Prepare for the ASIS Associate Protection Professional exam by comparing your experience with its four official domains, then using the APP reference list to fill the gaps. Security Fundamentals is the largest domain, but Business Operations, Risk Management and Response Management also need attention. The example below gives you a short risk-ranking exercise to work through before checking the answer.
What the APP covers and who qualifies
The APP certifies knowledge of security fundamentals, business operations, risk management, and response management. Eligibility centers on compensated security experience, not a degree, and the designation cannot be held alongside the CPP.
Eligibility rests on experience. The standard route is one or more years of compensated security experience. If you already hold an approved, related certification, six months may qualify you. No higher education degree is required. Your experience must have been full time in a security or loss-prevention role or as a primary duty; it can come from protecting assets in the public or private sector, the criminal justice system, government intelligence, investigative agencies, security vendors or consultancies whose work substantively relates to asset protection, or full-time education in relevant knowledge areas. Current employment is not required.
All applicants must also have no felony conviction that would reflect negatively on the security profession, ASIS, or the certification program, sign the ASIS Certification Code of Professional Responsibility, and agree to the certification program policies. Foreign-language application documents need an English translation.
Certification combinations matter here. You cannot hold the APP and the CPP at the same time: the APP expires if you earn the CPP, and CPP holders are not permitted to sit the APP exam. People already certified as PCI or PSP may take the APP exam if they meet the program's requirements.
Sources: ASIS Board Certification Handbook, updated 4 August 2026 — APP board certification, eligibility, fees, testing options, scoring, and study guidance sections; Associate Protection Professional (APP) — ASIS International credential page — Eligibility requirements, exam contents, reference material, and study resources
Exam format, scoring, and results
Expect 100 scored questions plus up to 25 unscored pretest items in two hours, four answer options per question, and a scaled passing score of 650.
Each item offers four answers, with one correct choice. Use the on-screen timer to pace yourself and answer every question before submitting: unanswered items count as wrong, and the exam closes when time expires.
A scaled score is neither a percentage nor a count of correct answers. Do not convert the passing score into a required number of correct responses.
After you submit, a preliminary result is emailed through Prometric — allow up to five hours — and official score verification arrives from ASIS roughly three weeks later. Scoring is electronic, so computer-based multiple-choice exams are not eligible for a hand score.
Sources: ASIS Board Certification Handbook, updated 4 August 2026 — APP board certification, eligibility, fees, testing options, scoring, and study guidance sections; Associate Protection Professional (APP) — ASIS International credential page — Eligibility requirements, exam contents, reference material, and study resources
The four domains and where to focus
Use the official domain map to identify gaps in your experience and select the corresponding reference material.
The official body of knowledge lists the tasks and knowledge statements behind each domain, and every exam question relates to one of them. A practical first step is to read each domain and honestly assess your own experience against it. Weight your study time roughly in proportion to the percentages below, adjusting for the gaps you find.
One scope note from the body of knowledge itself: no country-specific laws appear on the APP exam, so focus on the general principles of records management, retention, and legal holds rather than any single jurisdiction's statutes.
| Domain | Weight | Focus areas |
|---|---|---|
| Security Fundamentals | 35% | Security programs, awareness training, investigations, workplace-violence protection, executive protection, physical security, technology and information security |
| Risk Management | 25% | Risk assessment, threat prioritization, risk communication, countermeasures, business continuity and COOP, pre-incident resource planning |
| Business Operations | 22% | Budgets and financial controls, policy implementation, productivity metrics, staffing and development, ethics and compliance, vendor contracts |
| Response Management | 18% | Incident command and EOCs, recovery, post-incident review, contingency plans, degraded-state countermeasures, stakeholder communication |
Choosing your study references
Use the official APP reference list, because ASIS sources every correct exam answer from those materials, and use the body of knowledge to find your weak domains before buying anything.
ASIS states that all correct exam answers are sourced from the official reference materials and relate to the exam's content domains, so these references are the right starting point. For the APP, the recommended set is five standards — Physical Asset Protection (ASIS PAP-2021), Security and Resilience in Organizations and their Supply Chains, Investigations, Workplace Violence Prevention and Intervention (ASIS WVPI AA-2020), and Security Risk Assessment (ASIS SRA-2024) — plus three Protection of Assets volumes covering security management, crisis management, and business principles. ASIS sells them individually and in two APP bundles, with member eBook access for standards marked as included on the official page. Check each product separately.
