CPP (ASIS) study guide
CPP · Work through your exam, one topic at a time.
The Certified Protection Professional (CPP®) is a security management credential offered by ASIS International, a global community of 34,000+ security professionals that has brought together practitioners from the public and private sectors since 1955. ASIS lists the CPP alongside its APP®, PCI® and PSP® certifications as a way to show your expertise - it is aimed at experienced practitioners who already carry management responsibility and want independent validation of their judgement rather than an entry-level badge. The CPP study guide has 7 sections and about 2,142 words.
01Security Fundamentals
Everything in a security program traces back to risk. Treat risk as a function of threat (who or what can cause harm), vulnerability (a weakness the threat can exploit), and consequence (impact if it happens).
296 words, about 1 min02Business Principles and Practices
Security competes for the same money as every other department, so justify proposals in business language: cost, benefit, risk reduction, and time to value. Understand the organization's mission, structure, and financial cycle.
309 words, about 2 min03Investigations
Private-sector investigators are not police. You have no arrest power and no right to search a person or a locked desk without consent or a policy that clearly authorizes it.
320 words, about 2 min04Personnel Security
Personnel security runs from before hire to after departure: screening, onboarding, authorization, monitoring, and offboarding. Screening must be job-related and consistently applied.
303 words, about 2 min05Physical Security
Physical security is built in layers that deter, detect, delay, and respond. The outer layer (perimeter, lighting, signage, landscaping) deters; the building envelope (doors, locks, glazing) delays; interior controls (access control, intrusion detection, CCTV) detect and restrict; response (officers, alarms, police) completes the cycle.
303 words, about 2 min06Information Security
Information security protects confidentiality (only authorized disclosure), integrity (accuracy and completeness), and availability (access when needed). Classify data (for example public, internal, confidential, restricted) and let handling rules follow the label.
301 words, about 2 min07Crisis Management
An emergency is a localized event handled by first responders; a crisis threatens the organization's viability, reputation, or stakeholders and demands executive direction; a disaster overwhelms local resources. Business continuity planning (BCP) keeps critical functions running; continuity of operations (COOP) is the government-oriented analogue; disaster recovery (DR) restores IT systems.
310 words, about 2 min