Travel Security & Duty of Care

ASIS CPP Certified Protection Professional

Track your progress as you read

Finished sections get a check mark.

1 Introduction & CPP Exam Overview

CPP Exam Facts & Format Using the Seven Domains + ESRM Study Plan

2 Security Principles and Practices

1.1 Security Program Planning, Organization & Control 1.2 Enterprise Security Risk Management (ESRM) & Security Theory 1.3 Security Industry Standards & Continuous Improvement 1.4 The Security Risk Assessment Process Threats & Risk Analysis Fundamentals Risk Treatment — Strategies & Mitigation External Liaison & Public-Private Partnerships Security Awareness Programs

3 Business Principles and Practices

Security Budgeting & Financial Controls Policies, Procedures, Plans & Directives Measuring & Improving Productivity Security Staffing & Personnel Development Ethics, Governance & Vendor Contract Management

4 Investigations

Managing Investigative Operations Evidence, Surveillance & Specialized Investigations Investigative Interviews & Legal Proceedings

5 Personnel Security

Background Investigations & Screening Workplace Violence Protection Travel Security & Duty of Care Executive Protection Programs

6 Physical Security

Physical Security Surveys, Gap Analysis & PPS Design Perimeter Barriers, Protective Lighting & CPTED Locks, Key Control & Access Control Systems Intrusion Detection Systems & Video Surveillance Security Officers, PPS Integration & Program Management Testing, Auditing & Maintaining Physical Security Systems

7 Information Security

InfoSec Program Surveys & Risk Assessment InfoSec Management, Standards & Records Law Protecting Proprietary Information & Intellectual Property CIA Triad, Authentication, Encryption & Cyber Controls Managing an Integrated InfoSec Program & Awareness

8 Crisis Management

Threat Assessment, BIA & Business Continuity Standards Emergency Planning & Preparedness Crisis Communications, Notification & Exercises Incident Command, EOC & Incident Response Recovery, Resumption & Continuity of Operations

Travel Security & Duty of Care

Key Takeaways Explain This Topic AI

Duty of care is the employer's obligation to take reasonable, foreseeable steps to protect a traveling employee -- a standard of diligence, not a guarantee of safety.

Traveler risk management spans five phases: pre-travel assessment, in-transit monitoring, on-the-ground execution, contingency response, and post-travel debrief.

Consular or embassy registration lets government resources locate and notify travelers, issue replacement documents, and coordinate with local authorities during a crisis.

Route selection for ground movement applies the same principles as executive-protection advance work: primary and alternate routes, avoiding predictable patterns, and avoiding threat-flagged areas.

Contingency plans need a pre-assigned decision authority for evacuation or itinerary changes so the decision is not delayed during a real crisis.

Last updated: July 2026

Travel Security as a Personnel-Security Function

Business travel -- especially international travel to unfamiliar or higher-risk destinations -- concentrates risk onto a single employee outside the organization's normal security controls. The CPP Body of Knowledge places travel security within Personnel Security because the protective techniques are the same as those applied to any at-risk individual: assess the threat, plan the route, and prepare a contingency response before departure.

Duty of Care

Duty of care is the legal and ethical obligation an employer owes a traveling employee: to take reasonable, foreseeable steps to protect that employee's health and safety while on company business. It is not a guarantee of safety -- it is a standard of reasonable diligence. Courts and regulators evaluate duty of care against what the organization knew or should have known about the destination's risk profile and whether it took commensurate precautions. A documented travel-risk program is the primary evidence an organization has met that standard.

