ASIS APP study plan
ASIS APP · Give each week a clear focus.
8 weeks · About 6 hours per week
Security Fundamentals & Risk Management
Define and distinguish core security concepts (confidentiality, integrity, availability, and related principles) in your own words
Map the components of the risk management process and sequence them correctly
Identify the qualitative and quantitative risk assessment methods and when each applies
List the elements of a physical security risk assessment from memory
Your checkpoint
A one-page concept map linking security fundamentals to the risk management process, with definitions written in your own words
Risk Management
Compute single loss expectancy (SLE) and annualized loss expectancy (ALE) from given asset value, exposure factor, and annualized rate of occurrence
Explain how risk is treated through avoidance, mitigation, transfer, and acceptance
Differentiate threats, vulnerabilities, and impacts in written scenarios
Interpret a completed risk register and prioritize its entries
Your checkpoint
A worked problem set of 10 quantitative risk calculations with correct answers and a ranked risk register for a sample facility
Security Fundamentals & Risk Management
Explain the purpose and structure of a security policy hierarchy
Describe how security program governance connects to risk tolerance
Summarize common security frameworks and standards at a conceptual level
Apply risk concepts to a written scenario and justify a treatment decision
Your checkpoint
A two-page written analysis of a security scenario that cites the relevant policy tier and recommends a defensible risk treatment
Business and Organizational Principles
Describe the core functions of management: planning, organizing, leading, and controlling
Explain how security aligns with organizational strategy and mission
Outline a basic budget justification using cost-benefit reasoning
Identify key stakeholders and describe how to communicate security value to them
Your checkpoint
A one-page budget justification memo for a proposed security initiative aimed at a non-security executive audience
Business and Organizational Principles & Physical Security
Explain the purpose and components of a business continuity and disaster recovery program
Distinguish business impact analysis from risk assessment
Describe the layered physical security model and the role of each layer
Identify perimeter, interior, and access control measures and their trade-offs
Your checkpoint
A layered physical security diagram for a sample site annotated with the control type and rationale for each layer
Physical Security
Compare intrusion detection approaches and explain their strengths and limitations
Describe the function of access control systems, credentials, and authorization logic
Explain how lighting, landscaping, and CPTED principles influence security
Outline the elements of a physical security survey or audit
Your checkpoint
A completed physical security survey checklist for a hypothetical building, with at least five findings and recommended countermeasures
Security Fundamentals & Business and Organizational Principles & Risk Management & Physical Security
Integrate concepts across all four domains into a coherent security program narrative
Identify your two weakest domains based on practice results and target them
Practice scenario-based reasoning under time constraints
Correct misconceptions revealed by practice questions
Your checkpoint
A written error log of at least 20 missed practice items categorized by domain, with corrected reasoning for each
Security Fundamentals & Business and Organizational Principles & Risk Management & Physical Security
Complete a full-length timed practice assessment and analyze results by domain
Review your error log and confirm resolution of recurring mistakes
Recite key formulas, definitions, and frameworks from memory
Finalize a test-day strategy covering pacing and question triage
Your checkpoint
A final readiness report summarizing practice scores by domain, remaining weak areas, and a written test-day plan
Milestones
Week 2: Score at least 80% on a self-made 10-item quantitative risk calculation quiz without notes
Week 4: Explain the risk management process and management functions to a study partner or on paper in under 10 minutes each, with no reference material
Week 6: Complete the physical security survey deliverable and correctly classify every listed countermeasure by layer and control type
Week 8: Achieve at least 75% overall on a full-length timed practice assessment, with no domain below 65%