- Who Issues the ITS Credential
- Eligibility: What ETA Actually Asks For
- Recommended Background Before You Sit
- Exam Format and Passing Standard
- Registration, Fees and Remote Testing Rules
- The Ten Competency Areas You Must Master
- Worked Scenarios in the ITS Style
- Alternate Routes: Security+ Rollover and Journeyman Upgrade
- Retakes, Maintenance and Keeping the Credential Active
- A Domain-Ordered Preparation Plan
- Frequently Asked Questions
- ITS is issued by ETA International and tested with a 100-question, two-hour written exam; 75% is required to pass.
- The Stand-Alone route does not require Associate CET (CETa); the exam fee is USD 105.
- Computer-systems and networking experience is recommended preparation, not a formal prerequisite listed for the Stand-Alone route.
- A valid CompTIA Security+ (ce) certificate can roll over to ITS for USD 105; lifetime Security+ certificates are excluded.
Who Issues the ITS Credential
Before you plan anything, confirm you are preparing for the right credential. Here, ITS means Information Technology Security, issued and administered by ETA International. It is a separate credential from Certiport's Information Technology Specialist exams, even though the acronym is similar. If you are unsure what the abbreviation covers, the explainers at What Is ITS? and What Does ITS Stand For? clear up the naming confusion.
This distinction matters for requirements because every rule in this article, from the exam fee to the maintenance cycle, comes from ETA's published materials for Information Technology Security. If another vendor's exam shows up in your search results with different fees or formats, those details do not apply here.
Eligibility: What ETA Actually Asks For
The eligibility picture for ITS is simpler than many candidates expect. ETA's published materials describe the following:
- No Associate CET (CETa) requirement on the Stand-Alone route. You do not need to hold CETa to take ITS as a stand-alone credential.
- A written examination. ITS is a knowledge exam only. There is no hands-on assessment component.
- Acceptance of the ETA Code of Conduct. ETA's issuer badge lists this alongside the exam as part of earning the credential.
- Practicing-technician experience. The issuer badge description also lists experience as a practicing technician. Treat this as an expectation to discuss with ETA when you register rather than a hard number of years, because no specific year count is published for the Stand-Alone route.
Recommended Background Before You Sit
ETA's competency requirements recommend two kinds of preparation: prior experience with computer systems and networking, and prior IT or networking certification. These are recommendations, but they reflect how the exam is built. ITS questions assume you already understand how networks, operating systems and devices function, then ask how to secure them.
Candidates who benefit most from the recommended background typically include:
- Field technicians who install or service networked equipment and want to add a security credential.
- Help-desk and support staff who handle access, endpoint and wireless issues daily.
- Holders of an entry-level networking or IT certification who want to demonstrate security knowledge.
- Current Security+ (ce) holders who may qualify for the rollover route described below.
For a candid look at how the background gap translates into effort, see How Hard Is the ITS Exam?. For the career side, ITS Jobs covers the kinds of roles where this credential is relevant.
Exam Format and Passing Standard
The exam specifications come from the ETA Certification Booklet and the ITS credential page. They are the same regardless of how you test:
| Item | ITS Requirement |
|---|---|
| Exam type | Written knowledge examination |
| Number of questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Hands-on component | None |
| Exam fee | USD 105 |
| Certification term | Four years |
One clarification worth making: the 75% figure is a score threshold you must reach, not a statistic about how many candidates pass. ETA has not published an issuer-wide ITS pass rate that we could verify, so be skeptical of any site that quotes one. We discuss what is and is not known at ITS Pass Rate, and the scoring mechanics are covered at ITS Passing Score.
On a 100-question exam, 75% means you need to answer at least 75 questions correctly. Two hours across 100 questions averages out to roughly 72 seconds per question, which is comfortable for recall questions but tight if you stall on scenario-style items.
Registration, Fees and Remote Testing Rules
ITS testing is arranged with an ETA Certification Administrator. Two delivery formats are available: Trapeza online testing or paper/pencil. Remote proctoring is also available through ExamRoom.AI after you register with ETA.
Remote testing requirements
- Added fee: remote proctoring adds USD 16 for this two-hour exam.
- Scheduling lead time: initial scheduling can take up to 72 hours, so do not plan a same-day booking.
- Equipment: a working webcam, microphone, a recent computer, and at least 3 Mbps internet.
- Identification: photo ID is required.
Testing-room rules
- Scratch paper and non-programmable or scientific calculators are permitted.
- Used scratch paper must be surrendered at the end.
- Phones are prohibited.
- You may not leave the room once testing starts.
Trapeza displays results immediately, so you will know your outcome as soon as you finish. A realistic first-attempt budget is USD 105 for the exam, plus USD 16 if you test remotely. For the full cost picture, including maintenance and retakes, see ITS Certification Cost, and for timing logistics see ITS Exam Dates.
The Ten Competency Areas You Must Master
ETA states that examination questions derive from its published Competency Requirements (copyright 2024, eight pages). That document is your blueprint. It does not publish percentage weights per area, so do not trust any source that claims exact domain percentages. The ten major areas are:
Domains 1-3: Hardware, Physical and Software Security
These areas cover the infrastructure you protect and the controls around it.
- Domain 1: Network Hardware Security Fundamentals, securing the equipment that forms the network.
- Domain 2: Physical Security, including surveillance, access control, and RFID/NFC technologies.
- Domain 3: Network Software Security, protocols and software-based controls. Note that the competency document includes legacy security protocols, so expect to explain older protocols in context.
Domains 4-6: Wireless, Devices and Exploitation
These areas address where attacks tend to land.
- Domain 4: Wireless Security, including Bluetooth and wireless standards, some of them older editions.
- Domain 5: Device Security, endpoints and IoT devices.
- Domain 6: Software Exploitations and Vulnerabilities, how software weaknesses are abused.
Domains 7-10: Governance, Recovery, Crypto and People
These areas cover the management and human side of security.
- Domain 7: Operational Standards, Policies and Risk Assessments, including quantitative risk calculations such as SLE, ARO and ALE.
- Domain 8: Disaster Recovery and Computer Forensics, including recovery-site concepts.
- Domain 9: Cryptography, including PKI.
- Domain 10: Social Engineering, manipulation techniques aimed at people rather than systems.
For a deeper walk-through of each area, read ITS Exam Domains: Complete Guide to All 10 Content Areas. When you are ready to test yourself against the blueprint, the ITS practice tests are organized around these same ten areas.
Worked Scenarios in the ITS Style
The exam is a written knowledge test, so expect both direct recall and short scenario questions. The following original examples show the reasoning level to practice. They are illustrations, not actual exam items.
Cloud shared responsibility
Scenario: A company moves a database to an infrastructure-as-a-service provider. A misconfigured storage permission exposes records. Who is typically responsible? Reasoning: under the shared responsibility model, the provider secures the underlying infrastructure, while the customer is responsible for configuring access to its own data and resources. The permission setting falls on the customer.
Quantitative risk (SLE, ARO, ALE)
Scenario: An asset is valued at USD 50,000. A given threat would destroy 40% of its value per incident and is expected once every four years. Reasoning: SLE = asset value x exposure factor = 50,000 x 0.40 = USD 20,000. ARO = 0.25 (one event in four years). ALE = SLE x ARO = USD 5,000 per year. A control costing more than that annually would need justification beyond this single threat.
Physical access and RFID/NFC
Scenario: A facility uses proximity badges at the door, and an attacker captures a badge signal from a short distance. Reasoning: RFID and NFC credentials can be read or cloned at close range, so layering a second factor, such as a PIN, and adding camera coverage at the entry point reduces reliance on the badge alone.
Recovery sites
Scenario: A business needs to resume operations within hours after an outage and can afford a higher standing cost. Reasoning: a hot site, which is equipped and ready, supports the fastest recovery, while warm and cold sites trade lower cost for longer restoration times.
PKI
Scenario: A user's browser warns that a site's certificate was not issued by a trusted authority. Reasoning: in PKI, trust flows from a certificate authority's signature. If the chain does not lead to a trusted root, the browser cannot verify the site's identity.
Social engineering
Scenario: An email claiming to be from IT urges an employee to reset credentials immediately through a link. Reasoning: urgency and impersonation are hallmarks of phishing. The correct response is to verify through a known channel rather than click.
Key Takeaway
Practice turning every concept into a one-line decision rule, such as "customer configures access, provider secures infrastructure." That habit speeds up the 72-seconds-per-question pace the two-hour limit implies.
