CPP (ASIS) key terms

The combination of the likelihood that a threat will exploit a vulnerability and the resulting impact on an organization's people, assets, or operations.

Any person, event, or condition with the potential to cause harm, loss, or disruption to an organization's assets, information, personnel, or ability to operate.

A weakness in a physical, procedural, or technical control that a threat could exploit to gain access, cause damage, or disrupt operations.

A control, device, or procedure implemented to reduce risk by preventing, detecting, deterring, or responding to a threat or vulnerability.

Layering multiple independent security controls so that if one fails, others continue to protect the asset; often described as perimeter, building, interior, and asset layers.

A structured process of identifying assets, threats, and vulnerabilities, then estimating likelihood and impact to prioritize risk treatment decisions.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, often expressed as thresholds that guide security spending and control decisions.

Crime Prevention Through Environmental Design: using landscaping, lighting, sightlines, and space layout to reduce opportunities for crime and increase natural surveillance.

The reasonable care and investigation an organization is expected to exercise to identify and prevent foreseeable risks before entering a decision or relationship.

A property owner's or occupier's legal responsibility to keep the premises reasonably safe and to warn or protect people from foreseeable hazards, including criminal acts.

A financial measure comparing the benefit or savings produced by an investment with its cost, usually expressed as a percentage or ratio.

A decision method that compares the expected costs of a security control or program with its expected benefits, often used to justify budget requests.

Any individual or group with an interest in, or affected by, an organization's security decisions, including employees, executives, customers, regulators, and owners.

The full lifetime cost of acquiring, operating, maintaining, and eventually retiring a security system or asset, beyond the initial purchase price.

A documented, unbroken record of who handled evidence, when, and where, from collection through final disposition, used to show the evidence has not been altered.

Tangible items collected at a scene, such as tools, documents, or biological material, that may be examined to establish facts in an investigation.

A planned conversation with a person who may have information about an incident, conducted to gather facts in a non-accusatory manner.

A structured, accusatory questioning process of a suspect designed to obtain admissions or confessions, typically conducted after investigative facts are established.

A model explaining occupational fraud as the convergence of pressure, opportunity, and rationalization; controls often target opportunity to reduce fraud risk.

An out-of-court statement offered to prove the truth of the matter asserted; generally inadmissible in legal proceedings unless an exception applies.

The covert or overt observation of people, places, or activities to gather information, detect wrongdoing, or support an investigation, subject to legal and privacy limits.

Liability arising when an employer fails to exercise reasonable care in screening an employee whose known or foreseeable characteristics later cause harm to others.

Verification of a candidate's identity, background, credentials, and references before hire, conducted within legal limits to reduce hiring risk.

Risk posed by employees, contractors, or others with legitimate access who misuse that access to harm the organization, often through theft, fraud, or sabotage.

A contract in which a person agrees not to disclose specified confidential information, protecting trade secrets and sensitive data during and after employment.

Ongoing training and communication that teaches employees to recognize threats, follow security policies, and report suspicious activity.

The process of granting, restricting, and logging entry to facilities or systems based on identity, authorization, and need, using locks, cards, biometrics, or software.

Sensors and analytics that detect unauthorized entry or movement and alert responders, complementing access control and barriers.

A physical obstacle such as a fence, wall, or bollard that defines a property line and delays or deters unauthorized entry.

Procedures for registering, badging, escorting, and tracking non-employees on site so their presence is authorized and accountable.

Accountability procedures for issuing, tracking, replacing, and recovering physical keys or credentials to prevent unauthorized duplication or use.

The three core information security objectives: confidentiality (only authorized access), integrity (accuracy and completeness), and availability (reliable access when needed).

The principle of granting users only the access rights necessary to perform their duties, limiting damage from error or misuse.

Categorizing information by sensitivity and value so appropriate handling, storage, and access controls can be applied consistently.

Manipulating people into revealing information or granting access by exploiting trust, urgency, or authority rather than technical vulnerabilities.

Documented procedures to keep critical business functions operating during and after a disruption, including alternate sites, resources, and communication.

The maximum acceptable time to restore a business process or system after disruption, used to prioritize recovery efforts and resources.

A discussion-based drill in which participants walk through a simulated crisis to test plans, roles, and decision-making without deploying real resources.

Preplanned messaging to employees, customers, media, and authorities during an emergency, designed to inform accurately and protect reputation.

A designated facility and team that coordinates information, resources, and decisions during a major incident or crisis.