CPP (ASIS) cheat sheet

Risk = threat × vulnerability × consequence; assessments compare likelihood and impact to prioritize treatment.

Security controls are categorized as physical, procedural, or technical and by function as preventive, detective, corrective, deterrent, or compensatory.

Defense in depth uses layered, independent controls so a single failure does not defeat the protection system.

CPTED principles are natural surveillance, natural access control, territorial reinforcement, and maintenance.

The three lines of defense are operational management, risk and compliance oversight, and independent internal audit.

Due diligence requires reasonable care proportionate to foreseeable risk; negligence arises when that standard is breached.

Security governance flows from policy to standards to procedures to guidelines, with policy stating management intent.

Emergency management phases are mitigation, preparedness, response, and recovery.

ALE = SLE × ARO; SLE = asset value × exposure factor.

ROI = (net benefit ÷ cost) × 100; payback period = cost ÷ annual benefit.

NPV discounts future cash flows; a positive NPV indicates the investment exceeds the required return.

Capital budgets cover long-lived assets; operating budgets cover recurring expenses such as guard services and utilities.

An RFP requests detailed solutions for complex needs; an RFQ requests pricing for defined goods; an IFB invites sealed bids.

SLAs should define measurable performance, reporting, remedies, and right-to-audit provisions.

Security metrics include incident frequency, response time, loss per incident, training completion, and control compliance rate.

Stakeholder analysis maps influence and interest to determine engagement strategy; RACI assigns responsible, accountable, consulted, and informed roles.

Evidence categories include testimonial, documentary, physical, and digital; each requires documented collection and preservation.

Chain of custody records each transfer of evidence with date, time, handler, purpose, and storage location.

Miranda warnings generally apply to custodial interrogation by government agents, not to private-sector interviews absent state action.

Garrity-protected compelled statements by public employees generally cannot be used in subsequent criminal proceedings.

Weingarten rights give unionized employees representation in investigatory interviews that may lead to discipline.

The fraud triangle consists of opportunity, pressure, and rationalization; controls primarily reduce opportunity.

Digital evidence should be preserved with forensic imaging, hash verification, write blocking, and documented access.

Investigative reports state who, what, when, where, why, and how, using objective language and distinguishing fact from opinion.

Pre-employment screening commonly verifies identity, employment history, education, credentials, and criminal records, with consent.

The FCRA requires disclosure and authorization before a consumer report is used for employment purposes.

Least privilege grants only the access required for assigned duties; separation of duties prevents one person from controlling all phases of a transaction.

Onboarding and offboarding checklists control badge issuance, account provisioning, key control, and timely access removal.

Insider threat indicators include unusual access, financial stress, disgruntlement, policy violations, and unexplained data movement.

Security awareness programs use initial and recurrent training, phishing simulations, and reporting mechanisms.

Workplace violence prevention uses a multidisciplinary threat assessment team and documented behavioral concerns.

Contractor personnel should meet equivalent screening, confidentiality, and access-control requirements and be sponsored by an employee.

Physical security layers are outer perimeter, building envelope, interior zones, and restricted areas.

Deterrence discourages attack; detection identifies intrusion; response interrupts or mitigates loss; delay extends adversary time.

Access credentials fall into knowledge, possession, and inherence factors; two-factor authentication uses two different categories.

Fail-safe locks release on power loss for life safety; fail-secure locks stay locked for asset protection, subject to code.

Alarm systems include sensors, control panels, notification, and monitoring; verification reduces false alarm response.

CCTV design considers coverage, lighting, image quality, retention, privacy, and evidence handling.

Key control uses hierarchical master keying, serialized keys, issuance records, and rekeying after loss.

Visitor management verifies identity, records entry and exit, issues badges, and enforces escort or restricted-area rules.

The CIA triad is confidentiality, integrity, and availability.

Access control models include discretionary, mandatory, role-based, and attribute-based.

Authentication factors are knowledge, possession, and inherence; MFA requires two or more different factors.

Symmetric encryption uses one shared key; asymmetric encryption uses a public-private key pair; hashing verifies integrity.

Network defenses include firewalls, intrusion detection and prevention, segmentation, DMZs, and encrypted VPNs.

Incident response phases are preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

Vulnerability management includes asset inventory, scanning, risk ranking, patching, and verification.

Data classification determines handling, storage, transmission, retention, and destruction requirements.

Crisis management phases are pre-crisis preparedness, crisis response, and post-crisis recovery and learning.

The crisis management team typically includes executive leadership, security, operations, communications, legal, HR, and IT.

The incident command system uses a scalable command structure with operations, planning, logistics, and finance/administration.

A BIA identifies critical functions, dependencies, and impacts, and sets RTOs and RPOs.

RTO is the maximum acceptable restoration time; RPO is the maximum acceptable data loss measured in time.

Crisis communications use a single trained spokesperson, pre-approved templates, and stakeholder-specific channels.

Evacuation versus shelter-in-place decisions consider hazard type, time available, building conditions, and population needs.

After-action reviews document strengths, gaps, corrective actions, owners, and deadlines.