Study guide
2.4 Standards, Regulations, Codes & Where to Find Them
ASIS Physical Security Professional PSP
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PSP Exam Facts 1.2 Eligibility, Fees, Scheduling & Recertification 1.3 Experience-Based Testing, References & Study Approach
2 Assessment Planning & Methods
2.1 Assessment Plan, Stakeholders, Budget & Resources 2.2 Inside-Out, Outside-In, Site-Specific & Functional Models 2.3 Qualitative vs Quantitative Assessment Methods 2.4 Standards, Regulations, Codes & Where to Find Them
3 Asset Identification & Valuation
3.1 Asset Types, Terminology, Value, Criticality & Loss Impact 3.2 Valuing Tangible and Intangible Assets for Operations 3.3 Criticality, Key Areas & Loss-Impact Prioritization
4 Threats, Hazards & Operating Environment
4.1 Criminal, Terrorist, Insider & Sociopolitical Threats 4.2 Natural Disasters, Accidental & Cyber-Physical Hazards 4.3 Geography, Crime, Socioeconomics & Existing Countermeasures 4.4 Neighbors, Competitors, Legal, Reputation & Supply Chain
5 Vulnerability Assessment & Surveys
5.1 Surveys, Interviews, Incident Data, Crime Stats & Benchmarking 5.2 Evaluating Technology, Personnel & Procedures 5.3 Plans, Schematics & Environmental/Site Factors
6 Risk Analysis & Countermeasure Selection
6.1 Risk Analysis Strategies, Principles & Data Interpretation 6.2 Threat/Hazard–Vulnerability Pairing & Loss Event Profiles 6.3 Matching Countermeasures to Specific Risks 6.4 ROI, Total Cost of Ownership, Privacy, PII & Life Safety
7 Performance Requirements & Security Concepts
7.1 Design Constraints & Incorporating Risk Analysis 7.2 CPTED, Defense-in-Depth, 4 Ds & Security Terminology 7.3 Operational, Functional, Performance Requirements, Codes & Metrics
8 Structural Measures & CPTED Application
8.1 Fences, Gates & Perimeter Barriers 8.2 Blast Mitigation, Ballistic Protection & Hostile Vehicle Mitigation 8.3 Lighting, Locks, Doors, Windows & Glazing 8.4 Applying CPTED to Site Planning & Landscaping
9 Electronic Security Systems
9.1 Electronic Access Control Architecture & Credentials 9.2 Biometrics, Electrified Locks, Anti-Passback & Mantraps 9.3 Video Surveillance Design, Storage & Analytics 9.4 Intrusion Detection Sensors & Alarm Communications
10 Screening, Communications, Power & Networks
10.1 Personnel, Package & Vehicle Screening and Visitor/Vendor Policy 10.2 Mass Notification, Audio Comms, Consoles & Central Stations 10.3 Data Storage, Retention, PII & Physical Network Security 10.4 Primary/Backup Power and Copper, Fiber & Wireless Transmission
11 System Design & Project Documentation
11.1 Pre-Design, Schematic, Construction Docs, Calculations & Drawings 11.2 CSI MasterFormat, Owner Standards & AIA MasterSpec 11.3 Systems Integration, Scheduling, Cost Estimation & Value Engineering
12 Pre-Bid Meetings & Solicitation Packages
12.1 Site Visits, RFIs, Substitution Requests & Pre-Bid Meetings 12.2 RFP, RFQ, IFB & Sole Source 12.3 SOW, Timelines, Costs, Personnel & Documentation 12.4 Evaluation Criteria, Technical Compliance & Contracting Ethics
13 Procurement Planning & Vendor Selection
13.1 Procurement Process for Security Goods & Services 13.2 Interviews, Due Diligence, References & Selection 13.3 Project Management Functions in Procurement
14 Installation, Commissioning & Acceptance
14.1 Installation & Inspection Techniques 14.2 Commissioning & Implementation-Phase Integration 14.3 FAT, SAT & Final Acceptance Testing Criteria 14.4 Punch Lists, As-Builts, Config Management & End-User Training
15 Security Personnel Requirements
15.1 Roles, Limits, Proprietary vs Contract Staffing 15.2 Recruiting, KPIs, Discipline & Professional Development 15.3 Post Orders, Uniforms/Equipment & Non-Security Awareness
16 Lifecycle Maintenance & Program Evaluation
16.1 Preventive/Corrective Maintenance, Calibration, Service Agreements & Warranties 16.2 Upgrade Training, System Evaluation & Replacement
2.4 Standards, Regulations, Codes & Where to Find Them
Key Takeaways Explain This Topic AI
The adopted IBC/IFC edition and local amendments come from the authority having jurisdiction for that site, not from a generic national memory list.
Life-safety and accessibility requirements on required egress typically prevail over a security preference for fail-secure or chained exits.
