- The Short Answer: What an ITS Is
- Who Issues It and What It Is Not
- The Exam Format at a Glance
- The Ten Competency Areas
- Worked Scenarios That Mirror the Blueprint
- Registration, Testing Rules and Fees
- ITS vs Security+ and Certiport's Credentials
- Keeping the Credential Active
- Who Benefits From It
- A Domain-by-Domain Study Sequence
- Frequently Asked Questions
- ITS here means Information Technology Security, a credential issued by ETA International, not any other certification sharing the acronym.
- The written exam has 100 questions, a two-hour limit, a 75% passing score, and no hands-on component.
- The exam fee is USD 105; remote proctoring adds USD 16 for this two-hour exam.
- Ten published competency areas drive the questions, from network hardware security through social engineering.
The Short Answer: What an ITS Is
When people ask "what is a ITS?" in the context of IT credentials, the answer on this site is specific: Information Technology Security (ITS) is a vendor-neutral, knowledge-based certification administered by ETA International. It verifies that a technician understands how to protect networks, devices, facilities, data, and people from threats, and how to respond when protection fails.
The acronym is overloaded in the IT world, so it is worth being precise from the start. This article covers only the ETA Information Technology Security credential. If you landed here looking for a different certification that happens to share the letters, the details below (the issuer, the fee, the question count, the competency list) will not apply to it. For other framings of the same question, see our explainers What Is ITS?, What Does ITS Stand For?, and ITS Meaning.
At its core, the credential answers one question for employers: can this person recognize security risks across the full stack, from the server-room door lock to the encryption algorithm protecting a file, and apply sound practice? It is a breadth credential. Rather than diving deeply into one product or platform, it surveys ten areas of security knowledge and tests recall, comprehension, and application through written questions.
Who Issues It and What It Is Not
ETA International is a long-established certifying body for electronics and information technology technicians. Its certification catalog includes a range of technician credentials, and ITS sits among its information technology offerings. The exam questions derive from ETA's published Information Technology Security Competency Requirements, an eight-page document (copyright 2024) that lists exactly what a candidate is expected to know.
Two other things the credential is not. It is not a hands-on practical assessment; ETA lists no performance component for ITS. And it is not a Security+ clone, though the two overlap in subject matter and there is a rollover route between them, covered below. For a fuller explanation of how the certification is positioned, read What Is ITS Certification? and our overview page ITS Certification.
The Exam Format at a Glance
| Item | ETA Information Technology Security (ITS) |
|---|---|
| Format | Written knowledge examination |
| Questions | 100 |
| Time limit | Two hours |
| Passing score | 75% |
| Hands-on component | None |
| Exam fee | USD 105 |
| Remote proctoring surcharge | USD 16 for this two-hour exam |
| Certification term | Four years |
Two points deserve emphasis. First, 75% is a score threshold, not a pass rate. No issuer-wide pass rate has been verified for this exam, so be skeptical of any site that quotes one; our page ITS Pass Rate 2026: What the Data Shows explains what can and cannot be said honestly. Second, the passing mark means you can miss up to a quarter of the questions, but because the content spans ten distinct areas, a blind spot in even one or two areas can quickly consume that margin. More detail on scoring lives in ITS Passing Score 2026.
ETA does not publish percentage weights for the competency areas, so you should not assume any domain is "worth" more than another. Treat all ten as fair game.
The Ten Competency Areas
ETA states that examination questions derive from its published competencies. The ten major areas are below, with the kinds of concepts a candidate should be ready to explain. For a deeper walkthrough of each, see ITS Exam Domains 2026: Complete Guide to All 10 Content Areas.
Domain 1: Network Hardware Security Fundamentals
How the physical and logical building blocks of a network are secured and where each fits.
- Firewalls, routers, switches, and how each contributes to segmentation and filtering
- Intrusion detection and prevention concepts and where they sit in a topology
- Securing network infrastructure devices against misconfiguration and unauthorized access
Domain 2: Physical Security
Controlling who and what can reach equipment and facilities.
