Comprehensive security and asset protection practice
Domain 2 - Comprehensive security and asset protection practice
This domain tests whether the CPO can protect people, property, information and reputation through a structured process rather than a list of gadgets. Expect questions on risk assessment, layered defence, access control, security surveys, investigations and emergency preparedness.
Core rules
- Identify assets and classify them by criticality, replaceability and sensitivity.
- Assess risk as a function of threat, vulnerability and consequence; document assumptions.
- Apply layered defence: deter, detect, delay and respond. No single control should carry the whole burden.
- Use CPTED where appropriate: natural surveillance, access control, territorial reinforcement and maintenance.
- Match controls to the asset. A server room needs access control, environmental monitoring and audit logs; a loading dock needs procedural and physical controls.
- Integrate human, physical and information security. Insider threat is a security problem, not only an HR problem.
- Investigate to establish facts, preserve evidence, maintain chain of custody and report without prejudice.
- Test emergency and business-continuity plans; an unexercised plan is an assumption.
Worked example
A warehouse loses copper fittings at night. A guard asks for more cameras. The CPO instead maps the loss by time, location, access route and persons on site. Findings: a propped fire door, no key control and scrap collected near an unmonitored exit. Controls: door alarm and hourly door checks, key register with sign-out, scrap cage with two-person removal, targeted CCTV at the exit, and a tip line. Reasoning: cameras alone would detect but not remove the vulnerability; the layered fix addresses access, custody and detection.
Traps
- Buying technology before assessing risk.
- Ignoring internal collusion.
- Treating a guard post as a complete security program.
- Weak evidence handling.
- Copying another site’s plan without a local security survey.