Because the exams are experience-based, ASIS advises applying your own experience rather than memorizing the reference sets. Read each domain in the body of knowledge first, make an honest assessment of where your experience is thin, and concentrate your study there. The ASIS Self-Assessment Guide can help you judge exam readiness and confirm the APP is the right exam for your background.
ASIS does not require any particular study method. Beyond the references, options include the APP Study Manual, flash cards, ASIS review courses, and study groups run by many ASIS Chapters. One honest caveat from ASIS itself: studying with official materials does not guarantee success on the exam, and preparation costs are separate from the application fee.
Sources: Associate Protection Professional (APP) — ASIS International credential page — Eligibility requirements, exam contents, reference material, and study resources; How should I study for the exam? — ASIS International (issuer FAQ) — Reference materials as the source of correct exam answers; ASIS Board Certification Handbook, updated 4 August 2026 — APP board certification, eligibility, fees, testing options, scoring, and study guidance sections
Worked example: rank risks under a stated scoring rule
Apply the organization's stated rule consistently, then separate the resulting ranking from a treatment decision.
The APP outline includes risk analysis and prioritization. This original arithmetic exercise uses a fictional scoring rule; it is not a required ASIS risk formula.
Practice exercise
A fictional distributor assigns each risk a likelihood and impact from 1 to 5. Its internal rule is priority score = likelihood × impact. Dock theft scores likelihood 4 and impact 2; tornado damage scores likelihood 2 and impact 5; laptop theft scores likelihood 3 and impact 1. Rank the risks by this rule. Does the calculation also tell you which treatment to select?
Show answer
Tornado damage: 2 × 5 = 10; dock theft: 4 × 2 = 8; laptop theft: 3 × 1 = 3. The ranking is tornado damage, dock theft, then laptop theft. The calculation does not select a treatment.
Sorting only by likelihood would put dock theft first, laptop theft second and tornado damage third. The stated product rule gives a different ranking because it also includes impact. No treatment costs, control effects or decision criteria are supplied, so the scores alone cannot establish that insurance, mitigation or another option is the best treatment.
Applying and arranging your exam
Apply online and allow approximately two to three weeks for review. Schedule after receiving your authorization-to-test email.
The application is completed online. Once it is reviewed and approved, you receive an authorization-to-test email with scheduling instructions, and ASIS asks you to allow approximately two to three weeks for review. Make sure the name on your application exactly matches your valid, government-issued photo ID, or you will not be admitted. You will need an unofficial transcript if applicable, a résumé or CV detailing security experience aligned to the exam domains, the name of a supervisor who can verify your employment, and names and contact details for three work-experience references.
Testing policy changed recently. From 1 September 2026, remote proctoring is no longer broadly available for ASIS certification exams except through an approved PCB Certificant Relations Committee accommodation. Candidates who believe they qualify follow ASIS's established accommodation request process and submit documentation; distance or geography alone is not sufficient justification. For approved accommodated candidates, the remote option carries additional technical requirements, and ASIS strongly recommends against using a company computer because of firewall restrictions.
On language, the CPP, PCI, PSP, and APP exams are administered in English and Spanish, with an English translation provided alongside the Spanish form. If English is not your primary language and you test in English, you may request 25% additional testing time. The request must be submitted and approved before you schedule your appointment, and you may use either the additional-time option or the Spanish-language form for a given appointment, but not both.
Check the current application fee for your membership and market category before paying; preparatory materials are priced separately.
Your preparation checklist
Start with your weakest domain, and keep a record of the reference passages that resolve each gap.
- Mark the tasks you can explain and those that need further reading in the official body of knowledge.
- Work through the corresponding APP references, then explain the concept using a concrete workplace example.
- Before applying, assemble your experience documents and references; arrange any necessary accommodation before scheduling.
Sources: ASIS Board Certification Handbook, updated 4 August 2026 — APP board certification, eligibility, fees, testing options, scoring, and study guidance sections; Associate Protection Professional (APP) Body of Knowledge — Domain One through Domain Four with task and knowledge statements and weights; Associate Protection Professional (APP) — ASIS International credential page — Eligibility requirements, exam contents, reference material, and study resources
Sources
Exam facts checked against official ASIS sources: