme Committee. The retrieved handbook does not publish a numeric threshold, so no official percentage can be cited.
Yes. Certification requires five years of information-security experience, an application with a current resume, two professional endorsements and agreement to the Code of Ethics. A bachelor's, a relevant master's and a listed certification can each waive one year, up to three total.
It is valid for three years. You renew with 60 CPE credits per certification over the cycle or by retesting at the end, while observing the Code of Ethics and paying the USD 75 annual maintenance fee.