SST (Other exams) cheat sheet

CCTV resolution: 1080p = 1920x1080 pixels; 4K = 3840x2160; Pixels Per Foot (PPF) at target determines identification (≥125 PPF), recognition (≥62 PPF), observation (≥25 PPF), detection (≥10 PPF).

Lens focal length formula: F = (D × W) / C, where D = distance to object, W = sensor width, C = object width to fill frame.

PoE standards: 802.3af = 15.4 W at PSE (12.95 W at PD); 802.3at (PoE+) = 30 W at PSE (25.5 W at PD); 802.3bt Type 3 = 60 W; Type 4 = 90 W.

Access control reader technologies: 125 kHz proximity (low security, cloneable), 13.56 MHz smart card (MIFARE DESFire EV2/EV3 with AES), 2.4 GHz BLE, and 13.56 MHz NFC for mobile credentials.

Intrusion detection sensor types: PIR (passive infrared, detects heat movement), dual-technology (PIR + microwave, both must trip), photoelectric beam (perimeter), vibration/shock (fence), and glass-break (acoustic).

Fire detection: ionization smoke detectors respond faster to flaming fires; photoelectric respond faster to smoldering fires; rate-of-rise heat detectors trigger at ~15°F/min rise; fixed-temperature at 135–194°F.

Video analytics categories: motion detection, loitering, line crossing, intrusion, object left/removed, facial recognition, license plate recognition (LPR), and people/vehicle counting.

Network fundamentals for security devices: VLAN segmentation isolates cameras from corporate LAN; 802.1X port authentication; TLS 1.2/1.3 for encrypted video; ONVIF Profile S for streaming, Profile T for advanced analytics, Profile G for edge recording.

UL 681 and UL 1076 govern installation and performance of commercial intrusion detection systems; UL 294 covers access control system units; UL 639 covers intrusion detectors.

Defense in depth layers: perimeter (fence, bollards, lighting), building envelope (doors, windows, walls), interior (zones, locked doors), and asset (safes, cabinets, cages).

Door hardware: fail-safe (unlocks on power loss, used for egress/life safety) vs. fail-secure (locks on power loss, used for high-security assets); electric strike vs. maglock vs. electric latch retraction.

Request-to-exit (REX) devices: passive infrared (PIR) motion, push-button, and exit devices; required by NFPA 101 for free egress; must release lock within 15 seconds (or immediately for fire alarm).

Access control decision logic: card + PIN = two-factor authentication; anti-passback prevents credential sharing; interlock (mantrap) prevents tailgating by requiring door 1 closed before door 2 opens.

Wiegand interface: 26-bit format = 8-bit facility code + 16-bit card number + 2 parity bits; 34-bit and 37-bit formats support larger card populations; OSDP (Open Supervised Device Protocol) is the modern bidirectional encrypted replacement.

Perimeter barriers: bollards rated by ASTM F2656 (M30, M40, M50) and K-rating (K4, K8, K12) for vehicle impact; anti-ram fences per ASTM F2787; crash-rated gates per ASTM F2656.

Lighting for CCTV: illuminance measured in lux; color temperature in Kelvin; IR illuminators (850 nm covert with faint red glow, 940 nm covert); minimum 0.5 fc (5 lux) for facial identification.

Lock types: cylindrical (Schlage, Kwikset), mortise (high security), rim (surface mount), and deadbolt; ANSI/BHMA Grade 1, 2, 3 (Grade 1 highest cycle and strength rating).

Turnstile types: optical (fast, moderate security), tripod (waist-high, anti-tailgate), full-height (high security, slow throughput); throughput: optical ~30–60/min, tripod ~20–30/min, full-height ~10–15/min.

Incident response phases (NIST SP 800-61): Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Chain of custody: document every transfer of evidence with date, time, person, and purpose; use tamper-evident bags; maintain original media unaltered; hash video exports (SHA-256) to prove integrity.

Video evidence export: native format from VMS preferred; include player software; export with time/date stamp and camera ID; retain original DVR/NVR drive if possible.

Alarm response priorities: life safety (fire, panic) > intrusion (verified) > environmental (water, temperature) > equipment fault; verified alarms reduce false dispatch.

False alarm reduction: video verification, dual-technology sensors, alarm confirmation (two trips within window), and CP-01 control panel standard (SIA CP-01) for reduced false alarms.

SOC metrics: Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alarm-to-dispatch ratio, false alarm rate (target <1 per system per year per SIA), and incident closure rate.

Incident report elements: who, what, when, where, why, how; persons involved; witnesses; actions taken; evidence collected; notifications made; follow-up required.

Emergency operations center (EOC) activation levels: Level 1 (full activation, 24/7), Level 2 (partial, extended hours), Level 3 (monitoring, on-call); ICS structure: Incident Commander, Operations, Planning, Logistics, Finance/Admin.

