CPP (PayrollOrg Certifications) cheat sheet

Risk = threat likelihood × vulnerability × consequence; controls reduce likelihood, vulnerability, or impact.

Risk treatment options are avoid, reduce, transfer, and accept; selection compares control cost with residual risk.

A security program links policy, risk assessment, controls, training, monitoring, testing, and continual improvement.

Deterrence works only when the adversary perceives the control as credible and likely to detect or delay action.

Defense in depth layers physical, procedural, and technical controls so one failure does not expose the asset.

CPTED principles are natural surveillance, natural access control, territorial reinforcement, and maintenance.

Security data collection follows proportionality: collect only what is necessary and document retention limits.

An incident severity matrix escalates when likelihood or impact exceeds a defined organizational threshold.

ROI = (benefit − cost) ÷ cost; it is usually expressed as a percentage for comparing security investments.

A control is cost-justified when expected annual loss reduction exceeds its annualized total cost.

A business impact analysis identifies critical functions, dependencies, maximum tolerable downtime, RTO, and RPO.

Capital budgets cover one-time assets such as cameras; operating budgets cover recurring expenses such as guard services.

KPIs measure security performance, while KRIs measure risk trends; both require a baseline and a target.

Total cost of ownership includes acquisition, installation, operation, maintenance, training, and retirement.

A business case states the problem, options, costs, benefits, risks, and a recommended course of action.

Fixed-price contracts shift cost risk to the vendor; time-and-materials contracts shift cost risk to the buyer.

Chain of custody records who handled evidence, when, where, and why for every transfer.

Evidence admissibility depends on relevance, authenticity, integrity, and lawful collection methods.

Locard exchange principle: every contact leaves a trace, so collection protects both deposited and removed material.

Interviews gather information from cooperative subjects; interrogations seek admissions from suspects under legal constraints.

Workplace investigation sequence: intake, scope, preserve evidence, interview, analyze, report, and corrective action.

Attorney-client privilege protects legal advice communications, not every internal investigation file automatically.

Surveillance must be lawful, proportionate, and authorized, with dates, times, locations, and observers recorded.

Investigative reports separate fact from opinion and document who, what, when, where, how, and evidence references.

Screening scope must be job-related, consistently applied, documented, and compliant with applicable law.

Background checks commonly verify identity, employment, education, criminal record, references, and licenses.

Insider threat controls include least privilege, separation of duties, monitoring, reporting channels, and exit procedures.

Need-to-know governs access; a clearance level alone does not authorize access to all protected information.

Onboarding includes policy acknowledgment, awareness training, approved access requests, and asset issuance.

Offboarding requires prompt access revocation, asset recovery, badge and key collection, exit interview, and record updates.

Personnel risk indicators include unexplained affluence, policy violations, disgruntlement, and unusual access patterns.

Awareness training content and frequency should match role risk and be evaluated through assessment results.

Physical layers progress from property perimeter to building envelope, interior zones, and asset enclosure.

An access control point verifies identity, checks authorization, records entry, and controls passage.

Fail-safe locks unlock on power loss for life safety egress; fail-secure locks remain locked to protect assets.

Lighting supports deterrence and detection; uniformity and glare control matter more than raw brightness.

CCTV coverage is based on scene requirements, with defined retention periods and privacy rules.

Intrusion sensors include contact, motion, glass-break, and vibration types, each with distinct false-alarm drivers.

Guard deployment follows risk assessment, post orders, patrol routes, and required response time.

Key control includes issue logs, authorization, duplication control, recovery, and rekeying after loss.

The CIA triad is confidentiality, integrity, and availability.

Access control models include discretionary, mandatory, role-based, and attribute-based; selection depends on policy and scale.

Least privilege and separation of duties reduce insider misuse and accidental damage.

Multi-factor authentication requires two or more independent factor types: knowledge, possession, or inherence.

Data classification drives access, storage, transmission, retention, and disposal requirements.

Encryption protects data at rest and in transit, but key management determines its practical strength.

The 3-2-1 backup rule means three copies, on two media types, with one copy offsite.

Incident response phases are preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

The crisis lifecycle comprises prevention and mitigation, preparedness, response, and recovery.

Crisis team roles typically include incident commander, operations, communications, logistics, liaison, and finance.

The emergency operations center is a designated facility with communications and decision-support capability.

Business continuity focuses on business functions; disaster recovery focuses on technology; crisis management coordinates both.

RTO is the maximum acceptable restoration time; RPO is the maximum acceptable data loss measured in time.

Tabletop exercises test plans, roles, and decisions without deploying operational resources.

Crisis communication plans define spokespersons, channels, templates, and message approval procedures.

An after-action review documents strengths, gaps, corrective actions, owners, and completion deadlines.