CPP (PayrollOrg Certifications) study plan

Map how security-program components (governance, risk assessment, policy, procedures, metrics) connect to one another into a single diagram

Differentiate security, safety, and loss-prevention concepts and produce one workplace example of each

Summarize the legal, regulatory, and ethical constraints that shape a security program's design

Apply a likelihood-by-impact risk method to a hypothetical site and rank five risks with justification

Explain how operating versus capital budgeting and ROI framing change the way a security request is evaluated

Calculate cost-benefit and payback figures for a proposed control and defend the conclusion in writing

Outline typical organizational structures and describe how security interfaces with HR, IT, legal, and facilities

Interpret the handful of financial-statement figures needed to build a credible business case

Sequence the phases of a workplace investigation from intake and scoping through evidence collection to final report

Decide when to handle a matter internally versus refer it to law enforcement, outside counsel, or a specialist

Describe evidence-handling and chain-of-custody standards well enough to write a compliant procedure

Explain interviewing approaches and the legal and policy limits that constrain them

Identify recurring investigative failure modes such as bias, scope creep, and thin documentation

Re-test ten Domain 1 and Domain 2 items from memory to keep the early material warm

Design a pre-employment screening program tiered to three different role-risk levels

Explain how onboarding, awareness training, and offboarding procedures reduce insider risk

Distinguish employee-assistance, disciplinary, and security-reporting channels and route a case through each

Summarize privacy and fairness limits on background checks, monitoring, and drug testing

Apply layered defense (perimeter, building envelope, interior, asset) to a specific site description

Compare access-control, intrusion-detection, and video-surveillance technologies by function, cost driver, and limitation

Perform a CPTED-style walkthrough assessment on a described property and record findings

Integrate physical controls with guard-force staffing levels, posts, and response procedures

Recall Domain 3 investigation fundamentals in a short self-quiz

Explain confidentiality, integrity, and availability and map specific controls to each

Distinguish information-classification tiers, handling rules, and retention/disposal requirements

Describe prevalent cyber threat categories and separate the security manager's responsibilities from IT's

Outline incident-response phases and specify where the security function contributes at each phase

Re-derive Domain 4 personnel-security screening logic from memory in a five-minute recall drill

Separate crisis management, emergency response, business continuity, and disaster recovery so each can be defined without notes

Structure an emergency-operations plan covering roles, decision authority, communications, and succession

Run a tabletop exercise and record gaps, owners, and corrective actions

Explain how to build, exercise, and maintain a business continuity plan

Recall Domain 5 physical-security layering in a rapid self-quiz

Integrate all seven domains by working cross-domain scenarios such as a theft investigation that touches personnel, physical, and information security

Diagnose the two weakest domains from practice results and re-study them with targeted review

Rehearse formulaic content (risk scoring, ROI, payback, screening decisions) from memory without notes

Practice pacing and question triage on a full-length timed set

Build a final week-of-exam review sheet limited to one page per domain