Prepare for the CPP using its seven-domain outline and official reference list. Start with security and business principles, then connect them to physical, personnel and information protection, investigations and crisis management. The worked example below separates a threat, a vulnerability and an impact so you can explain the relationship rather than memorize the terms.
What the CPP exam covers and how it is scored
The CPP exam has 200 scored and 25 unscored multiple-choice questions with a four-hour limit, and knowledge across seven domains is tested. You need a scaled score of at least 650 to pass.
The Certified Protection Professional is ASIS International's security-management credential. Each exam question offers four choices with one correct answer.
Investigations and Crisis Management are separate domains. Use the current official map below to check that your preparation includes both.
ASIS exams use scaled scoring. A scaled score of at least 650 is required to pass, and it is neither the number of questions you answered correctly nor a percentage of correct answers. After you submit, preliminary results are emailed within up to five hours, and official verification arrives from ASIS roughly three weeks later. You can also retrieve your score report from Prometric using your confirmation number and last name.
| Domain | Share of exam questions |
|---|---|
| Security Principles and Practices | 22% |
| Business Principles and Practices | 15% |
| Investigations | 9% |
| Personnel Security | 11% |
| Physical Security | 16% |
| Information Security | 14% |
| Crisis Management | 13% |
Official sources: ASIS Board Certification Handbook, updated 4 August 2026 — CPP board certification, eligibility, exam format, scoring, and remote proctoring sections; CPP Body of Knowledge (certified-protection-professional-bok.pdf) — Domains One through Seven with task and knowledge statements; Certified Protection Professional (CPP) page, asisonline.org — Eligibility requirements, exam contents, and reference material sections
Eligibility routes and responsible charge
Every route combines security work experience with at least three years in responsible charge of a security function; the total years required depend on your highest degree, and holding the APP reduces each route by one year.
Responsible charge means you have the authority to make independent decisions and take independent actions to determine how a security-related project or process is run and to manage its execution. Supervising others is not required, and patrol-officer-type positions are generally excluded.
Experience counts when you are personally engaged in security or loss prevention full time or as a primary duty. That includes security work protecting assets in the public or private sector, criminal justice, government intelligence, or investigative agencies; work for firms whose duties substantively relate to designing or applying protection systems and services; and full-time educator roles whose duties relate primarily to protection-of-assets knowledge areas. Up to one year of directly relevant, full-time internship experience can count, and internships may be unpaid for the CPP. Current employment is not required.
All applicants must also attest they have not been convicted of a felony criminal offense that would reflect negatively on the security profession, ASIS, or the certification program, and must sign and agree to abide by the ASIS Certification Code of Professional Responsibility and the program policies in the handbook.
- No higher education degree: seven years of security experience (six if you already hold the APP)
- Bachelor's degree or international equivalent: six years (five with the APP)
- Master's degree or international equivalent: five years (four with the APP)
- All routes: at least three years in responsible charge of a security function
Official sources: ASIS Board Certification Handbook, updated 4 August 2026 — CPP board certification, eligibility, exam format, scoring, and remote proctoring sections; Certified Protection Professional (CPP) page, asisonline.org — Eligibility requirements, exam contents, and reference material sections
Applying, scheduling, and language options
Apply online, expect roughly two to three weeks for review, and schedule after you receive your authorization-to-test email. Since 1 September 2026, remote proctoring is available only through an approved accommodation.
The certification application is completed online. Prepare an unofficial transcript if you are claiming a degree, a resume detailing your security experience aligned to the exam domains, names and contact information for three references who can verify your work experience, and the name of a supervisor who can verify your employment. Foreign-language submissions need an English translation. Make sure the name on your application exactly matches your valid, government-issued photo ID; if it does not, you will not be permitted to test.
Effective 1 September 2026, remote proctoring is no longer broadly available for ASIS certification exams except through an approved Professional Certification Board Certificant Relations Committee accommodation. Distance or geography alone is not sufficient justification. If you believe you qualify, follow ASIS's established accommodation request process and submit the required documentation for review.
