PSAC common mistakes
PSAC · Understand the traps and how to avoid them.
When asked to assess a facility, the candidate jumps directly to recommending cameras, fences, and guards without first establishing a written threat statement and asset inventory, so recommendations are disconnected from identified risks.
Candidates treat the assessment as a hardware-selection exercise because equipment is concrete and easy to discuss, while the analytic front end (assets, threats, consequences) feels abstract and is often rushed under time pressure.
What to do instead
Adopt a fixed sequence for every scenario answer: identify and prioritize assets, state credible threats and likelihood, estimate consequences, then derive countermeasures that map to each threat. Practise writing a one-paragraph threat statement before listing any controls, and check that every recommendation traces back to a named threat.
The candidate confuses physical security layers and applies controls at the wrong perimeter, for example placing the primary screening checkpoint outside the CCTV coverage zone or treating a parking lot as a controlled area without defining the boundary.
Layered defence (perimeter, building envelope, interior, high-security area) is learned as a list rather than as a spatial model, so candidates cannot reason about where detection, delay, and response should occur relative to each other.
What to do instead
Draw the concentric layers for each practice scenario and place every control on the diagram. Verify the detect-delay-respond sequence holds at each boundary: intrusion must be detected before the adversary reaches the asset, and response must arrive within the delay time. Answer questions by naming the layer explicitly.
On access control questions, the candidate selects a technology (card reader, biometric, PIN) without matching it to the required assurance level, user population, or environmental conditions, and ignores anti-passback, tailgating, or fail-safe versus fail-secure behaviour.
Candidates memorise device names and features but not the decision criteria, and they overlook operational edge cases such as egress during a fire alarm or piggybacking at a mantrap.
What to do instead
For every access control question, state the asset sensitivity, population size, throughput, and life-safety requirement before choosing a technology. Explicitly address fail-safe versus fail-secure, anti-passback, and tailgating mitigation. Remember that life-safety egress overrides locking, and say so when relevant.
The candidate treats intrusion detection as interchangeable with surveillance, proposing cameras as a detection layer and ignoring alarm assessment, nuisance-alarm rates, and the response force needed to act on an alarm.
CCTV and intrusion alarms are both 'security electronics', so candidates merge them, missing that detection must be verified and acted upon, and that an alarm nobody responds to provides no protection.
What to do instead
Separate the functions clearly: intrusion sensors detect, cameras assess and provide evidence, and a response force intervenes. In answers, specify the sensor type appropriate to the environment (perimeter, volumetric, glass-break), the alarm assessment method, the expected nuisance-alarm rate, and the response time and authority.
When specifying CCTV, the candidate focuses on camera count and megapixels while omitting the operational requirement that drives the design: identification versus recognition versus detection, lighting, field of view, retention period, and privacy or data-protection constraints.
Marketing specifications emphasise resolution, and candidates lack practice translating a security outcome (for example, identifying a face at a gate) into pixel density, scene geometry, and storage calculations.
What to do instead
Start each surveillance answer from the task (detect, recognise, identify, or monitor) and derive the required pixel density, camera placement, lighting, and retention. Mention storage and bandwidth implications and any legal limits on coverage of public or private space. Tie the design back to the surveillance objective rather than to hardware counts.
The candidate describes monitoring as a passive activity, omitting operator procedures, alarm triage, escalation paths, video verification, and performance metrics such as false-alarm handling and response times.
Monitoring is often studied as technology rather than as a human process, so candidates forget that the control room is a socio-technical system with staffing, fatigue, and procedure requirements.
What to do instead
For every monitoring question, describe the operator workflow: what triggers an alert, how it is verified, who is notified, within what time, and how the outcome is recorded. Include staffing and fatigue considerations and at least one performance metric. Treat the control room as a process with defined inputs, decisions, and escalation.
The candidate performs a qualitative risk rating without defining likelihood and consequence scales, then presents the result as objective, and fails to distinguish risk assessment from risk treatment or to record residual risk after controls.
Risk matrices look simple, so candidates skip the calibration step and treat a colour on a heat map as a finding, which produces ratings that cannot be defended or compared.
What to do instead
Define the likelihood and consequence criteria before rating anything, apply them consistently, and state the resulting risk level with its basis. Then name the treatment option (avoid, reduce, transfer, accept), the control applied, and the residual risk. Distinguish inherent from residual risk explicitly in the answer.
The candidate conflates threat, vulnerability, and risk, or analyses only external attackers and omits insider threat, and does not link threat analysis to the intelligence cycle or to the organisation's own incident history.
The terms are used loosely in everyday security language, and candidates default to a burglary or terrorism narrative because it is vivid, neglecting fraud, workplace violence, and supply-chain exposure.
What to do instead
Use strict definitions: a threat is a potential cause of harm, a vulnerability is a weakness that can be exploited, and risk combines threat, vulnerability, and consequence. For each scenario, list at least one insider and one external threat, cite the intelligence or incident data that would inform the estimate, and state your assumptions.
In emergency response questions, the candidate lists response actions but omits the planning cycle: hazard identification, capability and gap analysis, plan development, training, exercising, and after-action review, and does not define command roles or interfaces with external agencies.
Candidates focus on the dramatic moment of response and treat planning documents as paperwork, so they miss that plans must be validated by exercises and revised from lessons learned.
What to do instead
Structure every emergency answer around the full cycle: identify hazards, assess capability, write the plan, train, exercise, evaluate, and update. Name the incident command roles, the decision authority for evacuation or shelter-in-place, and the liaison arrangements with police, fire, and medical services. Close with the after-action review and corrective action tracking.
When writing or evaluating policies, the candidate produces generic statements ('the organisation shall maintain adequate security') without measurable requirements, ownership, or review cycles, and does not distinguish policy, standard, procedure, and guideline.
Candidates imitate the vague language they have seen in real documents and are not practised at converting an intent into an auditable requirement with an accountable owner.
What to do instead
For every policy answer, specify the document tier (policy, standard, procedure, guideline), the accountable owner, the measurable requirement, the review frequency, and the evidence that would demonstrate compliance. Rewrite any vague clause into a testable statement before finalising the answer, and check that it aligns with a recognised standard or regulatory obligation where relevant.