Guard tour systems: checkpoint (RFID, NFC, QR) verification; tour reports document time-stamped presence; exception reporting flags missed checkpoints.

Risk formula: Risk = Threat × Vulnerability × Consequence (or Risk = Likelihood × Impact); controls reduce vulnerability or consequence, not threat.

Risk assessment methodologies: qualitative (delphi, scenario-based), semi-quantitative (risk matrix 5x5), quantitative (ALE = SLE × ARO; SLE = asset value × exposure factor).

Threat categories: natural (flood, earthquake), accidental (fire, human error), and intentional (theft, vandalism, terrorism, cyber).

Vulnerability assessment outputs: asset inventory, threat listing, existing control inventory, gap analysis, and prioritized recommendations (high/medium/low).

Loss prevention controls: deterrence (signage, lighting), detection (alarms, CCTV), delay (locks, barriers), response (guards, police); layered to increase adversary time and risk.

Crime Prevention Through Environmental Design (CPTED) principles: natural surveillance, natural access control, territorial reinforcement, maintenance, and activity support.

Business impact analysis (BIA): identify critical functions, Recovery Time Objective (RTO), Recovery Point Objective (RPO), Maximum Tolerable Downtime (MTD); drives continuity planning.

Security survey steps: pre-survey planning, physical inspection, interviews, records review, analysis, report, and follow-up; use standardized checklists (e.g., ASIS, ISO 31000).

Insurance and risk financing: risk avoidance, risk reduction, risk transfer (insurance), and risk retention; residual risk is accepted after controls applied.

Integration protocols: ONVIF (video), OSDP (access control), BACnet (building automation), Modbus (industrial), SNMP (network monitoring), MQTT (IoT messaging), REST API (software integration).

Preventive maintenance schedules: CCTV cameras cleaned and focused quarterly; DVR/NVR firmware and health checked monthly; access control readers and locks inspected quarterly; batteries tested annually; fire panels per NFPA 72 (annual test, quarterly inspection).

Network bandwidth calculation for video: bandwidth (Mbps) = bitrate (Mbps) × number of cameras; storage (TB) = bitrate (Mbps) × 86,400 × retention days × cameras ÷ 8 ÷ 1,000,000 (approx).

RAID levels: RAID 0 (striping, no redundancy), RAID 1 (mirroring), RAID 5 (striping + parity, tolerates one drive failure), RAID 6 (double parity, tolerates two failures), RAID 10 (mirror + stripe).

UPS sizing: load (W) × runtime (h) ÷ inverter efficiency (typically 0.85–0.9) = battery watt-hours; add 20–25% headroom; test batteries under load annually.

System commissioning: as-built drawings, IP schedule, credential database backup, firmware baseline, acceptance testing (functional, performance, failover), and training sign-off.

Cybersecurity hardening for security devices: change default passwords, disable unused services, segment on VLAN, apply firmware updates, enable TLS/HTTPS, use unique credentials, and monitor logs.

Change management: document all changes (firmware, configuration, hardware) with rollback plan; test in staging before production; maintain version control for VMS/ACS software.

Troubleshooting sequence: verify power, check network link, confirm IP/credentials, review logs, isolate component (swap test), and document resolution.

NFPA 101 (Life Safety Code): egress doors must be openable without keys or special knowledge; delayed egress permitted 15 or 30 seconds with automatic release on fire alarm; access-controlled egress per NFPA 101 §7.2.1.6.2.

NFPA 72 (National Fire Alarm and Signaling Code): inspection, testing, and maintenance (ITM) frequencies; smoke detector sensitivity testing within 1 year of installation and every alternate year thereafter; annual test of all devices.

ADA and ABA Accessibility Standards: accessible route, door opening force ≤5 lbf interior (≤8.5 lbf exterior), clear width 32 inches minimum, hardware operable with one hand without tight grasping, reaching, or twisting.

OSHA 29 CFR 1910.36–.39: exit routes, employee alarm systems, and emergency action plans; 1910.38 requires written EAP for employers with 10+ employees.

Privacy and video surveillance: GDPR (EU) requires lawful basis, data minimization, retention limits, and signage; US state laws (e.g., California, Illinois BIPA for biometrics) govern facial recognition and biometric data.

Ethics: ASIS International Code of Ethics requires honesty, confidentiality, conflict-of-interest disclosure, and compliance with law; avoid unauthorized access to information; report violations.

Licensing: many jurisdictions require security guard, alarm contractor, locksmith, and private investigator licenses; verify jurisdiction-specific requirements; maintain continuing education.

Records retention: incident reports typically 3–7 years depending on jurisdiction and insurer; video retention per policy (commonly 30–90 days) and legal hold for incidents; privacy laws may cap retention.

Standards organizations: ISO 31000 (risk management), ISO 27001 (information security), ASIS (security management), SIA (alarm standards), UL (product safety), NFPA (fire and life safety), ANSI/BHMA (door hardware).