BCS CITP and RITTech Explained: SFIA Levels, Evidence and the CPD Rules

BCS, The Chartered Institute for IT, runs the UK's chartered status for technology professionals. If someone on your team signs off as CITP MBCS, this is what sits behind those letters — and it is a competence assessment rather than an exam, which makes it a different kind of thing from the certification market most IT training budgets are pointed at.

This guide is written from BCS's own published standard and policies, read in October 2026. Where the documents are silent or disagree with each other, that is stated rather than smoothed over.

What CITP actually assesses

Chartered IT Professional is described by BCS as "the flagship standard for professionals working in the IT industry". It is assessed in two parts.

Technical expertise is measured against SFIA, the Skills Framework for the Information Age. The standard requires evidence against a minimum of four SFIA skills, at SFIA level 5 for at least two of them and a minimum of level 3 for the others. Breadth is assessed separately: a minimum of five SFIA skills at level 3 from outside the applicant's own area of practice. Where someone holds an accredited qualification, depth and breadth are considered to have been met.

Professional behaviours are assessed across four areas, named in the standard as:

• Leadership — working under broad direction, establishing milestones and assigning responsibilities, building effective business relationships
• Decision making — decisions that affect delivery to time, cost and quality, advising on scope and options, and recognising the limits of one's own expertise
• Problem solving — appropriate technique, creativity and ethical thinking, and applying fundamental principles in unpredictable contexts
• Values — keeping skills current, acting as a role model and developing others, and managing the ethical implications of professional work

No SFIA level is attached to the behaviours. Evidence for the first three is given using what the standard calls the STARE approach — an acronym the document does not expand. The ethics criterion asks specifically for examples covering sustainability, equality, diversity and inclusion, and legal, social or professional issues, with each covered at least once across the evidence.

Worth noting for anyone preparing an application: the values criterion requires evidence of CPD undertaken within the last two years, including its impact, plus the CPD planned for the next twelve months. CPD is not an afterthought at the end of the process; it is part of the assessed evidence.

Eligibility, route and assessment

An applicant must hold BCS membership at Professional (MBCS) or Fellow (FBCS) grade, or the equivalent class of membership with a body licensed to award CITP, and must be actively engaged within the scope of the IT profession.

BCS's admission policy names three routes: academic accreditation (an accredited qualification plus practical experience), industry accreditation (awarded on the qualification without further competence evidence), and experiential (evidence of breadth and competence through practical work experience). The application itself runs online through MyBCS: become a member, submit written evidence, nominate a supporter, submit, and receive the outcome.

The supporter requirement is looser than many chartered schemes. BCS's policy accepts "a Chartered professional, a senior colleague, or a peer", and the CITP page says the supporter "could be your employer, a colleague or client — as long as they're familiar with your work". BCS contacts the supporter to validate the application.

There is no interview. None of BCS's published CITP documents mentions one. Applications are reviewed by at least one CITP assessor and may also be checked by a CITP Review Panel. Unsuccessful applicants receive detailed feedback.

Fees, as published on the CITP page in October 2026: a one-off application fee of £160 and an annual subscription of £50. The application fee is non-refundable, except where the application is closed because a supporter did not respond. Fees change, so check before budgeting.

RITTech, and how it differs

RITTech is BCS's registration for IT technicians, and the documented differences from CITP are structural rather than a matter of degree:

• Membership required is Associate, Member or Fellow — not MBCS or FBCS
• Competence is assessed against four criteria BCS labels P1 Autonomy, P2 Influence, P3 Complexity and P4 Business Skills, rather than SFIA levels and the behaviours above
• Evidence uses the STAR technique — situation, task, action, result — and should only refer to experience from the last three years
• The applicant must be employed within the profession at the time of applying, and the supporter must be in a senior position with recent first-hand experience
• Outcomes are quick: BCS quotes 7 to 14 working days, and successful applicants receive a certificate of current competence valid for three years

An applicant assessed as not meeting the level applied for may be assessed against a lower level and awarded accordingly, and registrants can apply to upgrade later.

The CPD obligation — and the number that does not exist

This is the finding that surprises most training managers. BCS's CPD policy states no hours or points figure. Not in the CPD policy, not in the CITP standard, not on the registration pages. The requirement is that CPD be "relevant to their area of IT specialism", and for CITP that it is evidenced through assessment of current competence.

How compliance is handled depends on which hat the person is wearing, and the three regimes are genuinely different:

• General BCS membership — "Compliance is not monitored." Failure may be treated as a breach of the Code of Conduct
• CITP — evidenced through assessment of current competence under BCS's own policy for determining it. No removal consequence is stated
• RITTech — "Registrants who do not evidence compliance will be removed from the register"
• Engineering Council registrants — BCS, as a licensee, must request evidence from a sample of registrants each year. Those with a CPD record in the previous three years are excluded from the sample. Registrants who do not respond within twelve months lose their Engineering Council registration at their next renewal

So the same institute operates an unmonitored obligation, an assessed one, a removal-backed one and an annually sampled one, depending on the registration. An employer tracking "BCS CPD" as a single compliance line is tracking something that does not exist.

Keeping the registration

Both CITP and RITTech revalidate every three years with CPD evidence. CITP remains active for as long as the holder maintains BCS membership and the CITP subscription and completes revalidation. RITTech registrants get a reminder three months before lapse. No annual declaration is required for either.

What the documents do not say

Three gaps are worth knowing about before you rely on secondhand summaries.

First, BCS's published CITP and RITTech documents do not name CEng, IEng or EngTech, even though they confirm BCS holds an Engineering Council licence, and they make no reference to the UK Cyber Security Council or its chartered cyber titles. If a role profile needs a cyber-specific registration, that is a separate scheme — our guide to cyber security qualifications and UK professional registration covers it.

Second, the documents disagree with each other in places. The CITP standard says two specialisms are "being developed" — cyber security, and data and analytics — while the CITP page lists seven, adding leadership change and transformation, education and training, artificial intelligence, availability and resilience management, and architecture. The standard's depth criterion says level 3 for the further skills where the application guidance says "level 3 or 4". BCS's admission policy carries version 1.4 dated July 2025 on its cover and 1.2 dated April 2024 in its footer. The CPD policy is version 5, July 2020.

Third, the criteria for the Member and Fellow grades themselves sit in Trustee Board regulations and the BCS bye-laws rather than in the registration documents, so they cannot be read off the public pages.

How it compares, practically

CITP is a competence registration: no exam, evidence of what you have actually done, assessed against a skills framework, revalidated every three years. A certification such as CISSP works the other way round — an exam plus a counted experience requirement, maintained through a specified number of credits. They are not substitutes, and a senior technologist may sensibly hold both: one evidences professional standing in the UK, the other evidences assessed knowledge internationally.

For an employer, the practical difference is that CITP evidence has to be generated by the work. A development plan that produces no documented decisions, no breadth outside the person's specialism and no recorded CPD impact will not produce a chartered application, however much training it contains. Planning CPD with that evidence trail in mind is the part most firms leave until the application is due.

Sources and limits: written from BCS's CITP registration page, the Chartered IT Professional Standard, the Policy for CPD (V5, July 2020), the Policy for Admission to a BCS Professional Register and Membership, and the RITTech criteria and application guidance, all read in October 2026. Several linked policies — including the policies for determining and revalidating current competence, Trustee Board regulations Schedule 1 and the bye-laws — were not read and may qualify points above. Verify fees and criteria with BCS before acting.