- The Short Answer: Information Technology Security
- Why the Acronym Causes Confusion
- Who Issues ITS and What It Certifies
- The Ten Competency Areas Behind the Name
- Exam Format, Fees and Testing Logistics
- Worked Scenarios That Mirror the Competencies
- ITS and Security+: Rollover, Not Equivalence
- Keeping the Credential Current
- Sequencing Your Preparation by Domain
- Frequently Asked Questions
- ITS here means Information Technology Security, an ETA International certification, not Certiport's Information Technology Specialist exams.
- The written exam has 100 questions, a two-hour limit, and a 75% passing score.
- ETA publishes ten competency areas, from Network Hardware Security Fundamentals to Social Engineering, with no published domain weights.
- The exam fee is USD 105; remote proctoring adds USD 16.
The Short Answer: Information Technology Security
On this site, ITS stands for Information Technology Security. It is a written-knowledge certification administered by ETA International that tests whether a technician understands how to protect networks, devices, facilities, software, and people from threats. If you landed here from a search for the acronym and want the broader picture, our companion pages on what ITS is and ITS meaning cover adjacent angles, while this article focuses on pinning down the name, the issuer, and what the credential actually contains.
The ETA ITS credential is aimed at technicians who already work with computer systems and networks and want a documented, vendor-neutral security credential. The competency document recommends prior computer-systems and networking experience and prior IT or networking certification as preparation, so it is positioned as a security specialization rather than an entry point to technology in general.
Why the Acronym Causes Confusion
"ITS" is a crowded acronym. Several unrelated programs and credentials use the same three letters, and search results routinely mix them together. The most common mix-up in the certification world is with Certiport's Information Technology Specialist exams, which are a different family of credentials from a different organization with a different purpose, format, and blueprint.
Practice questions found on forums and document-sharing sites do not always declare which ITS they target. Always check an unofficial question set against ETA's competency document before trusting it. For the broader acronym discussion, see what ITS means and what a ITS is.
Who Issues ITS and What It Certifies
ETA International publishes the ITS competency requirements, sets the exam, and manages certification maintenance. ETA states that examination questions derive from the respective competencies, which makes the eight-page competency document (copyright 2024) the authoritative blueprint. Course outlines, flashcards, and third-party question banks are supplementary at best.
The credential can be earned on a stand-alone basis; the Stand-Alone route does not require the Associate CET (CETa). A later Journeyman upgrade does require CETa and at least two years of combined training and experience, with a USD 55 upgrade fee. ETA's issuer badge also lists practicing-technician experience, a written examination, and acceptance of the Code of Conduct among the credential's elements. For a deeper look at eligibility, read our guide to ITS requirements, and for the wider definition see what ITS certification is.
The Ten Competency Areas Behind the Name
The acronym only makes sense once you see what the name covers. ETA's competency document organizes the credential into ten major areas. Importantly, ETA does not publish percentage weights for these areas, so anyone quoting a weighting table is guessing. Treat all ten as testable. Our complete guide to the ITS exam domains walks through each in more detail; here is the overview.
Domain 1: Network Hardware Security Fundamentals
The security role of the devices that move and filter traffic.
- How routers, switches, firewalls, and related infrastructure are hardened and configured securely
- Why default settings and unmanaged devices create exposure
Domain 2: Physical Security
Controlling who and what can physically reach systems.
- Surveillance and access control concepts
- RFID and NFC technologies used in badges and entry systems, including their weaknesses
Domain 3: Network Software Security
Securing the software services and protocols that run over the network.
- Secure versus insecure protocols
- The competency document includes legacy protocols and older standards editions, so expect to explain them in historical context
Domain 4: Wireless Security
Protecting wireless links and the encryption and authentication that guard them.
- Evolution of wireless security standards and why older ones are considered weak
- Common wireless attack concepts
Domain 5: Device Security
Endpoints, mobile devices, and connected equipment.
- IoT and Bluetooth exposure
- Device hardening and management
Domain 6: Software Exploitations and Vulnerabilities
How attackers abuse software flaws and malicious code.
- Recognizing categories of exploits and malware
- Matching a vulnerability type to its mitigation
Domain 7: Operational Standards, Policies and Risk Assessments
The management side of security.
