CPP (ASIS)

It is ASIS International's protection management certification, offered alongside the APP®, PCI® and PSP® credentials. It suits security professionals who already manage programmes, budgets, people or risk, and who want external validation of that management judgement. If you are still building foundational experience, ASIS positions its other certifications and certificate courses as earlier steps.

The blueprint runs across security fundamentals, business principles and practices, investigations, personnel security, physical security, information security, and crisis management. Expect the business and management domains to carry real weight: cost justification, policy writing, programme governance and cross-functional influence appear throughout, not only in the business section. Confirm the current blueprint weighting with ASIS before you build a study plan.

Questions are multiple choice. Treat them as applied scenarios rather than recall drills: most stems describe a situation and ask for the best next action or the most appropriate control. Practise narrowing to the two plausible options and choosing the one that is proportionate, policy-driven and documented. Verify current delivery format, length and scoring with ASIS directly.

This page does not publish duration, item count, fees or passing scores, because those figures are set by ASIS and change between exam revisions. Rather than rely on a stale number, check the ASIS certification pages and your local test centre guidance for the current values before you schedule. Budget for a possible retake when planning cost.

Difficulty comes from breadth, not trickery. Candidates with deep experience in one domain - investigations, say, or physical security - often underestimate the business, information security and crisis management content. The exam rewards people who can reason across all of them and who understand why a control is chosen, not just what it is called.

Start with security fundamentals to fix vocabulary and risk concepts, then business principles, because cost justification and governance logic frame answers elsewhere. Next take physical and information security as a pair, then personnel security and investigations, and finish with crisis management, which draws on all the rest. Revisit your weakest domain in the final weeks.

Answering from habit instead of from the scenario, memorising definitions without practice in applying them, skipping the business and management material, and choosing the most aggressive or technical option when a measured, documented, policy-based step is correct. Also common: not reading the whole stem, so the qualifier - first action, best action, most cost-effective - gets missed.

Retake eligibility, waiting periods and fees are set and revised by ASIS, and this page does not state them. Check the ASIS certification FAQ and your candidate handbook for the current policy before you sit, and note that ASIS describes member discounts on its certification programmes, which may affect your overall cost.

Membership requirements are not stated in the material this page is built from, so confirm with ASIS. ASIS does describe exclusive member discounts on career-advancing certifications, plus access to standards and guidelines, chapters and mentoring. If you are deciding, weigh the certification discount and standards access against the membership cost.

No single figure fits, because the honest variable is the gap between your experience and the blueprint. Audit yourself domain by domain, rate confidence honestly, and allocate study blocks in inverse proportion to that confidence. Short, frequent sessions using scenario questions beat long reading marathons, and a written study calendar keeps the weaker domains from being avoided.