- Surveillance and access control layers, from perimeter to server room
- Badge systems, RFID and NFC, and the weaknesses specific to each
- How physical controls complement, rather than replace, logical controls
Domain 3: Network Software Security
The protocols and software mechanisms that protect data in motion and services in use.
- Secure versus insecure protocols and when each is appropriate
- Authentication and authorization models
- Legacy protocols, which the competency document includes and which you should be able to explain in historical context
Domain 4: Wireless Security
Protecting radio-based networks and the clients that use them.
- Wireless encryption standards and their relative strengths
- Common wireless attacks and the controls that counter them
- Secure configuration of access points
Domain 5: Device Security
Hardening endpoints, mobile devices, and connected hardware.
- Endpoint protection and configuration baselines
- IoT and Bluetooth risks, including why small connected devices are frequent weak links
- Mobile device management concepts
Domain 6: Software Exploitations and Vulnerabilities
How attackers abuse software and how defenders reduce exposure.
- Common exploit categories and malware types
- Patching and vulnerability management
- Recognizing attack symptoms from a described scenario
Domain 7: Operational Standards, Policies and Risk Assessments
The governance layer: written policy, standards, and quantified risk.
- Security policy types and their purposes
- Risk assessment terminology, including SLE, ARO, and ALE
- Cloud shared-responsibility reasoning
Domain 8: Disaster Recovery and Computer Forensics
Planning for failure and investigating incidents.
- Recovery site types and the trade-offs between them
- Backup strategy and continuity planning
- Evidence handling principles in forensic work
Domain 9: Cryptography
The mathematics-light but concept-heavy foundation of confidentiality and integrity.
- Symmetric versus asymmetric encryption and hashing
- Public key infrastructure, certificates, and trust chains
- Digital signatures and what they prove
Domain 10: Social Engineering
The human attack surface.
- Phishing and its variants, pretexting, tailgating, and similar techniques
- User awareness as a control
- Matching a described manipulation to its technique name
Worked Scenarios That Mirror the Blueprint
The exam is written, but many questions are framed as short situations. Working through scenarios is the most efficient way to move from memorization to the application the exam rewards. The examples below are original illustrations, not actual exam items.
Scenario 1: Quantifying risk (Domain 7)
A small clinic estimates that a single ransomware incident would cost USD 40,000 (that is the single loss expectancy, or SLE). Based on its environment, it expects roughly one such incident every two years, an annualized rate of occurrence (ARO) of 0.5. The annualized loss expectancy is SLE multiplied by ARO: USD 20,000 per year. If a control costing USD 6,000 per year cut the ARO to 0.1, the new ALE would be USD 4,000, and the control would pay for itself with margin. Know the formula, but also be able to say in words what each term means, since questions often test vocabulary rather than arithmetic.
Scenario 2: Cloud shared responsibility (Domain 7)
A company moves its customer database to an infrastructure-as-a-service virtual machine. The provider secures the physical data center and hypervisor. Who patches the guest operating system and configures database access rules? The customer. The recurring exam logic: as you move from infrastructure toward software-as-a-service, the provider takes on more of the stack, but the customer always retains responsibility for its own data and access decisions.
Scenario 3: Layered physical access (Domain 2)
An office uses badge readers on the main door, cameras covering the lobby, and a locked server closet. A visitor follows an employee through the door without badging in. Which control failed, and which technique was used? The behavior is tailgating (also a Domain 10 social engineering concept), and the countermeasures include a mantrap or turnstile, guard presence, and employee awareness. Notice how one scenario can touch two domains; the blueprint's areas are not walled off from each other.