- Policy, standards, and risk assessment
- Quantitative risk terms: SLE, ARO, and ALE
- Cloud shared-responsibility thinking
Domain 8: Disaster Recovery and Computer Forensics
Restoring operations and preserving evidence.
- Recovery site types and when each fits
- Evidence handling principles
Domain 9: Cryptography
Protecting confidentiality, integrity, and authenticity.
- Symmetric versus asymmetric approaches, hashing, and digital signatures
- PKI components and the role of certificates
Domain 10: Social Engineering
The human attack surface.
- Common manipulation techniques
- Pairing each technique with the control that blunts it
Exam Format, Fees and Testing Logistics
The exam is a written knowledge test with no hands-on component. The facts that matter most:
| Item | Detail |
|---|---|
| Questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Exam fee | USD 105 |
| Remote proctoring add-on | USD 16 |
| Certification term | Four years |
| Hands-on assessment | None |
Note the distinction between a passing score and a pass rate. The 75% figure is the threshold you must reach; no issuer-wide candidate pass rate has been verified, so be skeptical of any site that quotes one. Our pages on the ITS passing score and ITS pass rate unpack that difference, and the ITS certification cost breakdown covers fees beyond the exam itself.
How testing is arranged
You arrange testing with an ETA Certification Administrator. Options include Trapeza online testing or paper and pencil. Remotely proctored testing through ExamRoom.AI is available after you register with ETA; initial scheduling can take up to 72 hours, so do not leave it to the last minute. Remote candidates need a working webcam, microphone, a recent computer, and at least 3 Mbps of internet. Photo ID is required. Scratch paper and non-programmable or scientific calculators are permitted, but used scratch paper must be surrendered, phones are prohibited, and you may not leave the room once the exam begins. Trapeza displays results immediately.
Worked Scenarios That Mirror the Competencies
The exam tests applied understanding, so practice with scenarios rather than memorized definitions. These original examples reflect the kind of reasoning each area demands. For more drills, the ITS practice test site offers timed question sets.
Cloud shared responsibility
A company moves a database to a cloud infrastructure service and assumes the provider now handles all security. A breach occurs because the database was left with a weak administrative password. Who owns that failure? The customer. In infrastructure-style cloud models, the provider secures the underlying facilities and platform while the customer remains responsible for configuration, identities, and data. Expect questions that ask you to place a given control on the provider or customer side.
Physical surveillance and access control
A server room uses a badge reader, but staff routinely hold the door for colleagues. The badge system works; the process fails through tailgating. Appropriate countermeasures include an access vestibule, anti-tailgating policy, and camera coverage of the entry. The lesson: layered controls address both technology and behavior.
RFID and NFC
Proximity cards use RFID, and a lobby kiosk accepts NFC taps. A reviewer worries that cards can be read from a short distance by a hidden reader. This is the cloning and skimming concern. Mitigations include shielded card sleeves, stronger card technologies with mutual authentication, and combining the badge with a second factor for sensitive areas.
IoT and Bluetooth
A facilities team installs smart thermostats that ship with default credentials and an open Bluetooth pairing mode. The sound response is to change default credentials, disable unneeded pairing modes, update firmware, and segment the devices from critical systems. Questions here usually reward the answer that reduces attack surface first.
ALE, SLE and ARO
Suppose a single incident would cost USD 20,000 (the single loss expectancy) and is expected to occur twice per year (the annualized rate of occurrence). The annualized loss expectancy is SLE multiplied by ARO, or USD 40,000 per year. If a control costing USD 15,000 per year eliminates the risk entirely, it is financially justified. Know the formula cold; arithmetic items like this are easy points.
Recovery sites
An organization needs to resume operations within minutes with near-current data and will pay for it. That points to a hot site. A budget-constrained organization that can tolerate days of downtime fits a cold site, with a warm site between the two. Match the recovery time requirement to the site type and the cost follows.
PKI
A user's browser warns that a site's certificate is not trusted. Reason through the chain: the certificate was issued by a certificate authority, the client must trust that authority, and the certificate must be valid, unexpired, and unrevoked. A self-signed certificate triggers the warning because no trusted authority vouches for it. Be ready to name the roles of the certificate authority, registration function, and revocation mechanisms.
