- FITSP-Operator is the Operator role credential from the Federal IT Security Institute (FITSI), built around federal security standards.
- The exam has 150 multiple-choice items in 3 hours; 120 are scored and 30 are unscored beta items.
- NIST Control Families is the heaviest domain at 22%, followed by NIST Special Publications at 20%.
- Certification needs five years of security experience, though degrees and certifications can waive up to three years.
What FITSP-Operator Actually Is
FITSP-Operator is a role-based information security certification for professionals who operate, maintain, and defend federal information systems. The acronym stands for Federal IT Security Professional, and "Operator" names the specific role the credential validates. FITSI's shorthand is FITSP-O, and the current handbook refers to the credential as FITSP-Operator-NG, where "NG" denotes the next-generation version of the scheme.
Unlike broad, vendor-neutral security certifications that survey the whole industry, this credential is anchored in the body of standards, publications, and legal requirements that govern federal information security. Candidates are tested on how federal guidance is structured and applied: which NIST publication covers which problem, how control families map to operational duties, and which laws and regulations drive agency obligations.
If you want a shorter orientation to the terminology first, see our explainers on what FITSP-Operator is and what the name stands for. This article goes deeper into the structure, mechanics, and costs of the certification.
Who Issues It and How the Role Fits
The credential is issued by the Federal IT Security Institute (FITSI). FITSI also administers and proctors the computer-based examination. Membership in FITSI is optional, so you do not need to join the organization to sit for the exam or pursue certification.
The "Operator" designation reflects an operations-oriented perspective. FITSI defines official task objectives for the role in its FITSP-Operator Certification Competence Breakdown, and the exam content reflects the hands-on responsibilities of people who run systems rather than those who design security architecture or manage programs at a strategic level. Where other FITSP roles emphasize design, management, or auditing, the Operator track focuses on the day-to-day application of federal requirements to live systems.
Exam Format and Logistics
Structure and Timing
The examination is computer-based and consists of 150 multiple-choice items delivered in 3 hours. Of those items, 120 are scored and 30 are beta items, which FITSI uses for evaluating future questions. You will not be told which questions fall into which group, so every item deserves your full effort. The exam is offered in English only and is closed book. Personal calculators are prohibited.
Breaks do not extend the timer. If you step away, the clock keeps running, so plan to arrive prepared to sit through the session with minimal interruption.
Passing Standard
Scoring uses an Operator-specific cut score established through an Angoff study and approved by FITSI's Scheme Committee. The retrieved handbook does not publish a numeric threshold, so be skeptical of any source claiming an exact percentage required to pass. For a fuller treatment of what is and is not known, read our passing score guide.
Remote Testing Requirements
Remote delivery requires a personal computer plus a separate monitoring phone or tablet. You must present two signed IDs, at least one of which is a photo ID. Plan to connect or arrive 30 minutes before your scheduled start. The handbook describes both in-person and remote delivery, but the registration page has still labeled in-person testing as unavailable, so confirm which session types are actually offered before you plan around a testing center. Our exam dates and scheduling guide covers how to check availability.
| Exam Element | Detail |
|---|---|
| Total items | 150 multiple-choice |
| Scored / beta items | 120 scored, 30 beta |
| Time allowed | 3 hours |
| Language | English only |
| Reference materials | Closed book; no personal calculators |
| Remote setup | Personal computer plus separate monitoring phone or tablet |
| Identification | Two signed IDs, including one photo ID |
| Check-in | Connect or arrive 30 minutes early |
The Six Weighted Domains
The exam outline comes from FITSI's Certification Candidate Handbook, with weights effective June 1, 2024. The six domains below determine how the exam is composed. Current handbook weights take precedence over older reference lists and courseware, some of which still reflect earlier structures. For a deeper walk-through, see the complete domains guide.
Domain 3: NIST Control Families (CFs) - 22%
The largest domain. Candidates need to recognize the control families, understand what each family is meant to accomplish, and connect them to operational activities on federal systems.
- Know the purpose of each family well enough to identify which one a scenario describes
- Understand how controls are selected, implemented, and assessed in practice
- Expect scenario-style questions that ask you to match a requirement to the right family
Domain 1: NIST Special Publications (SPs) - 20%
The second-heaviest domain covers the NIST Special Publication series that underpin federal security practice.
- Learn what each key publication is for and when it is the right reference
- Distinguish publications that address controls, assessment, risk, and system lifecycle activities
- Be able to say which document an operator would consult for a given task
Domain 4: Governmental Laws and Regulations - 19%
Federal security is driven by statute and policy. This domain tests whether you understand the legal and regulatory drivers behind agency security obligations.
- Know which laws establish requirements and what they require of agencies
- Understand how policy flows from legislation down to technical standards
- Be ready for questions about responsibilities rather than technical configuration
Domain 5: NIST Risk Management Framework (RMF) - 19%
The RMF is the lifecycle process federal systems follow to manage security and privacy risk.
- Know the steps of the framework in order and the purpose of each
- Understand where the Operator role contributes to authorization and continuous monitoring
- Link RMF activities to the publications that support them
Domain 2: NIST Federal Information Processing Standards (FIPS) - 13%
FIPS are mandatory standards for federal systems, and the exam expects you to know what the key ones establish.
