ASIS CPP Study Guide 2026: Cost, Domains & Pass Tips

Key Facts

The ASIS CPP exam has 225 questions (200 scored plus 25 unscored pretest) and a 4-hour time limit (ASIS International).
CPP candidates need at least 5 years of security experience, with 3 years in responsible charge of a security function (ASIS).
Without a degree, CPP eligibility requires 9 years of security experience; a bachelor's reduces it to 6 years (ASIS).
The CPP exam covers 7 domains: Security Principles, Business Principles, Investigations, Personnel Security, Physical Security, Information Security, and Crisis Management.
Security Principles and Practices is the largest CPP domain at 22%, followed by Physical Security at 16% (ASIS Body of Knowledge).
The 2026 CPP application fee is $580 for ASIS members and $910 for non-members, including a $160 non-refundable processing fee.
ASIS scores the CPP on a scaled basis, so no fixed percentage of correct answers guarantees a pass (ASIS Certification Handbook).
The CPP reference set is Protection of Assets plus seven ASIS standards and guidelines (CSO, ORM.1, SRA, WVPI.1, PAP, IAP, PBS).
CPP recertification requires 60 Continuing Professional Education (CPE) credits every 3 years (ASIS).
ASIS International represents more than 34,000 security professionals across 140-plus countries.

Complete ASIS CPP Certification Study Guide for 2026

The Certified Protection Professional (CPP) is the gold standard certification for security management professionals. Whether you're aiming to advance your career, increase your earning potential, or validate your expertise, this comprehensive guide will help you pass the CPP exam on your first attempt.

Ready to practice? Test your knowledge with our free CPP practice questions covering all seven domains, then drill PSP physical-security questions if you plan to stack both credentials.

What is the CPP Certification?

The CPP is ASIS International's premier security management certification. It demonstrates mastery of security management principles and practices across multiple disciplines.

Why Earn Your CPP?

Benefit Impact
Higher Salary CPP holders earn $130,000-$150,000 median
Career Advancement Required for senior security positions
Industry Recognition Globally respected credential
Professional Credibility Validates expertise to employers
Network Access Connect with 34,000+ ASIS members
Job Security Preferred for leadership roles

The CPP sits alongside three other ASIS credentials: APP (Associate Protection Professional, an entry-level management cert), PSP (Physical Security Professional), and PCI (Professional Certified Investigator). The CPP is the senior, broadest of the four. Holding an APP shortens your CPP experience requirement by one year.

CPP Exam Overview

Feature Details
Total Questions 225 (200 scored + 25 unscored pretest)
Duration 4 hours
Passing Score Scaled score set by ASIS (no fixed percentage)
2026 Cost $580 (members) / $910 (non-members), incl. $160 processing fee
Format Multiple-choice, computer-based at a Pearson VUE test center or remotely proctored
Domains 7 (see weights below)
Accreditation ANAB/ANSI ISO 17024 accredited; SAFETY Act designated

Note on the passing score: ASIS does not publish a fixed pass percentage. The CPP is scored on a scaled basis and each exam form is statistically equated, so your scaled score must clear the cut score ASIS sets. Treat "answer roughly two-thirds correctly" as a rough study target, not an official threshold.

CPP Eligibility Requirements

ASIS frames CPP eligibility around at least five years of security experience, with three years in responsible charge of a security function. Your education level determines the exact number of years, and an APP credential trims one year off any path.

Education and Experience Pathways

Education Security Experience Experience with APP credential Responsible Charge
Master's Degree 5 years 4 years 3 years
Bachelor's Degree 6 years 5 years 3 years
No Degree 9 years 8 years 3 years

Key Definitions:

Security Experience: Full-time employment in a security-related role.

Responsible Charge: A position where you make decisions to complete security objectives without relying on a superior for specific methods. You do not need a formal supervisory title, as long as you held genuine security-program management responsibility.

Candidates must also have no disqualifying criminal convictions and must agree to the ASIS Certification Code of Conduct.

Acceptable Security Experience
Corporate security management
Law enforcement (with security duties)
Military (security, MP, intelligence)
Loss prevention
Risk management
Information security
Investigations
Physical security design/consulting
CPP Exam Domains (7 Areas)

The domain weights below come straight from the current ASIS CPP Body of Knowledge . Security Principles and Physical Security carry the most questions, but Information Security (14%) and Crisis Management (13%) are heavier than many candidates expect, so do not treat them as afterthoughts.

