- CCITP-F stands for Certified Counter-Insider Threat Professional - Fundamentals, governed by the CCITP Governance Council.
- The current handbook (March 2025) specifies 110 questions: 100 scored, 10 unscored pilot items, over 130 minutes.
- Passing requires 650 of 800 scaled points - not a raw percentage.
- Four weighted domain groups: Policy and Directives 25%, Social and Behavioral Science 10%, Researching 30%, Synthesis & Tools and Methods 35%.
What Does CCITP-F Mean, Exactly?
CCITP-F stands for Certified Counter-Insider Threat Professional - Fundamentals. It is the entry-level credential in the broader CCITP certification track, designed to validate that a practitioner understands the foundational policy, behavioral science, research, and analytical tools and methods used in counter-insider threat (C-InT) work. Because the acronym "CCITP-F" is reused across unrelated industries, it is worth pinning down this identity clearly: on this site, every fact, number, and requirement refers specifically to the counter-insider threat fundamentals credential and nothing else.
If you landed here trying to understand the basics before diving into prep materials, this article is the right starting point. For a deeper breakdown of the program itself, see our companion piece, What Is CCITP-F?, and for a quick acronym-focused explainer, check What Does CCITP-F Stand For?
Who Governs and Confers the Credential
CCITP-F sits under the authority of the CCITP Governance Council (CCITP GC), which sets the standards, handbook content, and exam specifications for the program. Conferral of the credential is a joint action between two offices: the Under Secretary of Defense for Intelligence and Security (USD(I&S)) and the Director of the National Counterintelligence and Security Center (NCSC). This dual-authority structure reflects the credential's origin inside the defense and national counterintelligence community rather than a commercial certification vendor.
One detail candidates often misunderstand: passing the exam and receiving a score report is not the same as final certification. The handbook is explicit that a score report does not itself constitute the final conferral decision - conferral is a separate administrative step handled by the governing authorities after a passing score is confirmed. For more on how this program fits into the broader certification landscape, see CCITP-F Certification and What Is CCITP-F Certification?
Exam Format: Questions, Timing, and Structure
The current official source of truth is the CCITP Program Candidate Handbook, March 2025, and on printed page 6 it lays out the exam structure candidates should prepare for:
- 110 total multiple-choice questions - 100 scored and 10 unscored pilot questions
- Each question has exactly one correct answer (standard single-best-answer format, no multi-select trickery)
- 130 minutes total exam duration (two hours and ten minutes), which the handbook's exam-hours field rounds to 2.1667
- Passing standard: 650 out of 800 scaled points - a scaled score, not a straight percentage of questions answered correctly
It's worth flagging that pilot questions are unscored and indistinguishable from scored ones during the exam, so there's no strategic benefit to trying to guess which questions "don't count." Treat every item on screen as if it affects your score, because from the test-taker's seat, it might.
Because the scaled scoring model (650/800) is unusual compared to simple percentage-based exams, it deserves its own explanation - see CCITP-F Passing Score 2026: Exactly What You Need to Pass for the full breakdown. If you're still trying to gauge how tough the exam feels in practice, How Hard Is the CCITP-F Exam? Complete Difficulty Guide 2026 digs into that question directly, and CCITP-F Pass Rate 2026: What the Data Shows covers what's publicly known about outcomes.
The Four Weighted Domain Groups
The issuer publishes five named topic areas, but they are organized into four weighted domain groups for scoring purposes. Two of the named topics - Synthesis, and Tools and Methods - are combined into a single joint weight. No separate percentage breakdown exists for those two individually, so don't let any prep resource convince you there's an official split; there isn't one published.
Domain 1: Policy and Directives (25%)
Covers the regulatory, legal, and directive-level framework that governs C-InT programs - the "why" and "under what authority" behind program actions.
- Understanding governing directives and how they shape program scope
Domain 2: Social and Behavioral Science (10%)
The smallest weighted domain, focused on behavioral indicators and the human factors that inform insider threat risk assessment.
- Recognizing behavioral patterns relevant to risk evaluation
Domain 3: Researching (30%)
A heavily weighted domain covering how analysts gather, verify, and contextualize information relevant to a potential insider threat case.
- Source evaluation and research methodology within program constraints
Domain 4: Synthesis & Tools and Methods (35%)
The largest domain group, combining the ability to synthesize findings into actionable output with practical knowledge of the tools and methods used in C-InT analysis.