NFPA 101 and NFPA 72 are commonly encountered references; confirm the edition the fire marshal actually enforces.
The ASIS Physical Asset Protection Standard is a voluntary consensus standard unless an owner adopts it; it does not replace building or fire code.
Find the applicable document by occupancy, adopted edition, listing mark, owner standard, and—only when it truly applies—sector guidance from agencies such as CISA.
Last updated: September 2026
Where to Look Up What Governs the Door in Front of You
Physical security assessments collide with codes , regulations , voluntary standards , product listings , and owner rules . Independent ExamFinch teaching for published PSP Domain 1 tasks is not a dump of copyrighted clause text and not a claim that a numbered line from a code book is a PSP exam item. The professional skill is how to find the document that actually governs this hospital, data center, warehouse, or campus , and how to handle the usual conflict: security wants the door to hold, life safety wants occupants out.
Life safety typically wins the conflict
On a required egress path, a security preference does not outrank the building official or fire marshal. If a warehouse chains a required exit to stop shrink, the problem is not clever loss prevention; it is an egress violation with injury potential. If a hospital wants a smoke-compartment door on a required exit to fail-secure (stay locked on power loss or fire alarm) because elopement is a fear, the adopted fire code and accessibility rules will often require that door to unlock for egress under emergency conditions. The assessor's job is to name the conflict , bring EHS and the authority having jurisdiction (AHJ) into the plan, and look for hardware sequences that satisfy both where the adopted code allows them—not to write a finding that occupants should wait while security holds the stair.
Three collisions you will actually see:
Fail-safe versus fail-secure. Fail-safe unlocking on fire alarm or power loss is commonly required on doors that are part of the means of egress. Fail-secure hardware that remains locked is common on doors that are not that egress path, or on special locking arrangements the adopted code expressly allows. Do not specify fail-secure on a required hospital exit because a camera vendor prefers it.
Delayed egress. Time-delay locking is a code-controlled arrangement (initiation, signage, delay duration, and occupancy limits), not a security gadget you invent on a data-hall door. Whether a delay is allowed, and for how long, is in the edition the AHJ adopted, plus any local amendment. Teach yourself to ask for the sequence of operations and the occupancy classification, not to memorize a single national delay as if it were universal.
Occupancy. A hospital (healthcare), a warehouse (storage/factory mix), a data hall, and a corporate office campus are not the same occupancy. Hardware that is routine in a business occupancy may be illegal in a healthcare smoke compartment. Occupancy is why you cannot copy a campus lock schedule onto a hospital annex.
How to find the applicable document
Use a lookup path. Write the path in the assessment plan so fieldwork does not guess.
Ask the AHJ and facilities which code edition is adopted for this parcel. That is usually an International Building Code (IBC) and International Fire Code (IFC) pair, often with state or city amendments. The book on your shelf is useless if the city is on a different edition.
Confirm occupancy classification and use with facilities and the certificate of occupancy, not with the marketing name of the building. A campus childcare center inside an office park is not an office.
Ask the fire marshal which fire-alarm and life-safety references they enforce. NFPA 101 (Life Safety Code) and NFPA 72 (National Fire Alarm and Signaling Code) are commonly encountered. Some jurisdictions adopt NFPA 101; others rely on IBC/IFC language that points to related standards. Confirm, do not assume.
Check accessibility. The ADA Standards for Accessible Design, plus any state accessibility code, affect hardware height, communication features, and whether a delayed-egress device is even usable for people with disabilities. A warehouse office and a hospital public entrance are both in scope in different ways.
Check OSHA egress duties that apply to the employer even when the building official is focused on construction code. Exit routes, panic hardware, and not locking people in are occupational duties. Chaining the warehouse exit is still wrong if the building permit is silent that week.
Read the listing mark on the device , then confirm the listing in the laboratory's product directory (for example UL Product iQ). A reader, lock, power supply, or delayed-egress controller is not “equivalent” because the salesperson said so.
Collect owner standards : corporate security design criteria, healthcare system lock protocols, data-center tenant manuals. Owner standards can be stricter than code. They cannot authorize a less safe egress condition than the AHJ will accept.
Only then look at sector guidance from DHS, CISA, or a regulator, and only after you confirm the facility is actually in that sector and whether the document is voluntary guidance or a binding rule.