Domain Weight
1. Security Principles and Practices 22%
2. Business Principles and Practices 15%
3. Investigations 9%
4. Personnel Security 11%
5. Physical Security 16%
6. Information Security 14%
7. Crisis Management 13%
Domain 1: Security Principles and Practices (22%)

Key Topics:

Security theory and concepts (including AI and IoT)
Enterprise Security Risk Management (ESRM)
Protection of assets (people, property, information)
Threat, vulnerability, and impact assessment
Security program development and continuous improvement
Security awareness programs
ASIS/ISO industry standards
Professional ethics and legal issues in security

Core Concepts:

Risk Management Process:

Identify assets
Identify threats and vulnerabilities
Assess risk (likelihood × impact)
Develop countermeasures
Implement controls
Monitor and evaluate

Security Principles:

Deterrence: Discourage threats
Detection: Identify incidents
Delay: Slow adversaries
Response: React to incidents

Threat Categories:

Category Examples
Natural Earthquake, flood, hurricane
Accidental Fire, equipment failure, human error
Intentional Theft, sabotage, terrorism, espionage
Domain 2: Business Principles and Practices (15%)

Key Topics:

Organizational structure and culture
Financial management and budgeting
Project management
Personnel management
Strategic planning
Metrics and performance measurement

Essential Business Skills:

Security Budget Components:

Personnel costs (salaries, benefits, training)
Equipment and technology
Maintenance and service contracts
Professional development
Emergency/contingency fund

ROI for Security:

Formula: ROI = (Losses Avoided - Security Costs) / Security Costs × 100%

Key Performance Indicators (KPIs):

Incident reduction rates
Response times
Budget variance
Employee satisfaction
Compliance audit results
Domain 3: Investigations (9%)

Key Topics:

Investigative methods and techniques
Evidence collection and preservation
Interviewing and interrogation
Fraud examination
Case management
Legal considerations

Investigation Types:

Type Focus Key Skills
Criminal Law violations Evidence preservation, police liaison
Civil Lawsuit preparation Documentation, expert testimony
Administrative Policy violations Internal procedures, due process
Fraud Financial crimes Forensic accounting, interviewing

Evidence Handling:

Chain of custody - Document every transfer
Authentication - Verify origin and integrity
Preservation - Protect from alteration or damage
Documentation - Detailed logs and photographs
Domain 4: Personnel Security (11%)

Key Topics:

Pre-employment screening
Background investigations
Security awareness training
Workplace violence prevention
Insider threat programs
Termination procedures
Executive protection programs
Travel security and threat assessment

Background Investigation Components:

Element What It Checks
Criminal History Felonies, misdemeanors, warrants
Employment Verification Job history, reasons for leaving
Education Verification Degrees, certifications
Credit Check Financial responsibility
Reference Checks Character, work performance
Drug Screening Substance abuse

Security Awareness Training Topics:

Physical security procedures
Information protection
Recognizing suspicious activity
Emergency response
Social engineering awareness
Reporting requirements
Domain 5: Physical Security (16%)

Key Topics:

Security surveys and assessments
Access control systems
Intrusion detection
Video surveillance (CCTV)
Security lighting
Barriers and locks
Guard force management

Physical Security Layers:

Layer 1: Deterrence
Signage
Lighting
Visible security measures
Layer 2: Perimeter
Fences and walls
Vehicle barriers
Gates and entrances
Layer 3: Building Exterior
Doors and windows
Locks and hardware
Exterior sensors
Layer 4: Interior
Access control systems
Intrusion alarms
Video surveillance
Safes and vaults
Layer 5: Asset Protection
Secure storage
Tamper-evident seals
Inventory controls

Access Control Methods:

Factor Examples
Something you know Password, PIN
Something you have Key card, token
Something you are Fingerprint, retina scan
Somewhere you are Location-based access
Domain 6: Information Security (14%)

Key Topics:

Information classification
Data protection strategies
Network security
Cybersecurity threats
Incident response
Business continuity planning

Information Classification Levels:

Level Description Handling
Public No restrictions Standard handling
Internal Organization use Internal distribution
Confidential Limited access Need-to-know basis
Restricted Critical information Maximum protection

Common Cyber Threats:

Phishing - Social engineering via email
Malware - Viruses, ransomware, trojans
DDoS - Distributed denial of service
Insider Threat - Malicious or negligent employees
APT - Advanced persistent threats
Domain 7: Crisis Management (13%)

Key Topics:

Emergency planning
Business continuity
Disaster recovery
Crisis communication
Media relations
Post-incident analysis

Crisis Management Phases:

Mitigation - Reduce risk before event
Preparedness - Plan and train
Response - Execute emergency plans
Recovery - Return to normal operations

Business Continuity Planning:

BIA (Business Impact Analysis):

Identify critical functions
Determine recovery priorities
Establish RTO (Recovery Time Objective)
Establish RPO (Recovery Point Objective)

Plan Components:

Emergency response procedures
Communication protocols
Resource requirements
Alternate site arrangements
Testing and maintenance schedule
3-Month CPP Study Schedule
Month 1: Core Knowledge (Domains 1, 2, 5)

Week Focus Hours
1 Security Principles (Domain 1) 12-15
2 Business Principles (Domain 2) 10-12
3 Physical Security (Domain 5) 12-15
4 Review and Practice 8-10
Month 2: Specialized Areas (Domains 3, 4, 6, 7)

Information Security (14%) and Crisis Management (13%) carry real weight, so give them as much time as the management domains, not less.