Scenario 4: Choosing a recovery site (Domain 8)
A business needs to resume operations within minutes of an outage and can afford the expense. Which recovery site fits? A hot site, fully equipped and mirrored, supports the shortest recovery time at the highest cost; a cold site is cheapest but slowest; a warm site sits between. Questions typically describe a recovery objective and a budget and ask you to match them.
Scenario 5: Trust in a certificate (Domain 9)
A browser warns that a site's certificate was not issued by a trusted authority. In PKI terms, the chain of trust leads back to a root certificate authority; if the issuing authority is not trusted, or the certificate is expired or revoked, validation fails. Be able to explain what a certificate binds (a public key to an identity), who vouches for it, and why a digital signature proves origin and integrity but not secrecy.
Key Takeaway
Practice translating plain-language situations into the correct term: tailgating, hot site, SLE, root CA. The exam rewards candidates who can name the concept hiding inside a story. Our ITS practice tests are built around exactly that skill.
Registration, Testing Rules and Fees
Testing is arranged through an ETA Certification Administrator. The exam is delivered via Trapeza online testing or on paper, and remotely proctored delivery is available through ExamRoom.AI after you register with ETA. The base exam fee is USD 105. Remote proctoring adds USD 16 for this two-hour exam, and initial remote scheduling can take up to 72 hours, so do not leave booking to the last minute. Our ITS Exam Dates page covers scheduling logistics, and ITS Certification Cost 2026 breaks down every fee in one place.
For remote candidates, the technical and conduct requirements are strict:
- A working webcam, microphone, a recent computer, and at least 3 Mbps internet
- Photo ID
- Scratch paper and non-programmable or scientific calculators are allowed; used scratch paper must be surrendered
- Phones are prohibited
- You may not leave the room once testing begins
Trapeza displays results immediately. If you do not pass, one eligible free retake is available after a 30-day wait and must be completed within one year of the first exam. A remote retake still incurs the proctoring fee.
Eligibility
The competency document recommends prior computer-systems and networking experience and prior IT or networking certification as preparation. ETA's issuer badge page separately describes practicing-technician experience, a written examination, and acceptance of the Code of Conduct. The Stand-Alone route does not require Associate CET (CETa). A later Journeyman upgrade, by contrast, requires CETa and at least two years of combined training and experience, with a USD 55 upgrade fee. Details are in ITS Requirements 2026.
ITS vs Security+ and Certiport's Credentials
Two comparisons come up constantly. The table below summarizes what can be stated reliably.
| Question | ETA ITS | Related credential |
|---|---|---|
| Issuer | ETA International | CompTIA (Security+); Certiport (Information Technology Specialist) |
| Blueprint source | ETA's published 2024 competency requirements | Each issuer publishes its own |
| Relationship | Accepts a valid Security+ (ce) as an alternative rollover route | Rollover does not make a CompTIA syllabus the ETA blueprint |
The rollover is a practical convenience: a valid CompTIA Security+ (ce) credential offers an alternative route to ITS for USD 105 with proof of the current certificate. Lifetime Security+ certificates are excluded. Importantly, a rollover is a pathway between credentials, not evidence that the two exams cover identical material. If you plan to sit the ETA exam, study against ETA's competency objectives, even if you use a Security+ resource as supplementary reading.
Keeping the Credential Active
ITS follows ETA's general, non-hands-on maintenance program over a four-year certification term. To maintain it, you submit the Certification Maintenance Form with 10 relevant continuing-education hours annually (40 over the four-year cycle), or alternatively a supervisor-completed Employer Verification Form. Either way, the fee is USD 25 annually, USD 100 over four years, and annual submission includes ETA membership.
The employer-verification path is useful for working technicians whose jobs already demonstrate ongoing relevant activity, while the continuing-education path suits independent or between-jobs professionals. Pick whichever you can document most easily, and keep records as you go rather than reconstructing them at the deadline.