Question on site Where to look first What that source is not
Which building/fire code edition applies to this corporate campus? Local AHJ, occupancy permit, municipal or state adoption ordinance A voluntary ASIS standard, a vendor white paper, or last year's survey from another city
Can this hospital door delay egress? Adopted IBC/IFC or NFPA 101 edition, occupancy, AHJ interpretations, sequence of operations A security preference, a camera-system setting, or a copied delay from a warehouse
Must this maglock drop on fire alarm? Adopted fire code, listed releasing devices, fire-alarm matrix, accessibility A fail-secure marketing sheet
Is this electric lock acceptable at all? Listing mark and laboratory directory; AHJ product acceptance An unlabeled import sold as equivalent
What lighting or camera practice does the owner require? Owner security and facilities standards A substitute for code on egress
Is there a federal performance rule for this warehouse? Confirm sector and current regulation; many CISA products are voluntary guidance A brochure treated as a nationwide lock code
What management framework might the owner want? ASIS Physical Asset Protection Standard if the owner purchased and adopted it A replacement for IBC, IFC, NFPA, ADA, or OSHA
Codes and regulations you will actually bump into
IBC and IFC. These model codes, once adopted and amended, drive occupancy, fire-resistance, and many special locking arrangements. Physical security assessors use them as lookup objects , not as novels to quote. Get the adopted edition from the AHJ. Local amendments matter: a city may restrict delayed egress more tightly than the model book.
NFPA 101 and NFPA 72. You will meet them on hospitals, assembly spaces, and fire-alarm matrices that release doors. NFPA 101 is a life-safety reference commonly used in healthcare and other occupancies depending on adoption. NFPA 72 is the usual reference for how detection and notification systems behave, including door release. Read the edition the marshal names. Do not paste handbook commentary into a client report as if you were the code body.
ADA. Accessibility is not optional decoration. Hardware, signaling, and delayed egress that trap or confuse a person with a disability will fail even if a security committee likes the delay. Coordinate with facilities and, in hospitals, with patient-experience and clinical engineering—not only with the integrator.
OSHA egress. Employers must maintain exit routes. A data center that badges every door still needs a legal way out when the badge system is dead. A warehouse that hides an exit behind stored pallets has an operations problem the assessment should record even if the fence is excellent.
Healthcare overlay. Hospitals add CMS conditions of participation and often accreditation life-safety surveys on top of the building code. That overlay is why an assessor who only reads a corporate office lock standard will recommend illegal hardware on a smoke-compartment door. Bring the hospital's life-safety officer into the stakeholder list from section 2.1.
Voluntary standards, listings, and sector guidance
ASIS Physical Asset Protection Standard. This is a voluntary consensus standard . An owner may adopt it as a management framework for identifying assets, assessing risk, and selecting protection. It is not a statute. It does not preempt the fire marshal. It is not a product listing. If the owner has not adopted it, you still look up the adopted code. If the owner has adopted it, you still cannot use it to justify chaining a required exit.
UL listings (and other laboratories). Listings describe tested product performance under defined conditions: access-control units, burglary-resistant electric locking, panic hardware, bullet-resisting glazing, alarm system components, and similar categories. The assessment skill is to read the mark, confirm the model, and see whether the installed application matches the listing (indoor versus outdoor, fire-rated door, delayed-egress accessory). A listing is not a site risk assessment and not a substitute for occupancy rules.
DHS / CISA guidance. Some sectors have federal performance requirements. Many CISA publications are voluntary protective-measure guides. Before you write a warehouse or campus finding that cites a CISA brochure as a mandate, confirm whether a binding rule applies to this facility. Useful guidance can still inform a recommendation; mislabeling it as law damages credibility with the AHJ.
Owner standards. Corporate design criteria, tenant handbooks, and hospital system lock protocols often decide camera placement, badge enrollment, and key control. Put them in the document stack during planning. When owner standard and adopted code conflict on egress, record the conflict and expect the AHJ to win.
Worked conflicts across four facilities
Hospital. Security wants fail-secure maglocks on a behavioral-health smoke-compartment door that is also a required exit. EHS and the fire marshal require release on fire alarm and a legal egress operation. The assessment plan already named EHS as a stakeholder; the survey report should propose listed hardware and a sequence of operations the AHJ will accept, not a memo that elopement risk outranks evacuation.
Data center. Operations wants delayed egress on white-space emergency exits to slow a tailgate. That is a code question for this occupancy and this AHJ, plus a listing question for the delay device, plus an OSHA question if occupants could be trapped during a fire-alarm failure. Measure and ask; do not install a delay because a colocation competitor did.
Warehouse. Loss prevention wants to chain the rear exit on the second shift. OSHA egress and the fire code both object. Functional assessment (section 2.2) should fix the shrink process—seals, cages, dual control—rather than illegal confinement.
Corporate campus. Research wants delayed egress on a lab with chemicals. That door may also be an accessible egress route and part of a hazardous-materials plan. EHS, the AHJ, and the owner laboratory standard all get a vote; the integrator does not get the only vote.
What not to do in reports or exam preparation
Do not paste copyrighted standard text into a client report or a study note as if volume were competence. Do not invent that a specific numbered requirement is on the PSP exam. Do not treat a voluntary ASIS standard, a UL mark, or a CISA brochure as the adopted building code. Do look up the AHJ's edition, the occupancy, the listing, the owner rule, and then write recommendations that occupants can survive.