CPP (ASIS) study plan

Define and distinguish the core security concepts (confidentiality, integrity, availability, and the supporting concepts of identification, authentication, authorization, accountability)

Diagram the three states of information (at rest, in transit, in use) and list one control example for each state

Compare asset classification, ownership, and handling roles, and rank data by sensitivity

Summarize the legal and regulatory frameworks that drive security program requirements

Write 40 original recall questions covering security fundamentals and score yourself without notes

Explain how security programs are aligned to organizational mission, goals, and risk appetite

Describe the components of a business case, including cost-benefit analysis, ROI, and the role of a champion

Outline the project management lifecycle and identify where security requirements are inserted

Differentiate policies, standards, procedures, and guidelines, and draft one example of each

Re-test the Domain 1 questions missed in Week 1 until scored at 90% or higher

Sequence the phases of an investigation from initial notification through case closure and reporting

Classify evidence types (testimonial, documentary, physical, digital) and apply chain-of-custody handling rules to each

Identify the legal constraints on interviews, searches, and evidence collection that affect private-sector investigations

Describe the role of surveillance, audits, and forensic analysis in supporting findings

Draft investigation report sections that present findings without opinion or liability exposure

Map the employment lifecycle - recruiting, screening, onboarding, evaluation, termination, and post-employment - to the security controls at each stage

Apply pre-employment screening limits and privacy constraints to realistic hiring scenarios

Select physical controls (perimeter, interior, access control, lighting, CPTED principles) for a described facility

Evaluate intrusion detection, CCTV, and access control system capabilities against stated threats

Cross-check Domains 1 through 4 with a timed 50-question mixed set

Explain the systems development lifecycle and place security requirements at each phase

Compare symmetric and asymmetric cryptography, hashing, and digital signatures, and select the right tool for a stated need

List the components of network security architecture (segmentation, firewalls, IDS/IPS, VPN) and where each fits

Describe the components of an information security management program, including risk assessment, audit, and training

Classify common malware and attack vectors and match each to a mitigation

Distinguish crisis, disaster, emergency, and business continuity, and identify the team roles in each

Sequence the crisis management phases from notification through recovery and post-incident review

Draft a business impact analysis that ranks processes by recovery time and recovery point objectives

Compare business continuity and disaster recovery plans and identify what each must contain

Revisit Domain 3 investigation documentation and connect it to the post-incident review process

Diagnose weak domains from prior self-test results and rank them by missed-question count

Complete 150 mixed practice questions under timed conditions across two sessions

Write error log entries for every missed question, naming the underlying concept and the fix

Re-drill the two weakest domains until each reaches 85% accuracy on a fresh set

Complete two full-length timed mock exams under exam-day conditions

Review every flagged question and restate the governing principle in one sentence each

Recite the key definitions and process sequences for all seven domains from memory

Finalize a one-page exam-day strategy covering pacing, question triage, and guess rules