- Understand which standards cover categorization, minimum requirements, and cryptographic protection
- Distinguish mandatory FIPS from advisory guidance
Domain 6: NIST Interagency Reports (NISTIRs) - 7%
The smallest domain, but still scored. NISTIRs cover research and technical findings relevant to federal security.
- Know what the NISTIR series is and how it differs from SPs and FIPS
- Do not skip it: a 7% domain is a meaningful share of 120 scored items
| Domain | Weight |
|---|---|
| NIST Control Families (CFs) | 22% |
| NIST Special Publications (SPs) | 20% |
| Governmental Laws and Regulations | 19% |
| NIST Risk Management Framework (RMF) | 19% |
| NIST Federal Information Processing Standards (FIPS) | 13% |
| NIST Interagency Reports (NISTIRs) | 7% |
Experience Requirements and Waivers
Passing the exam is only one part of earning the credential. Certification requires a combination of experience and documentation:
- Five years of information-security experience
- A completed application
- A current resume or CV
- Two professional endorsements
- Agreement to FITSI's Code of Ethics
You must submit the application within five years of passing the exam, so the exam result does not stay valid indefinitely if you delay the paperwork.
How the Experience Waivers Work
The five-year requirement can be reduced by up to three years in total:
- An accredited bachelor's degree can waive one year.
- An IT or information-assurance master's degree can waive a second year.
- An issuer-listed security certification can waive one more year.
A candidate who holds all three could therefore qualify with as little as two years of direct experience. Because the waivers depend on the issuer's own list of accepted certifications and degree types, verify your credentials against FITSI's published requirements. Our requirements guide goes through each step of qualifying.
Fees at Each Stage
The fee schedule is straightforward but has several moving parts across the life of the credential:
| Fee | Amount | Notes |
|---|---|---|
| Initial exam | USD 395 | Standard first attempt |
| Discounted retest | USD 197.50 | Same role; at least 21 calendar days after the initial exam and within one year of it |
| Annual maintenance | USD 75 | Paid each year while certified |
The retest discount comes with timing conditions. You must wait at least 21 calendar days, and you must retake within one year of the initial exam. That waiting period is useful in practice: it gives you time to analyze weak domains rather than rushing back in. For a complete breakdown including what to budget over a full certification cycle, see the certification cost guide.
Keeping the Credential Current
A FITSP-Operator certification is valid for three years. To maintain it, you have two paths:
- Earn continuing professional education credits: 60 CPE credits per certification over the three-year cycle.
- Retest: sit the exam again at the end of the cycle.
In either case, you must observe the Code of Ethics and pay the USD 75 annual maintenance fee. FITSI's 2025 Holder Handbook covers both legacy and NG credentials.
Who Benefits From It
The credential is most relevant to people working in or alongside the federal information-security ecosystem. That includes government employees responsible for operating systems under federal requirements, as well as contractors who support agencies and must demonstrate familiarity with NIST guidance and federal compliance expectations.
Because the content centers on federal standards, the clearest fit is for roles where authorization, control implementation, and compliance with federal policy are part of the job description. Practitioners outside that world may find the material less directly applicable than broader industry certifications. To explore concrete roles, see our overview of FITSP-Operator jobs, and for the financial side, the salary guide and the ROI analysis help you judge whether it fits your career path.
Sequencing Your Preparation
Generic study technique matters less here than ordering the material sensibly around the domain structure. One approach that fits the exam's design is to build from the foundations upward:
Laws, Regulations, and FIPS
- Start with Governmental Laws and Regulations (19%) and FIPS (13%) because they supply the vocabulary and the mandatory requirements everything else references
RMF and Special Publications
- Study the RMF (19%) alongside NIST Special Publications (20%), since the framework steps point to specific publications
Control Families and NISTIRs
- Spend your largest block on Control Families (22%) once you know the surrounding documents, then close with the lighter NISTIR domain (7%)
Practice questions are especially valuable for this exam because the format rewards precise recall of which document or family answers a given scenario. For a full preparation plan, read the study guide and keep the cheat sheet handy for last-minute review. When you are ready to test yourself against realistic multiple-choice items, work through the FITSP-Operator practice tests.
Key Takeaway
Weight your time by the domain percentages, but remember that 7% of 120 scored items is still a real block of questions. Because you cannot tell scored items from beta items, treat all 150 questions as if they count.
Frequently Asked Questions
The Federal IT Security Institute (FITSI) issues the credential and also administers and proctors the computer-based exam. Membership in FITSI is optional.
The exam has 150 multiple-choice items in 3 hours. Of these, 120 are scored and 30 are unscored beta items, and you cannot tell which is which.
FITSI uses an Operator-specific cut score set through an Angoff study and approved by its Scheme Committee. The retrieved handbook does not publish a numeric threshold, so no exact percentage can be stated reliably.
Certification requires five years of information-security experience, but up to three years can be waived: one for an accredited bachelor's degree, one for an IT or information-assurance master's, and one for an issuer-listed security certification.
It is valid for three years. You maintain it with 60 CPE credits per certification over the cycle or by retesting, while following the Code of Ethics and paying the USD 75 annual maintenance fee.
For a broader look at the credential from other angles, see our main page on FITSP-Operator certification, and when you are ready to begin practicing, head to the practice test hub.