Using the Seven Domains + ESRM Study Plan

ASIS CPP Certified Protection Professional

Track your progress as you read

Finished sections get a check mark.

1 Introduction & CPP Exam Overview

CPP Exam Facts & Format Using the Seven Domains + ESRM Study Plan

2 Security Principles and Practices

1.1 Security Program Planning, Organization & Control 1.2 Enterprise Security Risk Management (ESRM) & Security Theory 1.3 Security Industry Standards & Continuous Improvement 1.4 The Security Risk Assessment Process Threats & Risk Analysis Fundamentals Risk Treatment — Strategies & Mitigation External Liaison & Public-Private Partnerships Security Awareness Programs

3 Business Principles and Practices

Security Budgeting & Financial Controls Policies, Procedures, Plans & Directives Measuring & Improving Productivity Security Staffing & Personnel Development Ethics, Governance & Vendor Contract Management

4 Investigations

Managing Investigative Operations Evidence, Surveillance & Specialized Investigations Investigative Interviews & Legal Proceedings

5 Personnel Security

Background Investigations & Screening Workplace Violence Protection Travel Security & Duty of Care Executive Protection Programs

6 Physical Security

Physical Security Surveys, Gap Analysis & PPS Design Perimeter Barriers, Protective Lighting & CPTED Locks, Key Control & Access Control Systems Intrusion Detection Systems & Video Surveillance Security Officers, PPS Integration & Program Management Testing, Auditing & Maintaining Physical Security Systems

7 Information Security

InfoSec Program Surveys & Risk Assessment InfoSec Management, Standards & Records Law Protecting Proprietary Information & Intellectual Property CIA Triad, Authentication, Encryption & Cyber Controls Managing an Integrated InfoSec Program & Awareness

8 Crisis Management

Threat Assessment, BIA & Business Continuity Standards Emergency Planning & Preparedness Crisis Communications, Notification & Exercises Incident Command, EOC & Incident Response Recovery, Resumption & Continuity of Operations

Using the Seven Domains + ESRM Study Plan

Key Takeaways Explain This Topic AI

Security Principles and Practices carries the highest CPP domain weight at 22%, followed by Physical Security at 16%.

Enterprise Security Risk Management (ESRM) is explicitly listed as required knowledge under CPP Domain 1, Task 1.

Investigations is the lowest-weighted CPP domain at 9%, but still accounts for roughly 18 of the 200 scored questions.

ASIS describes its certification exams as experience-based, meaning candidates apply judgment to scenarios rather than recall memorized definitions.

Business Principles and Practices (15%) and Information Security (14%) together make up nearly 30% of the CPP exam.

Last updated: July 2026

From Blueprint to Study Plan

The seven domain weights introduced in Section 0.1 are not arbitrary -- the ASIS Professional Certification Board periodically reruns a job analysis study specifically to confirm those percentages still reflect what a "minimally competent" security manager needs to know. Because the CPP exam draws roughly proportional numbers of scored questions from each domain, the single highest-leverage study decision a candidate can make is matching study time to domain weight , rather than following intuition about which topics feel most familiar or most interesting.

Enterprise Security Risk Management (ESRM): The Unifying Philosophy

If one concept threads through all seven CPP domains, it is Enterprise Security Risk Management (ESRM) . ESRM is explicitly named as required knowledge under Domain 1, Task 1 ("Plan, develop, implement, and manage the organization's security program"), but its logic underlies the entire exam, not just Domain 1:

Risk owners, not the security department, make the final call. ESRM treats business-unit leaders as the owners of risk to their own assets; security's job is to identify, analyze, and clearly communicate risk so those owners can make informed decisions.

Security decisions are justified by risk, not by policy for its own sake. A countermeasure earns its budget by demonstrably reducing the likelihood or impact of a defined threat against a defined asset -- the same cost-benefit logic tested throughout Business Principles, Physical Security, and Information Security questions.

Collaboration crosses departmental lines. ESRM formalizes what the BoK calls "cross-functional organizational collaboration" -- legal, human resources, information technology, facilities, and business leadership all participate in risk decisions rather than security acting alone.

The process is continuous, not a one-time project. ESRM is a recurring lifecycle -- identify assets, assess risk, treat risk, and reassess -- that reappears in the Domain 1 risk-assessment tasks, the Domain 7 threat-and-business-impact-analysis tasks, and the Domain 5 and Domain 6 physical- and information-security survey tasks.

Expect ESRM logic to surface even in questions that never use the word "ESRM." A scenario asking which risk-treatment strategy applies, or which stakeholder should approve a control, is testing ESRM thinking.

Why CPP Questions Read Differently Than Recall Quizzes

ASIS states plainly that its certification exams are experience-based : candidates are expected to apply judgment drawn from real security-management practice, not recite memorized definitions from a reference manual. In practice, that means CPP stems tend to:

Describe a scenario ("A regional security manager discovers…") and ask for the best next action, not a textbook definition

Present multiple plausible-sounding options , where the wrong answers are technically valid actions but not the most appropriate one given the facts in the stem

Test sequencing ("What should be done first…") in processes such as incident command, the risk-assessment cycle, or evidence handling

Require applying a standard or framework to a specific fact pattern , rather than simply naming the standard

This guide's quiz questions throughout later chapters are written in that same application style, and lifecycle-heavy topics are flagged with ordering- and matching-style questions where useful.

Building a Weight-Proportional Study Plan

A simple way to allocate a fixed study budget is to mirror the exam's own weighting. For a candidate planning roughly 100 hours of total study time, the table below also converts each domain's weight into its approximate share of the 200 scored questions, so the same ratios explain both how to plan your calendar and how many questions from each domain you should expect to see on test day:

Domain Weight Study hours (of 100) Scored questions (of 200)
1. Security Principles and Practices 22% 22 44
2. Business Principles and Practices 15% 15 30
3. Investigations 9% 9 18
4. Personnel Security 11% 11 22
5. Physical Security 16% 16 32
6. Information Security 14% 14 28
7. Crisis Management 13% 13 26
Total 100% 100 200

The underlying ratios hold regardless of how many total hours a candidate actually has. A candidate with only 60 available study hours can multiply each domain's share by 0.6 rather than abandoning the weighting altogether -- Security Principles and Practices would still get the largest slice (about 13 hours), and Investigations the smallest (about 5 hours).

This study guide's own chapter structure mirrors that logic: Chapter 1 (Security Principles) and Chapter 5 (Physical Security) -- the two highest-weighted domains -- receive the most sections, while Chapter 3 (Investigations), the lowest-weighted domain, receives the fewest. Even so, do not skip low-weight domains entirely: at 9% of 200 scored questions, Investigations still represents roughly 18 exam questions -- enough on its own to determine whether a borderline candidate clears the 650 scaled-score passing point.

Finally, apply the same weighting to practice-question review , not just reading time. A candidate who reads evenly across all seven domains but drills practice questions only on favorite topics will systematically under-prepare for the higher-weighted, less-familiar domains where the exam concentrates the most points.