CCITP-A Exam Domains 2026: Complete Guide to All 6 Content Areas

CCITP-A Exam Structure at a Glance

Before drilling into content, it helps to understand the shape of the test itself. The CCITP-A assessment is a scenario-based, multiple-choice exam made up of 86 total questions - 80 scored and 6 unscored - administered in 135 minutes at a Pearson VUE test center. Candidates must already hold DAU eligibility approval before they can schedule a seat, and the published handbook lists no assessment fee for eligible candidates, since the credential is administered through DCSA/CDSE/SPeD Program Management Office rather than a traditional membership-based certifying body.

Passing isn't a simple raw-percentage calculation. The handbook specifies a scaled passing threshold of 650 out of 800, which is a different thing entirely from "get 81% of questions right." For a deeper breakdown of exactly how that scaling works, see our dedicated CCITP-A Passing Score guide. If you're still mapping out eligibility - the CITP-F prerequisite, the 12-month program experience requirement, the training hour minimums - the CCITP-A Requirements breakdown walks through each piece in order.

Here's how the six content domains break down, based on the most recently verified official weighting material:

Domains 4 and 5 are published jointly rather than as individual percentages, but together they represent more of the exam than any other content area - which should shape how you allocate study time. We'll address each domain below, and if you want a condensed, printable version of this breakdown once you've read it, bookmark the CCITP-A Cheat Sheet.

Domain 1: Policy and Directives (20%)

This domain tests your command of the governing framework that authorizes and constrains Insider Threat Program analysis work. Because CCITP-A sits at the intersection of counterintelligence and security policy, expect questions that probe whether you understand not just what a directive says, but when and how an analyst is authorized to act on information.

Because this is a scenario-based exam rather than a straight recall test, Policy and Directives questions are frequently framed as "what should the analyst do next" rather than "define this term." That framing matters for how you study - memorizing definitions alone won't get you through this domain.

Domain 2: Social and Behavior Science (10%)

At 10%, this is the lightest domain by published weight, but don't mistake "smallest" for "skippable." Social and behavior science underpins how an analyst interprets indicators in context - distinguishing a legitimate behavioral change from one that warrants further review.

Because eligibility requires review of 10 case studies as part of the prerequisite track, expect this domain to lean on applied judgment drawn from real program scenarios rather than textbook psychology.

Domain 3: Researching (20%)

Researching ties for the second-largest individually published weight at 20%, alongside Policy and Directives. This domain assesses how an analyst gathers, verifies, and documents information relevant to a potential insider threat case - a core function distinct from the foundational-level CITP-F credential.

Domains 4 & 5: Synthesis and Tools and Methods (35% Combined)

Here's the most important structural fact about the current CCITP-A blueprint: Domains 4 (Synthesis) and 5 (Tools and methods) are published together, and jointly they account for 35% of exam content - the largest content grouping on the test. No verified individual split between the two exists in current official material, so don't build a study plan around guessed sub-percentages; instead, treat this combined block as your single highest-priority study area.

The 8-hour UAM policy/tool training prerequisite exists specifically because this content area is tested - if your training hours felt thin on tool-specific application, that's the gap to close first. Our CCITP-A Study Guide goes deeper into sequencing practice questions around this combined domain block.

Domain 6: Vulnerabilities Assessment and Management (15%)

At 15%, this domain closes the loop between identifying a potential insider threat indicator and managing the organizational vulnerability it represents. It's distinct from Researching in that it's forward-looking - focused on mitigation and ongoing management rather than initial data gathering.

Mapping the Domains to a Study Timeline

Generic study techniques only matter here if they're anchored to CCITP-A's actual weighting. Given that Domains 4 and 5 jointly represent 35% of the exam, and Domains 1 and 3 each represent 20%, a reasonable four-week structure front-loads the heaviest-weighted material first and reserves the final week for the two lighter domains plus full-length review.

For candidates wondering whether the overall exam difficulty warrants this much structure, our CCITP-A difficulty guide breaks down what makes the scaled-score format and scenario-based question style challenging compared to simple recall exams.

Who Actually Tests You On These Domains

CCITP-A isn't issued by a commercial training vendor - it's jointly conferred through the Under Secretary of Defense for Intelligence and Security and the Director of the National Counterintelligence and Security Center, with day-to-day administration handled by DCSA, CDSE, and the SPeD Program Management Office. That governance structure is why the domains lean so heavily on policy, authority, and documented program procedure rather than generic analytic theory you'd find in a commercial data-analysis certification.

As of the most recent published tracker, 223 active CCITP-A credentials were recorded in DAU - a relatively small, specialized population compared to broader IT or security certifications. If you're trying to gauge demand or career impact before committing to the eligibility process, the CCITP-A Jobs page and the CCITP-A ROI analysis both dig into what this credential signals to a hiring program manager within a federal or cleared-contractor Insider Threat Program.

Once certified, maintaining the credential currently requires 100 PDUs per two-year cycle, with at least 50 of those tied specifically to Insider Threat-related content and recorded in DAU. Older program material referenced a three-year cycle, so confirm your individual expiration date and any transition treatment directly with your SPeD Program Management Office point of contact rather than assuming either cycle length applies automatically.

If you haven't started studying yet and want a broader orientation before diving into domain-level prep, our practice test platform is built around these same six domains and the 86-question, 135-minute format described in the current handbook. You can also start with What Is CCITP-A? or CCITP-A Meaning for foundational orientation before working through domain-specific practice sets on the main practice site.

Frequently Asked Questions