Evidence, Surveillance & Specialized Investigations

ASIS CPP Certified Protection Professional

Track your progress as you read

Finished sections get a check mark.

1 Introduction & CPP Exam Overview

CPP Exam Facts & Format Using the Seven Domains + ESRM Study Plan

2 Security Principles and Practices

1.1 Security Program Planning, Organization & Control 1.2 Enterprise Security Risk Management (ESRM) & Security Theory 1.3 Security Industry Standards & Continuous Improvement 1.4 The Security Risk Assessment Process Threats & Risk Analysis Fundamentals Risk Treatment — Strategies & Mitigation External Liaison & Public-Private Partnerships Security Awareness Programs

3 Business Principles and Practices

Security Budgeting & Financial Controls Policies, Procedures, Plans & Directives Measuring & Improving Productivity Security Staffing & Personnel Development Ethics, Governance & Vendor Contract Management

4 Investigations

Managing Investigative Operations Evidence, Surveillance & Specialized Investigations Investigative Interviews & Legal Proceedings

5 Personnel Security

Background Investigations & Screening Workplace Violence Protection Travel Security & Duty of Care Executive Protection Programs

6 Physical Security

Physical Security Surveys, Gap Analysis & PPS Design Perimeter Barriers, Protective Lighting & CPTED Locks, Key Control & Access Control Systems Intrusion Detection Systems & Video Surveillance Security Officers, PPS Integration & Program Management Testing, Auditing & Maintaining Physical Security Systems

7 Information Security

InfoSec Program Surveys & Risk Assessment InfoSec Management, Standards & Records Law Protecting Proprietary Information & Intellectual Property CIA Triad, Authentication, Encryption & Cyber Controls Managing an Integrated InfoSec Program & Awareness

8 Crisis Management

Threat Assessment, BIA & Business Continuity Standards Emergency Planning & Preparedness Crisis Communications, Notification & Exercises Incident Command, EOC & Incident Response Recovery, Resumption & Continuity of Operations

Evidence, Surveillance & Specialized Investigations

Key Takeaways Explain This Topic AI

Crime-scene protection -- securing the perimeter and preventing contamination -- must occur before evidence is documented or collected.

Chain of custody is the documented, unbroken record of who collected, controlled, transferred, and stored evidence from seizure through final disposition.

Destroying or altering evidence after a litigation hold attaches can constitute spoliation and expose the organization to adverse legal sanctions.

Commercial drone (UAS) surveillance in the United States is regulated under FAA Part 107, which requires a remote pilot certificate and grants no authority to disable another party's drone.

Specialized investigative categories -- financial/fraud, IP/espionage, property crime, cybercrime, and crimes against persons -- each carry distinct evidence types and legal-reporting obligations.

Last updated: July 2026

Protecting the Scene and the Evidence

The outcome of an investigation is only as strong as the evidence behind it, and evidence is only as strong as the handling it received from the moment it was discovered. Crime-scene protection is the first priority: establishing a secure perimeter, controlling entry and exit, identifying and separating witnesses, and preventing contamination before evidence is documented and collected. Untrained personnel — including well-meaning employees or managers — routinely destroy evidentiary value by moving items, cleaning up, or allowing unrestricted access before the scene is recorded.

Evidence collection follows a disciplined sequence: photograph and diagram the scene before anything is touched, collect evidence systematically (fragile or perishable items first), mark and package each item individually, and record the collector's identity, date, time, and location for every item at the moment of collection. Physical evidence (documents, tools, damaged property), digital evidence (log files, email, device images), and testimonial evidence (witness statements) each require a different collection method, but all three must feed into the same chain-of-custody log so the case record stays internally consistent.

Chain of Custody

Chain of custody is the chronological, documented record of who collected, controlled, transferred, analyzed, and stored a piece of evidence from the moment it was seized until it is presented in a proceeding or otherwise disposed of. Every transfer of custody must be logged — who released it, who received it, when, and why — with no unexplained gap in the record. A broken or undocumented chain of custody is one of the most common reasons evidence is challenged or excluded, because it opens the door to an argument that the evidence was altered, substituted, or contaminated. The core chain-of-custody elements a CPP must apply are:

• Element Requirement
• Identification Evidence is uniquely marked/tagged at the point of collection
• Documentation A log records every person who possessed or accessed the item
• Preservation Evidence is stored securely, protected from tampering, damage, or loss
• Transfer Each hand-off is signed, dated, and justified

Disposition Final release, return, or destruction is authorized and recorded, consistent with retention law and any litigation hold

Preservation and disposition are also governed by law: evidence relevant to reasonably anticipated litigation is subject to a litigation hold , and destroying or altering it once that duty attaches can constitute spoliation , exposing the organization to adverse legal inference or sanctions.

Surveillance and Counter-Surveillance

Surveillance — the covert or overt observation of a person, place, or activity — supports investigations by corroborating or refuting witness accounts and documenting ongoing misconduct. Modern investigative surveillance increasingly uses unmanned aircraft systems (UAS/drones) and ground robotics, which raise their own legal requirements: in the United States, commercial drone use falls under FAA Part 107 , which requires a remote pilot certificate, caps altitude generally at 400 feet, restricts flight over uninvolved people, and does not grant any authority to disable or take down another party's drone. State and local privacy, trespass, and anti-surveillance statutes layer on top of federal airspace rules, so a CPP must clear a planned surveillance operation — aerial or ground-based — against both sets of law before execution. Counter-surveillance detects when the organization itself is being watched or targeted — by a competitor, activist group, or criminal actor — and typically follows a protocol of detect, document, and escalate rather than direct confrontation, since Part 107 gives an organization no legal authority to disable or seize an unfamiliar drone on its own. Ground robotics used for perimeter patrol raise a parallel set of considerations: data-retention limits on recorded footage, notice requirements where employees or the public may be recorded, and integration of robotic sensor logs into the same evidentiary chain as human-collected evidence.

Specialized Crime Categories

The CPP body of knowledge expects familiarity with the major categories of crime a security investigator will encounter, since the investigative approach, evidence type, and referral path differ by category:

Financial crime and fraud — embezzlement, procurement fraud, expense-account abuse, and financial-statement manipulation; typically requires forensic-accounting support and document-trail analysis

Intellectual property theft and espionage — theft of trade secrets, proprietary processes, or competitive information, often involving an insider with authorized access

Property crime — arson, theft, and sabotage against physical assets, facilities, or equipment

Cybercrime — distributed denial-of-service (DDoS) attacks, phishing, and ransomware, which combine technical evidence (logs, malware artifacts) with the same chain-of-custody discipline applied to physical evidence

Crimes against persons — workplace violence, human trafficking, and harassment, where victim safety and trauma-informed interviewing take priority over evidence collection speed

Each category may trigger a distinct legal-reporting obligation — for example, suspected trafficking or certain financial crimes can carry mandatory reporting duties — so the investigator must know which categories require immediate escalation to law enforcement or a regulator rather than internal resolution alone. Recognizing the category early shapes the entire investigative plan: who is notified, what evidence must be preserved first, and whether the matter proceeds as an internal case or is handed to outside authorities from the outset.