Who Benefits From It
ITS is aimed at technicians and early-to-mid-career IT staff who need verifiable security literacy: help-desk and desktop support staff moving toward security duties, network technicians, field and systems technicians in organizations that must show baseline security competence, and people building a documented credential trail. Because it is vendor-neutral and written-only, it also suits candidates who want a recognized security credential without the cost and complexity of a lab-based exam.
On earnings, a note of caution: ETA's official fact sheet labels its wage figures as 2016 and its employment projections as 2022-2032. Those numbers should not be read as current salary evidence or as a pay premium attributable to this specific certification. For a measured treatment, see ITS Salary Guide 2026, Is the ITS Certification Worth It?, and the roles overview in ITS Jobs.
A Domain-by-Domain Study Sequence
Because the ten domains vary in character, sequencing matters more than generic scheduling. A sensible order groups related ideas so each week builds on the last:
Infrastructure foundations
- Domain 1 (network hardware) and Domain 2 (physical security): they share the "protect the equipment" theme
- Draw a layered perimeter diagram from memory
Protocols and radio
- Domain 3 (network software) and Domain 4 (wireless)
- Build a table pairing each protocol or standard with its purpose and weakness; note legacy items explicitly
Devices and exploits
- Domain 5 (devices, including IoT and Bluetooth) and Domain 6 (exploitations)
- Match each threat to the control that counters it
Governance and recovery
- Domain 7 (policies and risk) and Domain 8 (recovery and forensics)
- Drill ALE, SLE, and ARO until the arithmetic is automatic; compare hot, warm, and cold sites
Cryptography, people, and review
- Domain 9 (cryptography, PKI) and Domain 10 (social engineering)
- Finish with full-length timed practice: 100 questions in two hours
Pair this sequence with the competency document itself, which is free from ETA, and with a structured plan from ITS Study Guide 2026: How to Pass on Your First Attempt. For a quick final pass, the ITS Cheat Sheet condenses the must-know facts. Candidates wondering about workload should read How Hard Is the ITS Exam?, and those exploring structured courses can compare options in ITS Training.
A note on optional prep products
Some commercial courses exist. One example is eITprep's CompTIA Security+ Study Guide for ETA ITS, which lists USD 59.95 for six months of access, two custom practice exams, 100 electronic flashcards, a searchable glossary, and 45 course contact hours. Keep two distinctions clear. Those 45 hours are course contact hours, not part of the exam, which is a single two-hour sitting. And the 100 flashcards are a product feature, unrelated to the exam's 100 questions. The course does not confer certification, and its public description does not state which Security+ edition it follows, so map any use of it back to ETA's 2024 competency objectives. Unofficial question dumps and cheat sheets found on document-sharing sites vary widely in accuracy and have no issuer authority; use them, if at all, only to find topics to verify against the blueprint. Original, objective-mapped practice on our main practice test site is a safer way to test yourself.
Frequently Asked Questions
It stands for Information Technology Security, the written certification administered by ETA International. It is separate from Certiport's Information Technology Specialist credentials and from any other credential that uses the same acronym. See What Does ITS Stand For? for more.
The exam has 100 questions with a two-hour limit, and the passing score is 75%. It is a written knowledge exam with no hands-on portion. The 75% figure is a score requirement, not a published candidate pass rate.
The exam fee is USD 105, with a USD 16 surcharge if you take it remotely proctored. A free retake is available once, after a 30-day wait and within one year of the first attempt, though remote retakes still pay the proctoring fee. A fuller breakdown is in ITS Certification Cost 2026.
No. The Stand-Alone route does not require Associate CET (CETa). Prior networking experience and certification are recommended for preparation, but not listed as a prerequisite for the stand-alone exam. A later Journeyman upgrade does require CETa plus at least two years of combined training and experience.
Over the four-year term, submit the Certification Maintenance Form with 10 continuing-education hours each year (40 total), or an employer-completed verification form, plus USD 25 annually. Holders of a valid, non-lifetime Security+ (ce) credential may alternatively obtain ITS through a USD 105 rollover.