CPP (ASIS) common mistakes
CPP · Understand the traps and how to avoid them.
When a question asks who establishes security policy, the candidate selects the security manager or CSO as the issuer rather than identifying executive management as the approving authority.
Most candidates come from operational roles where they personally write and enforce the rules, so they map their own job onto the organizational hierarchy and choose the answer that sounds most like their daily work.
What to do instead
Memorize the governance chain: executive management sets and issues policy; the security function drafts, recommends, and implements it through standards, procedures, and guidelines. In any 'who' question, ask whether the option describes setting direction (executive) or executing it (security).
On 'FIRST step' or 'which should be done first' items, the candidate picks the option that installs a control or writes a procedure instead of the option that assesses the risk or identifies the requirement.
Experienced practitioners pattern-match to solutions they have deployed before; the tactic feels obviously correct, and the assessment step feels like a bureaucratic delay rather than the answer being tested.
What to do instead
Before answering, ask: has the risk been assessed and the requirement documented? If an option describes a safeguard and another describes analysis or requirement-gathering, the analytical option usually precedes it. Treat the program lifecycle as fixed order: assess, plan, design, implement, test, review.
Choosing the strongest, most comprehensive safeguard regardless of what it costs, rather than the option that quantifies the risk reduction and recommends it to management.
Security training rewards risk elimination, so cost feels like an excuse for under-protecting. Candidates underestimate how heavily the exam weights business justification and management decision-making.
What to do instead
Run the arithmetic explicitly: single loss expectancy times annualized rate of occurrence gives annualized loss expectancy; compare that with the annualized cost of the control including maintenance, training, and staffing. When two options both reduce risk, prefer the one framed as a recommendation with a stated business case over a unilateral mandate.
Answering budget and project questions with technical specifications and threat descriptions while omitting total cost of ownership and the link to a business objective.
Candidates are comfortable describing how a control works and uncomfortable with financial framing, so they default to the material they know and skip the justification layer the question is actually testing.
What to do instead
For every proposal, be ready to state three things: the business objective it supports, the full cost across the lifecycle (acquisition, installation, maintenance, training, staff time), and the measure of effectiveness. If an option justifies spend in operational or financial terms and another only describes capability, the justification option is the better answer.
In investigation scenarios, the candidate selects interviewing or confronting the suspected employee as the initial action, ahead of securing the scene, preserving evidence, and documenting chain of custody.
Dramatized investigation narratives put the interview at the center of the story, and interview skills are what investigators feel most confident about, so the sequence gets collapsed.
What to do instead
Fix the order in mind: confirm authority and scope, secure and preserve evidence with documented custody, then analyze, then interview. If an option moves toward a person before evidence is protected, it is almost always premature.
Selecting options in which the security investigator determines guilt, imposes discipline, or conducts a search without an identified source of authority such as written policy, consent, or legal counsel involvement.
Candidates conflate the investigative role with the disciplinary or law-enforcement role, and they assume that a security title carries inherent authority to search and sanction.
What to do instead
Anchor every authority question to its source: company policy, written consent, statutory power, or direction from legal counsel. The investigator establishes and reports facts; HR, management, or legal decide outcomes. Options that have security deciding culpability or punishment are distractors.
Treating personnel security as a pre-employment screening gate only, and routing behavioral or insider-threat concerns to security rather than to the manager and HR with security advising.
Screening is the visible, procedural part of personnel security and easy to study, while the continuous, cross-functional parts are diffuse and feel like common sense, so they get skipped.
What to do instead
Build the full lifecycle in memory: pre-employment verification, onboarding and awareness, continuous monitoring and reporting channels, role change and transfer controls, and offboarding with prompt access and asset recovery. Assign behavioral and performance concerns to the supervisor and HR; security supplies indicators, investigation support, and access controls.
Matching physical controls to the wrong security function, such as selecting CCTV as a deterrent or lighting as a detection measure, when the question specifies the function required.
Candidates memorize lists of equipment without tagging each item to deter, detect, delay, deny, or respond, so recall produces a familiar device instead of the device that performs the named job.
What to do instead
For every control you review, write one line naming its primary function and its layer in the defense-in-depth stack. Answer by working backward from the function and asset named in the stem, then eliminating any option whose primary function differs.
Confusing the data owner, custodian, and user roles, and answering that the IT organization decides who may access a given data set or sets information security policy.
In practice IT often administers access, so the observed workflow is mistaken for the accountability model the exam tests.
What to do instead
Use one sentence per role: the owner is the business manager accountable for the information, who classifies it and authorizes access; the custodian implements and maintains the controls; the user complies with the rules. Policy originates with executive management, is interpreted by the security function, and is implemented by custodians.
Answering crisis scenarios by immediately activating the plan, and treating crisis management as interchangeable with emergency response, business continuity, or disaster recovery.
The terms are used loosely in the workplace and overlap in practice, so candidates substitute the response they have rehearsed for the strategic, cross-functional process the question describes.
What to do instead
Separate the definitions: emergency response protects life and property at the scene; business continuity keeps priority functions running; disaster recovery restores technology; crisis management is the senior-level, cross-functional process for decision-making, stakeholder communication, and reputation. Sequence the opening moves as detect and verify, assess and classify, convene the crisis team, communicate, then recover and conduct the after-action review.