CCITP-F Exam Domains 2026: Complete Guide to All 4 Content Areas

CCITP-F Exam Structure Overview

The Certified Counter-Insider Threat Professional - Fundamentals (CCITP-F) exam is organized around five published topic areas that roll up into four weighted domain groups. This structure matters because two of the five named topics - Synthesis and Tools and Methods - are scored together as a single 35% block, with no separate percentage published for either one individually. Treat that pairing as one unified content area when you build your study plan, not two.

According to the current official CCITP Program Candidate Handbook (March 2025, printed page 6), the exam consists of 110 multiple-choice questions: 100 scored items and 10 unscored pilot questions, each with a single correct answer. You are not told which questions are pilots, so every item should be treated as if it counts. You have 130 minutes (listed as 2.1667 exam hours) to finish. A passing result is 650 out of 800 scaled points - a scaled score, not a straight percentage of items answered correctly. Note also that receiving a score report is not, by itself, the final certification conferral decision; conferral authority sits jointly with the Under Secretary of Defense for Intelligence and Security (USD(I&S)) and the Director of the National Counterintelligence and Security Center (NCSC) under the CCITP Governance Council (CCITP GC).

If you've seen older prep material citing 115 questions with 15 pilot items, that reflects the superseded Spring 2024 V1_8 handbook. The current, controlling version is the March 2025 handbook, and this article uses that version throughout. For a side-by-side comparison of scoring mechanics, see our dedicated breakdown of the CCITP-F passing score requirements.

Domain 1: Policy and Directives (25%)

Policy and Directives makes up a quarter of the scored exam. This domain tests whether a candidate understands the governing frameworks, authorities, and directives that structure a counter-insider threat (C-InT) program - not just that such frameworks exist, but how they shape day-to-day program decisions, reporting obligations, and oversight boundaries.

Expect scenario-style questions that ask you to apply a directive to a specific situation rather than simply recall its title. Because this is a knowledge domain built on written authorities, flashcard-style memorization only gets you partway - you also need to practice applying those rules to short vignettes.

Domain 2: Social and Behavioral Science (10%)

At 10%, Social and Behavioral Science is the smallest weighted group on the exam, but it still shapes how candidates interpret behavioral indicators within a C-InT context. This domain draws on the human factors side of insider threat work - why behavior matters as a data point, and how behavioral observations should be contextualized rather than treated as standalone evidence.

Because this domain carries the lowest weight, allocate study time proportionally: it deserves solid comprehension, but not the bulk of your review hours. Over-indexing here at the expense of Researching or Synthesis & Tools and Methods is a common and avoidable mistake.

Domain 3: Researching (30%)

Researching is the second-largest domain at 30%, and it tests the investigative and analytic groundwork that underpins every C-InT case. This is less about memorizing facts and more about demonstrating sound research practice: how information is gathered, validated, and organized before it becomes part of an assessment.

Because Researching feeds directly into the Synthesis portion of Domain 4, candidates often find it efficient to study these two domains back-to-back. Strong research habits make the synthesis questions far more intuitive, since synthesis questions frequently assume you already know how the underlying information was gathered and verified.

Domain 4: Synthesis & Tools and Methods (35%)

This is the single largest domain group on the CCITP-F exam at 35% - and it's a combined category. The handbook does not publish a separate percentage breakdown between "Synthesis" and "Tools and Methods," so candidates should prepare for both topics as one integrated block rather than trying to guess an internal split.

Given its weight, this domain should anchor your final review sessions. Questions here often combine elements from Policy and Directives and Researching into a single scenario, so a candidate who has only studied domains in isolation may struggle with the integrated question style. For a full walkthrough of how to sequence review across all four domains, see our CCITP-F Study Guide for passing on your first attempt.

Domain Weighting at a Glance

Because the exam blueprint groups five named topics into four scored domain rows, it helps to see the weighting laid out plainly before you plan study hours.

This distribution tells a clear story: more than two-thirds of your scored questions come from the Researching and Synthesis/Tools-and-Methods groups combined. If you're deciding how to allocate limited study time, that's where the math should point you. For context on how difficult candidates generally find this weighting in practice, see our guide on how hard the CCITP-F exam actually is.

Mapping Domains to a Study Schedule

Rather than studying domains in the order they're listed in the handbook, it's often more efficient to sequence them by weight and dependency. Since Researching feeds into Synthesis, and Policy and Directives provides context that shows up inside scenario questions across every domain, a deliberate order can save real review time.

This isn't a generic weekly template - it's ordered specifically around the 25/10/30/35 weighting and the way Researching logically precedes Synthesis. If you want a condensed, last-week version of these priorities, our CCITP-F cheat sheet compresses the must-know facts from each domain onto a single page.

Who Takes This Exam and Why It Matters

CCITP-F isn't an open-entry credential. Eligibility is restricted to individuals currently serving in, or affiliated with, a counter-insider-threat program. Candidates need at least six months of experience working in or with a C-InT program, a minimum of ten hours of related training, and formal Program Manager approval before they can sit for the exam. If you're unsure whether you currently qualify, our detailed CCITP-F requirements and eligibility guide walks through each prerequisite.

Because eligibility is gated this way, the population taking this exam is already embedded in C-InT work - program analysts, investigators, and affiliated personnel who need a recognized credential tied to the CCITP Governance Council's joint conferral process. That context explains why the domain weighting leans so heavily toward Researching and Synthesis & Tools and Methods: these are the working skills that C-InT program roles actually demand day to day, not abstract theory.

Once you've confirmed eligibility and reviewed the domain breakdown above, the next practical steps are usually cost planning and scheduling. Our CCITP-F certification cost breakdown and exam dates and scheduling guide cover the logistics side, while our full practice test platform lets you drill domain-specific questions under timed conditions that mirror the real 130-minute format. Running timed practice sets through the practice exam simulator is one of the few ways to get a realistic feel for the 110-question format before test day, and reviewing your practice test results by domain helps confirm whether your weakest area lines up with the highest-weighted content.

Frequently Asked Questions