Traveler Risk Management Process

A structured program addresses risk before, during, and after travel:

Phase Core activities

Pre-travel Destination risk assessment, traveler briefing, itinerary registration, medical preparation, emergency contact and evacuation-insurance setup

• In-transit Flight planning, route selection, real-time threat monitoring, check-in protocol
• On the ground Secure ground transportation, hotel security vetting, local liaison contacts
• Contingency Evacuation plan, medical emergency plan, crisis-communication protocol
• Post-travel Debrief, incident capture, program lessons-learned update
• Flight Planning and Route Selection

Flight planning goes beyond booking convenience -- it considers carrier safety record, routing through or over higher-risk airspace, layover-country entry requirements, and connection-time buffers that avoid stranding a traveler in a high-risk transit hub. Route selection for ground movement applies the same logic used in executive-protection advance work: identifying primary and alternate routes, avoiding predictable patterns, and steering clear of areas flagged by current threat intelligence, such as civil unrest, high-crime districts, or active conflict zones.

Global Threat Awareness

Effective traveler risk management depends on current global threat intelligence : government travel advisories, private threat-intelligence subscription services, and open-source monitoring of the destination's security, political, health, and natural-hazard conditions. Threat levels change quickly, so a security program needs a defined process for re-screening upcoming itineraries against updated advisories, not a one-time check at the time of booking.

Global Threat Categorization Tools

Security programs typically anchor destination risk ratings to an established external reference rather than building one from scratch. The U.S. State Department's Travel Advisory system , for example, rates every country on a four-level scale: Level 1 (exercise normal precautions), Level 2 (exercise increased caution), Level 3 (reconsider travel), and Level 4 (do not travel). Level 1 and 2 advisories are reviewed roughly every 12 months, while Level 3 and 4 advisories -- covering the highest-risk destinations -- are reviewed at least every six months given how quickly conditions can change. Mapping company travel-approval thresholds to these levels (for example, requiring executive sign-off for Level 3 travel and barring Level 4 travel outright) gives a security program an externally validated, auditable basis for pre-travel risk decisions instead of an internal judgment call alone.

Consulate Services and Government Resources

Travelers and security teams should know how to reach the destination country's embassy or consulate before a crisis occurs. Registering international itineraries with a government travel-registration program allows the embassy to locate and notify travelers during an emergency, provide replacement-document services, and coordinate with local authorities. Consular resources are also a channel for real-time security updates during a fast-moving crisis such as civil unrest, a natural disaster, or a terrorist incident.

Contingency Planning

Contingency planning turns duty of care into an executable response. Minimum elements include:

Emergency contact tree linking the traveler, the security operations center, a local liaison, and next of kin.

Medical evacuation and repatriation arrangements , typically through a travel-risk or medical-assistance vendor.

Communication protocol for a traveler to signal distress or check in on a defined schedule in higher-risk locations.

Evacuation triggers and routes pre-identified for the destination, not improvised during the crisis itself.

Decision authority -- a clearly designated person who can authorize an evacuation or itinerary change, so the decision is not delayed by unclear ownership.

Traveler Preparation

Before departure, at-risk travelers should receive a destination-specific security briefing covering local threat conditions, cultural and legal considerations -- including conduct that could draw unwanted attention -- emergency numbers, and instructions for the check-in protocol. Low-profile behavior, such as avoiding conspicuous displays of wealth or company affiliation, varying routines, and using vetted transportation, reduces the traveler's exposure without requiring a dedicated protective detail.

Program Governance

A mature travel-security program ties into the broader ESRM framework: risk is assessed by destination and traveler profile rather than applied uniformly, mitigation is proportionate to that risk, and outcomes such as incidents or near-misses feed back into the risk model. For CPP purposes, remember that duty of care obligates reasonable preparation and response, not the elimination of all travel risk, and that documentation of the risk-assessment and contingency-planning process is what demonstrates the organization met its obligation.

Key Takeaways for Application Questions

Duty of care means reasonable, foreseeable protective steps, not a safety guarantee.

Pre-travel risk assessment must be destination- and traveler-specific, and refreshed close to departure.

Route selection and flight planning are proactive risk-avoidance tools, not just logistics.

Consular registration provides emergency locate-and-notify capability.

Contingency plans need pre-assigned decision authority to avoid delay during a real crisis.