- CCITP-F has 110 questions: 100 scored, 10 unscored pilot items, over 130 minutes.
- Passing standard is 650 of 800 scaled points - not a raw percentage.
- Researching (30%) and the joint Synthesis & Tools and Methods group (35%) carry the heaviest weight.
- Eligibility requires 6 months in a C-InT program, 10 training hours, and Program Manager approval.
CCITP-F At a Glance
If you need a single-page refresher before test day, this cheat sheet pulls together the exact facts that matter for the Certified Counter-Insider Threat Professional - Fundamentals (CCITP-F) exam - no filler, no borrowed statistics from other credentials that happen to share the acronym. Everything below traces back to the current official CCITP Program Candidate Handbook (March 2025). For a deeper walkthrough of any single fact, pair this page with the full CCITP-F Study Guide 2026, which covers pacing and content strategy in more detail.
Exam Format: Questions, Timing, Scoring
The current handbook (printed page 6) specifies a fixed structure that every candidate should memorize before scheduling:
- Total questions: 110 multiple-choice items
- Scored questions: 100
- Unscored pilot questions: 10 (used to field-test future items; you won't know which ones these are)
- Question style: each item has exactly one correct answer - no multi-select, no "choose all that apply"
- Duration: 130 minutes (two hours and ten minutes; recorded as 2.1667 exam hours)
- Passing standard: 650 out of 800 scaled points
That scaled-point threshold is worth sitting with for a moment. It is not "81% correct" or any similar percentage - it's a scaled score derived from the 100 scored items, and a score report by itself is not the final certification conferral decision. For a dedicated breakdown of how the scaling works and what margin you should target, see CCITP-F Passing Score 2026.
Key Takeaway
Budget roughly 70 seconds per question across the 130-minute window, but don't burn time hunting for the 10 pilot questions - you can't identify them, so treat every item as scored.
One historical note worth flagging because it trips up people reading older forum posts: an earlier Spring 2024 (V1_8) handbook listed 115 total questions with 15 pilots. That version is superseded. The current, authoritative figure for this component is 110 total - 100 scored, 10 pilot. If you see "115" or "15 pilot" referenced anywhere, it's outdated and should not be used for planning.
The Four Domain Groups
The issuer publishes five topic areas rolled into four weighted domain groups. Memorize these weights cold - they tell you where to spend your limited study hours.
| Domain | Weight | Relative Priority |
|---|---|---|
| Policy and Directives | 25% | High |
| Social and Behavioral Science | 10% | Lowest |
| Researching | 30% | Highest |
| Synthesis & Tools and Methods (joint) | 35% | Highest |
Note that Synthesis and Tools and Methods are published as a single joint 35% group - the issuer does not break that figure into two separate sub-percentages, so don't try to invent a split when allocating study time. For a full content map of what each domain actually tests, read the CCITP-F Exam Domains 2026 guide.
Domain 1: Policy and Directives (25%)
Candidates must understand the governing directives and policy frameworks that structure counter-insider-threat programs, including how authorities and responsibilities are distributed across program roles.
- Know which policy documents establish program authority
- Understand how directives translate into program-level requirements
Domain 2: Social and Behavioral Science (10%)
The smallest weighted domain, but still tested directly. Focus on behavioral indicators and the social-science foundations used to interpret insider-threat risk factors.
- Behavioral indicator categories
- How behavioral science informs risk assessment, not just technical indicators
Domain 3: Researching (30%)
One of the two heaviest domains. This covers how a C-InT professional gathers, validates, and documents information relevant to a potential insider-threat concern.
- Research methodology and source validation
- Documentation standards tied to program requirements
Domain 4: Synthesis & Tools and Methods (35%)
The single largest weighted group. Candidates must be able to combine findings from research and policy knowledge into coherent assessments, and apply the tools and methods used in C-InT analytic work.
- Turning raw research into a synthesized assessment
- Correct application of program tools and analytic methods
Do not cross-reference material from the separate CCITP-Analysis credential (including its Vulnerabilities Assessment topic) - that content belongs to a different component of the CCITP program and will not help you on Fundamentals.