- Turning raw research into a coherent, decision-ready product
- Applying appropriate analytical tools and methods to a given scenario
Because this domain is the single largest weight on the exam, it deserves disproportionate study time. For a full walkthrough of all four areas with more subtopic detail, read CCITP-F Exam Domains 2026: Complete Guide to All 4 Content Areas.
| Domain | Weight | Relative Priority |
|---|---|---|
| Policy and Directives | 25% | High |
| Social and Behavioral Science | 10% | Lowest |
| Researching | 30% | High |
| Synthesis & Tools and Methods | 35% | Highest |
Who Can Actually Sit for CCITP-F
This is not an open-entry exam that anyone can register for off the street. Eligibility is restricted specifically to people already working inside or affiliated with a counter-insider-threat program. The handbook requirements include:
- At least six months of experience working in or with a C-InT program
- At least ten hours of related training
- Program Manager approval before registration
This restriction shapes who should even be researching this credential in the first place - it's not a general-audience security certification. If you're unsure whether your current role or training hours qualify, our dedicated article CCITP-F Requirements 2026: Eligibility, Prerequisites & How to Qualify walks through each condition in detail, and CCITP-F Exam Dates 2026: Testing Windows, Deadlines & Scheduling covers how scheduling works once you're cleared.
Key Takeaway
Don't start studying before confirming eligibility - six months of C-InT program experience, ten hours of training, and Program Manager sign-off are prerequisites, not formalities.
Who Hires People With This Credential
CCITP-F sits inside defense and national security C-InT programs, so the people who hold or pursue it are typically already embedded in agencies, defense contractors, or organizations running formal insider threat programs. The credential signals to a Program Manager or hiring authority that a practitioner has demonstrated baseline competency across policy, behavioral indicators, research, and analytical synthesis - the core functions most C-InT analyst and program-support roles require day to day.
If you're weighing whether pursuing this credential makes sense for your career trajectory, Is the CCITP-F Certification Worth It? Complete ROI Analysis 2026 and CCITP-F Salary Guide 2026: Complete Earnings Analysis explore that from the career-outcomes side, while CCITP-F Jobs looks at the kinds of roles where this credential is relevant. For budgeting purposes before you commit, CCITP-F Certification Cost 2026: Complete Pricing Breakdown lays out what to expect financially.
How the Format Should Shape Your Study Plan
Generic study advice - spaced repetition, timed practice blocks, active recall - works fine for CCITP-F, but it only becomes useful once it's mapped onto the actual domain weights. Since Synthesis & Tools and Methods carries 35% and Researching carries 30%, together accounting for nearly two-thirds of the exam, those two areas deserve the bulk of your study hours, not an even split across all four domains.
Policy and Directives + Social and Behavioral Science
- Build foundational vocabulary and directive knowledge early since these are lighter-weighted but foundational to later domains
Researching
- Practice source evaluation and research-methodology questions under timed conditions, since this domain carries 30% weight
Synthesis & Tools and Methods
- Focus the most hours here - it's the single largest domain group and ties together everything studied earlier
Full-Length Practice Under Real Timing
- Simulate the full 130-minute, 110-question format, including pacing for roughly 100 scored items
For a complete week-by-week study framework with more detail than the overview above, see CCITP-F Study Guide 2026: How to Pass on Your First Attempt. And if you want a condensed, one-page reference to review in the final days before your exam, CCITP-F Cheat Sheet 2026: One-Page Review of Must-Know Facts is built exactly for that. To build timing instincts, running full-length simulations on our practice test platform before test day is one of the most reliable ways to confirm you can finish all 110 questions inside 130 minutes without rushing the heavily-weighted domains.
Beyond timed practice, it also helps to run through official and third-party explanations of each term you encounter in the practice question bank, since the Researching and Synthesis domains often test whether you can apply a concept to a scenario rather than simply recall a definition. If terminology or acronym confusion is slowing you down, our glossary-style pieces like CCITP-F Meaning and What Is A CCITP-F? can clear up foundational confusion before you move into deeper content review. For those researching formal coursework options ahead of the exam, CCITP-F Training covers what's available.
Frequently Asked Questions
CCITP-F stands for Certified Counter-Insider Threat Professional - Fundamentals. It is the entry-level credential within the CCITP certification track governed by the CCITP Governance Council.
Per the current March 2025 CCITP Program Candidate Handbook, the exam contains 110 multiple-choice questions total: 100 scored and 10 unscored pilot questions, each with one correct answer.
The exam runs 130 minutes (two hours and ten minutes). Passing requires a scaled score of 650 out of 800 points - this is not a simple percentage of correct answers.
No. Eligibility is restricted to current counter-insider-threat program or affiliated personnel with at least six months of relevant experience, at least ten hours of related training, and Program Manager approval.
Policy and Directives (25%), Social and Behavioral Science (10%), Researching (30%), and Synthesis & Tools and Methods combined (35%). No separate official percentage is published splitting Synthesis from Tools and Methods.