CPP Exam Facts & Format

ASIS CPP Certified Protection Professional

Track your progress as you read

Finished sections get a check mark.

1 Introduction & CPP Exam Overview

CPP Exam Facts & Format Using the Seven Domains + ESRM Study Plan

2 Security Principles and Practices

1.1 Security Program Planning, Organization & Control 1.2 Enterprise Security Risk Management (ESRM) & Security Theory 1.3 Security Industry Standards & Continuous Improvement 1.4 The Security Risk Assessment Process Threats & Risk Analysis Fundamentals Risk Treatment — Strategies & Mitigation External Liaison & Public-Private Partnerships Security Awareness Programs

3 Business Principles and Practices

Security Budgeting & Financial Controls Policies, Procedures, Plans & Directives Measuring & Improving Productivity Security Staffing & Personnel Development Ethics, Governance & Vendor Contract Management

4 Investigations

Managing Investigative Operations Evidence, Surveillance & Specialized Investigations Investigative Interviews & Legal Proceedings

5 Personnel Security

Background Investigations & Screening Workplace Violence Protection Travel Security & Duty of Care Executive Protection Programs

6 Physical Security

Physical Security Surveys, Gap Analysis & PPS Design Perimeter Barriers, Protective Lighting & CPTED Locks, Key Control & Access Control Systems Intrusion Detection Systems & Video Surveillance Security Officers, PPS Integration & Program Management Testing, Auditing & Maintaining Physical Security Systems

7 Information Security

InfoSec Program Surveys & Risk Assessment InfoSec Management, Standards & Records Law Protecting Proprietary Information & Intellectual Property CIA Triad, Authentication, Encryption & Cyber Controls Managing an Integrated InfoSec Program & Awareness

8 Crisis Management

Threat Assessment, BIA & Business Continuity Standards Emergency Planning & Preparedness Crisis Communications, Notification & Exercises Incident Command, EOC & Incident Response Recovery, Resumption & Continuity of Operations

CPP Exam Facts & Format

Key Takeaways Explain This Topic AI

The CPP exam contains 225 total items: 200 scored questions plus 25 unscored pretest questions randomly distributed throughout, per the ASIS Certification Handbook.

Candidates have four hours to complete the CPP exam, delivered by Prometric at a test center or through the remote-proctored ProProctor platform.

A scaled score of at least 650 (on a 200-800 scale) is required to pass the CPP exam.

CPP eligibility requires at least three years in responsible charge, plus seven years of security experience (six with a bachelor's degree, five with a master's).

CPP certificants must recertify every three years by earning 60 Continuing Professional Education (CPE) credits tied to the certification's domains.

Last updated: July 2026

What Is the CPP?

The Certified Protection Professional (CPP®) is ASIS International's board certification in security management, widely regarded as the "gold standard" for senior security leaders. ASIS International -- the world's largest membership association for security management professionals -- has offered the CPP for more than 40 years. Earning a CPP demonstrates broad, senior-level competence across the entire security function: program leadership, business operations, investigations, personnel protection, physical security, information security, and crisis management. It is not a specialist credential in any one of those areas; it certifies the ability to lead across all seven.

Because CPP is a board certification rather than a course-completion certificate, it is earned solely by meeting strict, experience-based eligibility requirements and then passing a single proctored exam -- there is no mandatory training component. ASIS does publish a recommended reference set (the Protection of Assets manual plus seven ASIS Standards and Guidelines, including the Security and Resilience in Organizations standard and the Workplace Violence Prevention and Intervention standard) that its own item writers use to source correct answers, but studying those materials is optional, not required for eligibility.

Exam Format at a Glance

The CPP exam is a single computer-based, multiple-choice exam -- everything is tested in one sitting rather than split across separate exam parts:

225 total items : 200 "live" (scored) questions plus 25 unscored pretest questions distributed randomly throughout the exam

Four-hour time limit, which accounts for time spent on the unscored pretest items
Four answer choices per question , exactly one correct

Delivered through Prometric , either at a physical test center or through Prometric's remote-proctored ProProctor platform on a candidate's own computer

Offered in English or Spanish (Spanish-language exams include an English translation and a Spanish-speaking proctor)

No scheduled breaks -- the exam clock continues running if a candidate steps away

Because the 25 pretest items are indistinguishable from live items, every question should be treated as if it counts toward the score.

The Seven Domains and Their Weights

The CPP Body of Knowledge (BoK) organizes the exam into seven domains. Each domain's weight approximates the share of the 200 scored questions it contributes -- and should approximate the share of a candidate's study time (more on this in Section 0.2).

# Domain Weight
1 Security Principles and Practices 22%
2 Business Principles and Practices 15%
3 Investigations 9%
4 Personnel Security 11%
5 Physical Security 16%
6 Information Security 14%
7 Crisis Management 13%
- Total 100%

Security Principles and Practices is the largest single domain, reflecting the CPP's emphasis on program leadership, risk assessment, and Enterprise Security Risk Management. Investigations, at 9%, is the smallest weighted domain -- but still represents roughly 18 scored questions on a typical form.

Eligibility Requirements

CPP eligibility is experience-based rather than education-based, though holding a degree reduces the required years of security experience. All three paths require at least three years in responsible charge of a security function -- meaning the applicant had authority to make independent decisions and take independent action on a security-related project or process, without necessarily supervising others.

Education Security experience required Responsible charge
No degree 7 years (6 years if you already hold the APP) 3 years
Bachelor's degree or equivalent 6 years (5 years if you already hold the APP) 3 years
Master's degree or equivalent 5 years (4 years if you already hold the APP) 3 years

Additional requirements include full-time employment in a security-related role, no criminal conviction that would reflect negatively on the security profession, and agreement to abide by the ASIS Certification Code of Professional Responsibility.

Scoring and Passing

CPP results are reported as a scaled score , not a raw percentage or raw point total. Scaled scoring converts the number of correctly answered questions into a standardized scale -- commonly cited as 200 to 800 -- that accounts for item difficulty, so performance is comparable across different exam forms. A scaled score of at least 650 is required to pass. Unanswered items are scored identically to wrong answers, so candidates should answer every question; there is no penalty for an informed guess.

Fees, Retesting, and Recertification

As of 2026, the CPP application fee is $580 for ASIS members and $910 for nonmembers ; both figures include a nonrefundable $160 processing fee, and reduced Emerging Market rates apply in qualifying countries. Approved candidates get up to three attempts within a one-year eligibility window , with at least 60 days required between attempts; each retest costs $480 . Candidates who fail three times, or whose one-year eligibility window lapses, must submit a new application.

Once earned, the CPP designation does not expire automatically, but it must be recertified every three years by completing 60 Continuing Professional Education (CPE) credits tied to the certification's domains -- earned through ASIS conferences, instruction, authorship, volunteer service, membership, or other approved categories.