The CPP exam is administered in English and Spanish, and you choose the language during the online application; Spanish-language candidates receive a Spanish-speaking proctor and an English translation. If your primary language is not English and you are testing in English, you may request 25% additional testing time. The request must be submitted and approved before you schedule, and it must include your full name as shown in your ASIS record, your ASIS ID, your email address, the specific certification, an attestation that English is not your primary language, and the official request. You may choose either the additional-time option or the Spanish-language form, but not both for the same exam appointment. Current fee amounts by category appear in the Certification Handbook.
Official sources: ASIS Board Certification Handbook, updated 4 August 2026 — CPP board certification, eligibility, exam format, scoring, and remote proctoring sections; Certified Protection Professional (CPP) page, asisonline.org — Eligibility requirements, exam contents, and reference material sections
Connect security decisions with business needs
Study Security Principles and Business Principles together: the first includes risk assessment and protection programs, while the second includes budgets, contracts and organizational decisions.
The security principles domain supplies the framework itself: planning and control, quantitative and qualitative risk assessment, vulnerability, threat, and impact assessment, and cost-benefit judgment about countermeasures. Business principles add the justification side: budgeting, contracting, return on investment analysis, and the reason protection decisions must be defensible to management. When you later study a control in physical, personnel, or information security, ask which risk-analysis output justifies it and what business case supports spending on it. That habit keeps technical knowledge attached to decision logic instead of floating as isolated facts.
Official sources: CPP Body of Knowledge (certified-protection-professional-bok.pdf) — Domains One through Seven with task and knowledge statements
Worked example: distinguish a threat from a vulnerability
In the information-security context, a threat is a potentially harmful circumstance or event; a vulnerability is a weakness that can be exploited or triggered. Risk considers the likelihood and adverse impact of the event.
The CPP outline includes threat, vulnerability and impact assessment. The NIST definitions cited here explain these concepts for the information-security example below; they supplement the outline rather than replace the official CPP reference set.
Practice exercise
A fictional reporting system contains confidential client files. A security review has found a software flaw that would let an unauthenticated outsider read those files if exploited. No exploitation has been observed. Identify (1) a potential threat event, (2) the vulnerability, and (3) an adverse impact. Can the review alone establish that a breach has occurred or give a numerical risk score?
Show answer
A potential threat event is an outsider exploiting the flaw to read the files. The vulnerability is the software weakness allowing unauthorized access. An adverse impact would be disclosure of confidential client information. The review establishes neither an observed breach nor a numerical risk score.
The weakness exists in the stated system, while exploitation is a possible event. Disclosure describes the resulting harm if that event occurs. No exploitation has been observed, so a breach cannot be inferred from the weakness alone. A numerical risk estimate would also need a defined method and supporting likelihood and impact inputs; none are supplied.
Official sources: CPP Body of Knowledge (certified-protection-professional-bok.pdf) — Domains One through Seven with task and knowledge statements; threat - Glossary | CSRC — Definitions:; vulnerability - Glossary | CSRC — Definitions:; risk - Glossary | CSRC — Definitions:
Physical security: survey, select and assess
Cover all three physical-security tasks: facility surveys, selection and implementation of measures, and assessment of their effectiveness.
The outline includes survey techniques, plans and schematics, risk assessment and gap analysis. It then moves to system design, policies, technology and procedures, cost projections, bid evaluation and vendor selection. Testing, final acceptance and maintenance complete the domain.
As a study exercise, take a requirement from a worked case in the official references and explain how its proposed measure and acceptance test relate to that requirement. Avoid learning equipment names without the assessment and implementation context.
Official sources: CPP Body of Knowledge (certified-protection-professional-bok.pdf) — Domains One through Seven with task and knowledge statements
Personnel security across the employment lifecycle
Organizing personnel security by employment stage helps: background screening for hiring, promotion, and retention; protection policies for people in the workplace; and executive protection as its own program area. Place each control you study in its stage.