Alternate Routes: Security+ Rollover and Journeyman Upgrade
CompTIA Security+ (ce) rollover
ETA offers a rollover route for people who already hold a current CompTIA Security+ (ce) credential. The rollover costs USD 105 and requires proof of your current certificate. Lifetime Security+ certificates are excluded.
Be precise about what this means. The rollover is an alternative route to the credential. It does not make the Security+ syllabus the ETA ITS blueprint. If you are weighing which path suits you, compare them side by side:
| Factor | Take the ITS Exam | Security+ (ce) Rollover |
|---|---|---|
| Fee | USD 105 (plus USD 16 if remote) | USD 105 |
| Requires proof of current certificate | No | Yes |
| Exam sat | Yes, 100 questions, two hours | No ITS exam sitting described for this route |
| Lifetime Security+ eligible | Not applicable | No |
Journeyman upgrade
A later Journeyman upgrade requires CETa and at least two years of combined training and experience. The upgrade fee is USD 55. This is separate from the Stand-Alone route, which does not require CETa. The upgrade is a career-ladder step rather than an entry requirement.
Retakes, Maintenance and Keeping the Credential Active
If you do not pass
After an unsuccessful attempt, one eligible free retake is available. The rules are specific:
- You must wait 30 days after the first attempt.
- The retake must be completed within one year of the first exam.
- A remote retake still incurs the proctoring fee.
Maintenance requirements
ITS follows ETA's general, non-hands-on Maintenance program over its four-year term. You have two ways to satisfy it:
- Option A: submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 over the four-year cycle).
- Option B: submit a supervisor-completed Employer Verification Form instead of the CE hours.
Either option includes a USD 25 annual fee (USD 100 over four years). Annual submission includes ETA membership. See Is the ITS Certification Worth It? for how these recurring costs factor into a return-on-investment view.
A Domain-Ordered Preparation Plan
Because ETA publishes no domain weights, sequence your study by dependency rather than by assumed importance. Foundational infrastructure first, then attacks, then governance.
Infrastructure foundations
- Domain 1: Network Hardware Security Fundamentals
- Domain 2: Physical Security, including surveillance and RFID/NFC
Protocols and wireless
- Domain 3: Network Software Security, with legacy protocols explained in context
- Domain 4: Wireless Security and Bluetooth
Endpoints and exploits
- Domain 5: Device Security and IoT
- Domain 6: Software Exploitations and Vulnerabilities
Governance, recovery and people
- Domain 7: policies and SLE/ARO/ALE drills
- Domain 8: recovery sites and forensics
- Domain 9: Cryptography and PKI
- Domain 10: Social Engineering
Do the quantitative risk math early and repeatedly; formula questions are easy points once the pattern is automatic. Reserve the final days for full-length timed practice. The ITS Study Guide expands this plan, and the ITS Cheat Sheet condenses the must-know facts for last-minute review.
Choosing preparation resources
Your resources differ in authority, so rank them accordingly. ETA's competency document is the top source because exam questions derive from it. Commercial products and unofficial question dumps do not replace it. One optional product, eITprep's CompTIA Security+ Study Guide for ETA ITS, lists USD 59.95 for six months, two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. Keep two distinctions straight: those 45 hours are course contact time, not exam time, and the practice-exam counts are product features, not facts about the 100-question, two-hour ETA exam. The course does not itself confer certification, and its public description does not identify a Security+ edition, so map anything you study from it back to ETA's published 2024 competencies. For self-testing against that blueprint, start with the ITS Exam Prep practice test site. If you want structured learning options, see ITS Training, and for the credential overview see What Is ITS Certification?.
Frequently Asked Questions
No. The Stand-Alone route does not require CETa. CETa becomes relevant only for the later Journeyman upgrade, which also requires at least two years of combined training and experience and costs USD 55.
ETA's competency document recommends prior computer-systems and networking experience and prior IT or networking certification. ETA's issuer badge also lists practicing-technician experience. No minimum year count is published for the Stand-Alone route, so confirm your situation with ETA or an administrator.
The written exam has 100 questions with a two-hour limit, and you need 75% to pass. There is no hands-on component. Results display immediately on Trapeza.
A valid CompTIA Security+ (ce) credential provides an alternative rollover route for USD 105 with proof of your current certificate. Lifetime Security+ certificates are excluded. The rollover is a separate route and does not make Security+ content the ITS blueprint.
One eligible free retake is available after a 30-day wait and must be completed within one year of the first exam. If you retake remotely, the proctoring fee still applies.