Week Focus Hours
5 Investigations (Domain 3) 8-10
6 Personnel Security (Domain 4) 8-10
7 Information Security (Domain 6) 10-12
8 Crisis Management (Domain 7) 10-12
Month 3: Review and Practice

Week Focus Hours
9 Weak area review 10-12
10 Practice exam 1 8-10
11 Practice exam 2 8-10
12 Final review 6-8
Total Study Time: 100-150 hours
CPP Test-Taking Strategies
Time Management
200 questions in 240 minutes
Target: ~1.2 minutes per question
Strategy: Answer easier questions first
Question Types

Scenario-Based:

Read the scenario carefully
Identify the core issue
Apply security principles
Choose best answer

Knowledge-Based:

Recall specific concepts
Know definitions and terms
Understand relationships

Application:

Apply theory to practice
Consider context
Evaluate options
Answering Strategy
Read the entire question
Eliminate obviously wrong answers
Choose the BEST answer (may not be perfect)
Mark uncertain questions for review
Answer every question (no penalty for guessing)
CPP Study Resources
Official ASIS Reference Set

ASIS item writers build CPP questions from a defined reference set. The exam is experience-based - ASIS explicitly tells candidates not to memorize these books, but to use them to fill knowledge gaps and apply your own judgment.

Resource What It Is
Protection of Assets (POA) The core multi-volume ASIS reference covering technical and managerial security
ASIS Standards CSO, ORM.1, SRA, and WVPI.1
ASIS Guidelines PAP, IAP, and PBS
CPP Study Manual Walks through all 7 domains, key terms, and study strategy
CPP Flash Cards Print or digital, for terms and concept recall
CPP Practice Test / Practice Exam Retired real items so you see the actual question style
Cost of Materials

Resource Approximate Cost
CPP Study Manual ~$130-150
Protection of Assets set ~$200-400 (free eBooks for some member tiers)
Standards & Guidelines bundle ~$100-200 (eBooks free for members)
ASIS Membership $215-295/year
Recommended Additional Study
ASIS Webinars - Domain-specific training
Local ASIS Chapters - Study groups
Online Courses - Structured learning
Security Management Magazine - Stay current
CPP Certification Costs Summary (2026)

The CPP application fee bundles the exam and a non-refundable $160 processing fee. ASIS sets the member rate well below the non-member rate, so most candidates join ASIS first.

Item Member Non-Member
Application Fee (exam + $160 processing) $580 $910
ASIS Membership $215-295/year N/A
Study Manual ~$130-150 ~$130-150
Reference books (POA + standards) ~$200-500 ~$200-500
Total Estimated ~$1,125-1,525 ~$1,240-1,560

Discounted application fees apply in ASIS-designated Emerging Market countries. Always confirm current pricing in the ASIS Certification Handbook before you apply.

CPP vs. PSP: Which Certification?

CPP is the broad security-management credential; PSP zooms in on physical security assessment, design, and implementation. The CPP covers all seven domains, while the PSP focuses on just three physical-security domains.

Factor CPP PSP
Focus Security management (7 domains) Physical security technical (3 domains)
Scored Questions 200 (+25 pretest) 125 (+15 pretest)
Time 4 hours 3 hours
Experience 5+ years, 3 in responsible charge 4+ years in physical security
Best For Security managers/directors Physical security specialists

Many professionals earn both - the CPP proves management breadth, the PSP proves physical-security depth. ASIS also offers the PCI (investigations) and APP (entry-level management) credentials, so you can build a full ASIS stack. Drill the free PSP question bank alongside your CPP practice if you are targeting both.

Career Impact of CPP Certification
Salary Increases

Position Without CPP With CPP
Security Manager $85,000 $105,000
Security Director $110,000 $135,000
VP Security $150,000 $180,000
Career Advancement
Faster promotion to senior roles
Broader opportunities across industries
Consulting eligibility - Many clients require CPP
Board positions - Preference for certified professionals
Free CPP Practice Resources
Start Practicing Today
200+ CPP-style practice questions covering all 7 domains
Scenario-based questions with detailed explanations
Domain-specific quizzes to identify weak areas
Study guidance based on exam blueprint