The personnel security domain tasks map to this lifecycle. Before hire and at promotion or retention points, the domain covers background investigation and personnel screening techniques, the quality and types of information sources such as open source, social media, government databases, and credit reports, screening policies, and the laws and regulations governing personnel screening.
During employment, the domain covers policies and procedures protecting individuals against human threats such as harassment, violence, and active assailant situations, including threat assessment, prevention, intervention, and response tactics, awareness program design, travel security, and organizational efforts to reduce employee substance abuse. Executive protection is a separate task covering techniques, threat analysis, liaison, and the selection, costs, and effectiveness of proprietary versus contract personnel.
Official sources: CPP Body of Knowledge (certified-protection-professional-bok.pdf) — Domains One through Seven with task and knowledge statements
Information security and its physical dependencies
The information security domain spans program surveys, policies protecting information against vulnerabilities and threats, and running an integrated program built on confidentiality, integrity, and availability. Many information rules are enforced through physical and personnel controls.
The domain's knowledge list runs from program elements and survey techniques through records management laws such as the GDPR, information security standards, authentication techniques including multi-factor and biometrics, encryption and data masking, ethical hacking and penetration testing awareness, and training against phishing, social engineering, ransomware, and insider threats. As you review, group these into the three tasks: survey the current state, develop policies and procedures, then implement and manage the integrated program.
Official sources: CPP Body of Knowledge (certified-protection-professional-bok.pdf) — Domains One through Seven with task and knowledge statements
Keep investigations and crisis management distinct
Prepare for the investigation program and its evidence requirements as well as incident planning, response and recovery.
Investigations includes operations, evidence collection and preservation, surveillance, specialized investigations, interviews and support to legal counsel. Crisis Management includes threat prioritization, preparation and planning, incident management, recovery and resumption of operations.
Use the relevant official references to learn the procedures and legal considerations behind these topics. The domain outline supplies a coverage checklist; it does not establish a universal order for emergency actions or imply that investigations can start only after stabilization.
Official sources: CPP Body of Knowledge (certified-protection-professional-bok.pdf) — Domains One through Seven with task and knowledge statements
Study sequence, references, and a coverage check
Use the official reference list to fill the gaps you identify in the seven-domain outline.
Start with the body of knowledge. Read each domain carefully, make an honest assessment of your own experience, and use the ASIS Self-Assessment to find where you need to concentrate. ASIS encourages candidates to use the CPP reference materials, including Protection of Assets and the associated standards and guidelines, and notes these are the same materials its item writers and reviewers use to reference correct answers. Because the exams are experience-based, ASIS advises applying your own experience rather than memorizing the reference sets. A practice exam containing retired items is available to familiarize yourself with how items appear, and many ASIS Chapters offer study groups. ASIS does not require any one study method and does not guarantee success from its preparatory materials.
One optional sequence is to study security and business principles together, then physical, personnel and information security, followed by investigations and crisis management. Adjust that order to your experience. Use mixed practice to find remaining gaps and revisit the relevant reference passages.
Official sources: ASIS Board Certification Handbook, updated 4 August 2026 — CPP board certification, eligibility, exam format, scoring, and remote proctoring sections; Certified Protection Professional (CPP) page, asisonline.org — Eligibility requirements, exam contents, and reference material sections; How should I study for the exam? – ASIS International (candidate FAQ) — Answer about reference materials and content domains
Official sources
Exam facts checked against official ASIS sources:
- ASIS Board Certification Handbook, updated 4 August 2026
- CPP Body of Knowledge (certified-protection-professional-bok.pdf)
- Certified Protection Professional (CPP) page, asisonline.org
- How should I study for the exam? – ASIS International (candidate FAQ)
- threat - Glossary | CSRC
- vulnerability - Glossary | CSRC
- risk - Glossary | CSRC