Eligibility Snapshot
CCITP-F is not an open-entry exam, which surprises some candidates. Before you can even register, you need:
- Current status as counter-insider-threat program personnel or affiliated personnel
- At least six months of experience working in or with a C-InT program
- At least ten hours of related training
- Program Manager approval
If any of those boxes aren't checked yet, review the full breakdown in CCITP-F Requirements 2026 before you plan a study timeline - there's no point memorizing domain content if the eligibility gate isn't cleared first.
Must-Know Topics By Domain
Beyond the domain weights, here's the practical checklist to run through in your final review pass:
- Policy and Directives: can you identify which directive governs a given program function without hesitating?
- Social and Behavioral Science: can you distinguish a behavioral indicator from a purely technical one?
- Researching: can you walk through a research task from question to validated finding?
- Synthesis & Tools and Methods: can you take two or three pieces of researched information and synthesize them into a single coherent judgment, using the correct method or tool for the task?
If you're still unsure how tough this combination actually is in practice, the How Hard Is the CCITP-F Exam? guide walks through what makes the Researching and Synthesis domains the real differentiators between a pass and a retake.
One-Week Review Schedule
If you're using this cheat sheet as your final-week review rather than your primary study plan, allocate days by domain weight - heaviest domains get the most days, lightest domain gets a single targeted session.
Researching (30%)
- Drill source validation and documentation scenarios
- Review how research findings feed into program decisions
Synthesis & Tools and Methods (35%)
- Practice combining multiple data points into one assessment
- Review the specific tools/methods named in the handbook
Policy and Directives (25%)
- Match directives to the program functions they govern
Social and Behavioral Science (10%)
- One focused pass on behavioral indicator categories
Full Review
- Timed practice run at 130 minutes on our practice test platform to confirm pacing
This weighted-day approach only works because you know the exact percentages going in - it's a direct application of the domain breakdown above, not a generic study template. For a longer-horizon plan that starts weeks out instead of days, the CCITP-F Study Guide 2026 extends this same logic across a multi-week calendar.
Last-Mile Mistakes to Avoid
- Studying the wrong handbook version: confirm you're working from the March 2025 handbook (110 questions, 100 scored, 10 pilot) and not the superseded Spring 2024 V1_8 version (115 questions, 15 pilot).
- Treating the pass mark as a percentage: 650/800 is a scaled score, not "81.25% correct." Don't recalculate your target incorrectly.
- Splitting the joint 35% domain into guessed sub-weights: Synthesis and Tools and Methods are published together - study them together.
- Importing content from CCITP-Analysis: Vulnerabilities Assessment and other Analysis-level content are not part of Fundamentals.
- Skipping the eligibility check: Program Manager approval and the six-month/ten-hour thresholds must be in place before you can sit the exam at all.
Key Takeaway
Run a full 130-minute timed practice session before exam day using a realistic practice test so the pacing - not just the content - feels familiar when the clock starts.
Candidates weighing whether the credential is worth pursuing at all, given the eligibility restrictions, may also want to read Is the CCITP-F Certification Worth It? and the related CCITP-F Salary Guide 2026 before investing study time. And if cost planning or registration windows are still open questions, CCITP-F Certification Cost 2026 and CCITP-F Exam Dates 2026 cover those mechanics directly.
Frequently Asked Questions
110 total: 100 scored multiple-choice questions plus 10 unscored pilot questions, each with a single correct answer, per the current March 2025 handbook.
650 out of 800 scaled points. This is a scaled score, not a straight percentage, and a score report alone does not constitute final certification conferral.
130 minutes, listed in the handbook as two hours and ten minutes (2.1667 exam hours).
Synthesis & Tools and Methods carries the single largest weight at 35%, with Researching close behind at 30%. Together these two domains make up 65% of the exam.
No. Eligibility is restricted to current counter-insider-threat program or affiliated personnel with at least six months of C-InT program experience, ten hours of related training, and Program Manager approval.