FITSI Manager Exam 2025/2026 (200+ Questions) – NIST RMF, FISMA, Risk Assessment, SP 800 Series | Federal IT Security Institute

This document provides a complete set of 200+ expert-verified questions and answers for the 2025/2026 FITSI Manager Certification Exam, focused on U.S. federal cybersecurity policy, NIST standards, and risk management frameworks. Developed for professionals pursuing the Federal IT Security Institute (FITSI) credential, this resource is structured around real exam topics, covering both technical and managerial aspects of federal information assurance. Aligned with DoD, DHS, and federal IT requirements, the document emphasizes the application of the NIST Risk Management Framework (RMF) across organizational tiers, preparing candidates to manage, assess, and oversee secure IT operations in federal environments. Core topics include: NIST Special Publications: SP 800-30 (Risk Assessment), 800-37 (RMF), 800-39 (Information System Risk), 800-53 & 800-53A (Security & Privacy Controls) FISMA 2002 & 2014: Federal cybersecurity legislation and modernization Risk Assessment Frameworks: FARM process (Frame, Assess, Respond, Monitor), SP 800-30 adversarial vs non-adversarial threats Security Categorization and Controls: FIPS 199, FIPS 200, control families (AC, AU, IR, RA, SC, etc.) Incident Response & POAMs: Preparation through recovery and documentation E-Authentication Levels, TIC, CNSS policies, Clinger-Cohen Act, OMB Circular A-130 Common standards and tools: CVE, CWE, CPE, CVSS, XCCDF, OVAL, OCIL, and the NVD Federal infrastructure protection: HSPD-12, HSPD-20, PPD-21 This exam prep document is ideal for: Federal cybersecurity managers and IT professionals Department of Defense (DoD), DHS, and other federal agency employees Candidates pursuing the FITSI Manager Certification Students in U.S. government cybersecurity, information assurance, or NIST RMF-focused courses Professionals working with or within systems requiring FISMA or FedRAMP compliance It offers in-depth support for certification and audit preparation by reinforcing real-world risk management knowledge and security policy mastery. Keywords: FITSI Manager, NIST RMF, FISMA, SP 800-37, SP 800-30, cybersecurity management, risk assessment, federal IT security, information assurance, control families, incident response, POAM, CVE, TIC, CNSS, FedRAMP, government cybersecurity, e-authentication, OMB A-130, Clinger-Cohen Act