PSAC cheat sheet

The security survey sequence: identify assets, identify threats, assess vulnerabilities, determine risk, recommend countermeasures, and document findings.

Qualitative risk rating formula: Risk = Threat × Vulnerability × Consequence, each scored on a defined scale (e.g., 1–5); higher products indicate higher priority.

The layers of protection principle (defense in depth): perimeter, building exterior, interior spaces, and asset-specific controls; each layer must be breached for an adversary to reach the asset.

Crime Prevention Through Environmental Design (CPTED) four principles: natural surveillance, natural access control, territorial reinforcement, and maintenance.

The 3-2-1 rule for security drawings: at least three independent barriers, two detection layers, and one response capability between the perimeter and the critical asset.

Site plan review checklist: setback distances, lighting levels (minimum 2 fc at entrances, 0.5 fc in parking), clear zones, and emergency vehicle access.

Security assessment report must include an executive summary, methodology, findings with risk ratings, prioritized recommendations, and a corrective action plan with owners and due dates.

Threat and vulnerability gap analysis compares existing controls against a recognized standard (e.g., ASIS, ISO 31000, NFPA 730) to identify residual risk.

Access control decision factors: something you know (PIN), something you have (card/token), something you are (biometric), and something you do (behavior); two-factor authentication requires two different categories.

Card technologies ranked by cloning resistance: 125 kHz proximity (lowest) < 13.56 MHz MIFARE Classic < MIFARE DESFire EV2/EV3 < smart card with PKI (highest).

Anti-passback prevents a credential from being used to enter twice without an intervening exit; types include hard (denies entry), soft (logs only), and timed (resets after a period).

Door held-open alarm time is typically 15–30 seconds; forced-door alarm triggers when a door opens without a valid credential.

Request-to-exit (REX) devices: passive infrared (PIR), push button, or exit loop; a REX bypasses the access control reader for egress.

Intrusion detection sensor selection: PIR for body heat and movement; dual-technology (PIR + microwave) reduces false alarms; glass-break detectors for perimeter windows; vibration sensors for walls/safes.

Alarm zones should be sized so that a single zone covers no more than one room or one identifiable area, enabling responders to locate the alarm quickly.

Fail-safe vs. fail-secure: fail-safe locks unlock on power loss (life safety egress); fail-secure locks remain locked on power loss (asset protection); code requires fail-safe on egress doors.

Camera coverage calculation: pixel density (PPF) = horizontal pixels ÷ field of view width in feet; 40 PPF for identification, 80 PPF for recognition, 20 PPF for detection.

Camera types by function: fixed for choke points, PTZ for wide-area patrol, panoramic for open areas, and thermal for low-light or perimeter detection.

Storage calculation: gigabytes per day = (bitrate in Mbps × 86,400 seconds) ÷ (8 × 1,024); multiply by retention days and number of cameras.

Video management system (VMS) health checks: camera online status, recording continuity, time synchronization (NTP), and storage retention compliance.

Monitoring center ergonomics: video wall viewing distance should be 4–6 times the screen height; operators should not view more than 16 cameras per monitor simultaneously.

Chain of custody for video evidence: export with hash value, log export time, operator, and case number; store in write-once media.

Privacy and legal compliance: avoid viewing private areas; post notice of surveillance; retain footage only as long as necessary per policy.

Alarm resolution workflow: detect, verify (video or secondary sensor), classify, dispatch, and document.

Risk = likelihood × impact; risk treatment options: avoid, reduce, transfer (insurance), and accept.

Threat assessment models: CARVER (Criticality, Accessibility, Recoverability, Vulnerability, Effect, Recognizability) for asset targeting; SWOT for strategic analysis.

The risk matrix: plot likelihood (1–5) against impact (1–5); scores 1–4 low, 5–9 medium, 10–16 high, 17–25 critical.

Business impact analysis (BIA) identifies critical functions, recovery time objectives (RTO), and recovery point objectives (RPO).

Threat intelligence sources: open-source (OSINT), law enforcement bulletins, industry information sharing and analysis centers (ISACs), and internal incident data.

Residual risk = inherent risk − effectiveness of controls; document accepted residual risk with management sign-off.

Vulnerability assessment vs. risk assessment: vulnerability assessment identifies weaknesses; risk assessment quantifies the potential consequence and likelihood.

Key risk indicators (KRIs) are metrics that provide early warning of increasing risk exposure (e.g., alarm response time, access denial rate).

Incident command system (ICS) roles: Incident Commander, Operations, Planning, Logistics, and Finance/Administration.

Emergency action plan (EAP) elements: evacuation routes, assembly areas, accountability procedures, shelter-in-place, and communication methods.

Evacuation time estimate: total evacuation time = notification time + travel time + queuing time; drills should target completion within 3 minutes for high-hazard areas.

Incident report contents: who, what, when, where, why, how, actions taken, witnesses, and evidence collected.

Notification cascade: security operations center → incident commander → emergency services → corporate leadership → public information officer.

Drill evaluation criteria: alarm audibility, egress route clearance, assembly accountability within 10 minutes, and communication effectiveness.

After-action review (AAR) is conducted within 30 days of an incident or drill; it identifies strengths, areas for improvement, and corrective actions with owners.

Emergency communication redundancy: primary (radio), secondary (cellular), tertiary (satellite or hardwired) with regular testing.

Policy hierarchy: policy (management intent) → standard (mandatory requirements) → procedure (step-by-step tasks) → guideline (recommended practices).

Policy review cycle: annual review or upon significant change; version control with approval signatures and effective dates.

Access control policy must define authorization levels, provisioning/deprovisioning timelines (e.g., within 24 hours of termination), and periodic access reviews (quarterly).

Incident response policy includes reporting timelines (e.g., within 1 hour for critical incidents), investigation authority, and evidence preservation.

Regulatory drivers: GDPR (EU personal data), HIPAA (US health information), PCI DSS (payment card data), SOX (financial controls).

Security awareness training: initial upon hire, annual refresher, and role-based training for privileged users; completion tracked at 95% or higher.

Key performance indicators (KPIs) for security programs: number of incidents, response time, false alarm rate, training completion, and audit findings closed on time.

Document control: unique document ID, revision history, distribution list, and retention period per records retention schedule.