PSAC flashcards
PSAC · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CPTED
- Crime Prevention Through Environmental Design; a strategy using natural surveillance, natural access control, territorial reinforcement, and maintenance to reduce opportunities for crime.
- Risk formula
- Risk = Threat × Vulnerability × Consequence; each factor is scored on a defined scale, and the product prioritizes countermeasure investments.
- Layers of protection
- Defense in depth principle requiring an adversary to breach multiple independent barriers-perimeter, building exterior, interior, and asset-before reaching a critical asset.
- Security survey
- Systematic on-site evaluation that identifies assets, threats, vulnerabilities, and existing controls, then recommends prioritized countermeasures in a written report.
- Minimum lighting levels
- Recommended illuminance: at least 2 foot-candles at entrances and 0.5 foot-candles in parking areas, measured at ground level for safe surveillance.
- Three-factor authentication
- Access control requiring three different credential categories: something you know, something you have, and something you are (biometric).
- Anti-passback
- Access control rule preventing a credential from being used to enter twice without an intervening exit; types include hard, soft, and timed.
- Fail-safe lock
- Lock that unlocks automatically on power loss, allowing free egress; required by life safety codes on egress doors.
- Dual-technology sensor
- Intrusion detector combining PIR and microwave technologies; both must detect an event to trigger an alarm, reducing false alarms.
- Request-to-exit device
- Sensor or button (PIR, push button, exit loop) that bypasses the access reader to allow egress without triggering an alarm.
- Forced-door alarm
- Alarm triggered when a secured door opens without a valid credential or REX signal, indicating possible intrusion.
- Pixel density
- Camera resolution metric: horizontal pixels divided by field-of-view width in feet; 40 PPF for identification, 80 PPF for recognition, 20 PPF for detection.
- Video storage calculation
- Gigabytes per day = (bitrate in Mbps × 86,400) ÷ (8 × 1,024); multiply by retention days and camera count for total storage.
- PTZ camera
- Pan-tilt-zoom camera that can be remotely controlled to cover wide areas; useful for patrol but not continuous fixed coverage.
- Video evidence chain of custody
- Documented process for exporting video with hash value, export time, operator, and case number; stored on write-once media.
- VMS health check
- Routine verification of camera online status, recording continuity, time synchronization via NTP, and storage retention compliance.
- Thermal camera
- Surveillance camera detecting infrared radiation to identify heat signatures; effective in low-light and perimeter detection.
- Risk treatment options
- Four strategies for managing risk: avoid (eliminate activity), reduce (mitigate), transfer (insurance), and accept (acknowledge with sign-off).
- CARVER matrix
- Threat assessment tool scoring assets on Criticality, Accessibility, Recoverability, Vulnerability, Effect, and Recognizability to prioritize protection.
- Residual risk
- Risk remaining after controls are applied; calculated as inherent risk minus control effectiveness, documented with management acceptance.
- Business impact analysis
- Process identifying critical functions and their recovery time objectives (RTO) and recovery point objectives (RPO) to guide continuity planning.
- Risk matrix
- Grid plotting likelihood (1–5) against impact (1–5); scores 1–4 low, 5–9 medium, 10–16 high, 17–25 critical.
- Key risk indicator
- Metric providing early warning of increasing risk exposure, such as alarm response time or access denial rate.
- Incident Command System
- Standardized emergency management structure with roles: Incident Commander, Operations, Planning, Logistics, and Finance/Administration.
- Emergency action plan
- Document specifying evacuation routes, assembly areas, accountability procedures, shelter-in-place, and communication methods for emergencies.
- After-action review
- Structured debrief conducted within 30 days of an incident or drill to identify strengths, improvements, and corrective actions with owners.
- Notification cascade
- Ordered communication sequence: security operations center → incident commander → emergency services → leadership → public information officer.
- Assembly accountability
- Procedure to confirm all personnel are accounted for at the assembly area, typically within 10 minutes of evacuation.
- Policy hierarchy
- Document structure: policy (management intent) → standard (mandatory requirements) → procedure (step-by-step tasks) → guideline (recommended practices).
- Access deprovisioning timeline
- Policy requirement to revoke access credentials within a defined period (e.g., 24 hours) after termination or role change.
- Security awareness training
- Required training upon hire and annually, with role-based modules for privileged users; completion tracked at 95% or higher.
- Document control
- Version management practice assigning unique document IDs, revision history, distribution lists, and retention periods per records schedule.