PSP cheat sheet

Security risk is commonly estimated as R = T × V × C, where T is threat, V is vulnerability, and C is consequence in a qualitative model.

Asset inventory identifies people, information, equipment, facilities, and processes, then records criticality, location, owner, and replacement or recovery cost.

The design basis threat (DBT) defines the adversary capabilities, intent, tactics, and weapons that the protection system must counter.

A threat is a potential cause of loss; a vulnerability is a weakness that can be exploited; consequence is the impact if exploitation succeeds.

The CARVER matrix scores Criticality, Accessibility, Recoverability, Vulnerability, Effect, and Recognizability to prioritize assets.

CPTED principles include natural surveillance, natural access control, territorial reinforcement, maintenance, and activity support.

A security survey documents existing conditions such as perimeter, lighting, access points, alarms, CCTV, staffing, and procedures.

Gap analysis compares protection required by the DBT with existing controls, then identifies deficiencies and mitigation options.

Assessment outputs include prioritized risks, recommended countermeasures, residual risk, and the authority who accepts that residual risk.

Layered defense places independent barriers and detection zones from the perimeter to the asset, so defeating one layer does not immediately expose the target.

Effective interdiction requires response time plus detection and assessment time to be less than the delay provided by physical barriers.

Perimeter intrusion detection options include fence-mounted sensors, buried cable, microwave, infrared beams, and video analytics.

Lighting should provide required illuminance at critical areas, maintain uniformity, and avoid glare that impairs guards or cameras.

Access control performs identity verification, credential validation, authorization, entry or exit control, and audit logging.

Biometric performance is a tradeoff between false accept rate and false reject rate; the chosen threshold sets the operating point.

Camera selection depends on purpose: detection, recognition, identification, or monitoring, each requiring different pixel density on target.

Alarm systems comprise sensors, control panel, notification, and assessment; alarm floods can overwhelm responder capacity.

Vehicle barriers are selected by crash rating, vehicle class, speed, and penetration, and must match the assessed vehicle threat.

Implementation sequence: requirements, design, procurement, installation, integration, testing, training, acceptance, then operations and maintenance.

Commissioning verifies that installed systems meet design intent; acceptance tests document performance before formal handover.

A factory acceptance test (FAT) occurs at the manufacturer's facility before shipment; a site acceptance test (SAT) occurs after installation.

Physical security devices on networks require segmentation, patching, least privilege, and monitoring because compromise can disable protection.

Critical head-end equipment should use UPS power, with runtime calculated from connected load and required outage duration.

Structured cabling controls include conduit fill, bend radius, separation from power, labeling, and updated as-built records.

Change management reviews and documents changes to drawings, configurations, firmware, and procedures to prevent protection gaps.

Commissioning includes operator and administrator training plus standard operating procedures and emergency procedures.

The project schedule critical path includes long-lead equipment, network dependencies, utility work, and inspection or permitting milestones.

RFI gathers market information; RFP requests a proposed solution; RFQ requests pricing for a defined requirement.

A statement of work defines scope, deliverables, schedule, acceptance criteria, responsibilities, assumptions, and exclusions.

Performance specifications state measurable outcomes and allow vendor innovation; prescriptive specifications define products or methods.

Evaluation uses mandatory versus desirable criteria and weighted scoring; best value is not necessarily the lowest price.

Total cost of ownership includes acquisition, installation, licensing, maintenance, training, consumables, upgrades, replacement, and disposal.

Firm-fixed-price suits well-defined scope; time-and-materials suits uncertain duration; cost-reimbursable suits high uncertainty.

Vendor qualification reviews licenses, insurance, bonding, financial stability, past performance, references, and certifications.

Service level agreements define uptime, response and repair times, reporting, escalation, remedies, and responsibilities.

Acceptance terms address punch lists, substantial completion, final acceptance, warranty start, retainage, and spare parts.