Social engineering
An employee receives a call from someone claiming to be IT support who urgently needs a password to "prevent account lockout." This combines pretexting with urgency. The correct response is to refuse, verify through a known channel, and report it. Policy and awareness training are the principal defenses, because no firewall stops a willing employee from reading out a password.
Key Takeaway
For each scenario, practice naming the threat, the control category (technical, physical, or administrative), and the reason it works. That three-part answer pattern transfers directly to multiple-choice elimination.
ITS and Security+: Rollover, Not Equivalence
A valid CompTIA Security+ (ce) certificate provides an alternative route to ITS through rollover: USD 105 with proof of the current certificate. Lifetime Security+ certificates are excluded. This is a credential-conversion pathway, and it does not mean a CompTIA syllabus is the ETA ITS blueprint. The two certifications come from different organizations and are defined by different documents.
If you plan to prepare, anchor your study to ETA's published 2024 competency objectives. Optional commercial resources exist, such as eITprep's Security+ study guide for ETA ITS, which lists USD 59.95 for six months, two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. Keep these figures in perspective: they describe a preparation product, not the exam. The 45 contact hours are course time, unrelated to the two-hour written exam, and the course does not itself confer certification. Map anything you study there back to the ETA competencies. Our ITS study guide shows how to do that mapping.
Keeping the Credential Current
Certification runs on a four-year term and follows ETA's general, non-hands-on maintenance program. You have two routes:
- Submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 over the four-year cycle), or
- Submit a supervisor-completed Employer Verification Form.
Either route includes a USD 25 annual fee, or USD 100 over four years, and annual submission includes ETA membership. Because the CE alternative is employer verification rather than hour-counting, technicians with supportive supervisors have a lighter administrative path.
Sequencing Your Preparation by Domain
Rather than a generic schedule, order your study by dependency. Concepts in later domains lean on earlier ones, so this sequence reduces rework. Candidates weighing the effort involved should also read how hard the ITS exam is.
Infrastructure foundations
- Domain 1 and Domain 3: hardware and network software security, including legacy protocols in context
- Domain 4: wireless standards, since they build on protocol knowledge
Physical and endpoint layers
- Domain 2: surveillance, access control, RFID and NFC
- Domain 5 and Domain 6: devices, IoT and Bluetooth, then exploits and vulnerabilities
Governance and resilience
- Domain 7: policies, risk math (SLE, ARO, ALE), cloud responsibility
- Domain 8: recovery sites and forensics
Cryptography, people, and review
- Domain 9: cryptography and PKI
- Domain 10: social engineering, then timed 100-question practice runs
Finish with timed sets to build pacing: 100 questions in two hours leaves roughly a minute and a half per item. A condensed refresher is available in our ITS cheat sheet.
Where the credential leads
The credential suits technicians in network support, field service, and IT operations roles where security awareness is part of the job. Be careful with earnings claims: ETA's official fact sheet labels its wage figures as 2016 and its employment projections as 2022-2032, so they are not current salary evidence or proof of a certification-specific pay premium. For a measured discussion, see the ITS salary guide, the ITS certification ROI analysis, and the overview of ITS jobs.
Frequently Asked Questions
On this site, ITS stands for Information Technology Security, a certification administered by ETA International. It is distinct from Certiport's Information Technology Specialist credentials, which use the same acronym but are a separate program.
The written exam has 100 questions with a two-hour limit and a 75% passing score. There is no hands-on assessment. The competency document lists ten major areas, and ETA does not publish percentage weights for them.
The exam fee is USD 105. Remotely proctored testing adds USD 16. A Journeyman upgrade, available later with CETa and at least two years of combined training and experience, costs USD 55. See our cost breakdown for the full picture.
Yes, a valid CompTIA Security+ (ce) credential can roll over to ITS for USD 105 with proof of the current certificate. Lifetime Security+ certificates are excluded. Rollover is a credential route, not evidence that the two syllabi match.
One eligible free retake is available after a 30-day wait and must be completed within one year of the first attempt. A remote retake still incurs the proctoring fee. Results display immediately after testing through Trapeza.
Understanding the name is only the first step. Once you know ITS means Information Technology Security and that ETA's ten competency areas define the exam, you can build a focused plan. When you are ready to test yourself against realistic questions, head to the ITS practice tests and start with the domains you find least familiar.