Study guide
6.1 Risk Analysis Strategies, Principles & Data Interpretation
ASIS Physical Security Professional PSP
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PSP Exam Facts 1.2 Eligibility, Fees, Scheduling & Recertification 1.3 Experience-Based Testing, References & Study Approach
2 Assessment Planning & Methods
2.1 Assessment Plan, Stakeholders, Budget & Resources 2.2 Inside-Out, Outside-In, Site-Specific & Functional Models 2.3 Qualitative vs Quantitative Assessment Methods 2.4 Standards, Regulations, Codes & Where to Find Them
3 Asset Identification & Valuation
3.1 Asset Types, Terminology, Value, Criticality & Loss Impact 3.2 Valuing Tangible and Intangible Assets for Operations 3.3 Criticality, Key Areas & Loss-Impact Prioritization
4 Threats, Hazards & Operating Environment
4.1 Criminal, Terrorist, Insider & Sociopolitical Threats 4.2 Natural Disasters, Accidental & Cyber-Physical Hazards 4.3 Geography, Crime, Socioeconomics & Existing Countermeasures 4.4 Neighbors, Competitors, Legal, Reputation & Supply Chain
5 Vulnerability Assessment & Surveys
5.1 Surveys, Interviews, Incident Data, Crime Stats & Benchmarking 5.2 Evaluating Technology, Personnel & Procedures 5.3 Plans, Schematics & Environmental/Site Factors
6 Risk Analysis & Countermeasure Selection
6.1 Risk Analysis Strategies, Principles & Data Interpretation 6.2 Threat/Hazard–Vulnerability Pairing & Loss Event Profiles 6.3 Matching Countermeasures to Specific Risks 6.4 ROI, Total Cost of Ownership, Privacy, PII & Life Safety
7 Performance Requirements & Security Concepts
7.1 Design Constraints & Incorporating Risk Analysis 7.2 CPTED, Defense-in-Depth, 4 Ds & Security Terminology 7.3 Operational, Functional, Performance Requirements, Codes & Metrics
8 Structural Measures & CPTED Application
8.1 Fences, Gates & Perimeter Barriers 8.2 Blast Mitigation, Ballistic Protection & Hostile Vehicle Mitigation 8.3 Lighting, Locks, Doors, Windows & Glazing 8.4 Applying CPTED to Site Planning & Landscaping
9 Electronic Security Systems
9.1 Electronic Access Control Architecture & Credentials 9.2 Biometrics, Electrified Locks, Anti-Passback & Mantraps 9.3 Video Surveillance Design, Storage & Analytics 9.4 Intrusion Detection Sensors & Alarm Communications
10 Screening, Communications, Power & Networks
10.1 Personnel, Package & Vehicle Screening and Visitor/Vendor Policy 10.2 Mass Notification, Audio Comms, Consoles & Central Stations 10.3 Data Storage, Retention, PII & Physical Network Security 10.4 Primary/Backup Power and Copper, Fiber & Wireless Transmission
11 System Design & Project Documentation
11.1 Pre-Design, Schematic, Construction Docs, Calculations & Drawings 11.2 CSI MasterFormat, Owner Standards & AIA MasterSpec 11.3 Systems Integration, Scheduling, Cost Estimation & Value Engineering
12 Pre-Bid Meetings & Solicitation Packages
12.1 Site Visits, RFIs, Substitution Requests & Pre-Bid Meetings 12.2 RFP, RFQ, IFB & Sole Source 12.3 SOW, Timelines, Costs, Personnel & Documentation 12.4 Evaluation Criteria, Technical Compliance & Contracting Ethics
13 Procurement Planning & Vendor Selection
13.1 Procurement Process for Security Goods & Services 13.2 Interviews, Due Diligence, References & Selection 13.3 Project Management Functions in Procurement
14 Installation, Commissioning & Acceptance
14.1 Installation & Inspection Techniques 14.2 Commissioning & Implementation-Phase Integration 14.3 FAT, SAT & Final Acceptance Testing Criteria 14.4 Punch Lists, As-Builts, Config Management & End-User Training
15 Security Personnel Requirements
15.1 Roles, Limits, Proprietary vs Contract Staffing 15.2 Recruiting, KPIs, Discipline & Professional Development 15.3 Post Orders, Uniforms/Equipment & Non-Security Awareness
16 Lifecycle Maintenance & Program Evaluation
16.1 Preventive/Corrective Maintenance, Calibration, Service Agreements & Warranties 16.2 Upgrade Training, System Evaluation & Replacement
6.1 Risk Analysis Strategies, Principles & Data Interpretation
Key Takeaways Explain This Topic AI
Inherent risk is the loss-event pairing before credit for measures as they actually operate; residual risk is what remains after selected treatments work
Qualitative matrices rank named loss events; they do not mint dollars or replace a written how
Semi-quantitative 1–5 products only order conversations; treating the product as currency is fake precision
Treatment is avoid, mitigate, transfer, or accept with a named owner; monitor then feeds the next analysis cycle
- Interview stories are leads: test them against logs, observation, and drawings before they move a matrix cell
- Last updated: September 2026
Risk Analysis Strategies, Principles, and Data Interpretation
By the time Domain 1 Task 5 begins, the team already holds an asset list, a threat and hazard picture, a vulnerability survey, and a stack of notes. Risk analysis is the step that turns that stack into decisions: what is inherent, what is residual after treatment, and which treatment is honest. Independent ExamFinch teaching for published PSP Domain 1 tasks is that analysis is not a second walkthrough and not a catalog of cameras. It is a disciplined read of evidence against a short set of risk-management principles.
Exam focus: Rate the pairing, not the building. Separate inherent from residual. Let logs and observation test stories before a matrix cell moves.
Three Analysis Strategies You Will Actually Use
Physical security teams rarely get a clean laboratory. You still have to choose a strategy that matches the quality of the data you collected in Task 4.
Qualitative matrices
A qualitative matrix —commonly 3×3 or 5×5—plots likelihood against consequence using ordinal labels such as low, medium, and high. Color bands help leadership see concentration. Use a matrix when you must rank many loss events in one picture and when dollar history is thin. The matrix does not create facts. It displays a judgment you still have to defend with a named threat or hazard, a named vulnerability, and a named consequence.
The professional trap is scoring the site as one cell. A campus is not a loss event. Score pairings: the pharmacy after hours, the dock at shift change, the generator room in a flood. A second trap is moving a cell because a vice president wants a red square for budget theater. If the evidence did not change, the cell should not change.
Semi-quantitative scoring
Semi-quantitative work assigns numbers—often 1–5 for likelihood and 1–5 for consequence, sometimes with a detectability or existing-control factor—and multiplies or adds them into a rank. Those numbers remain ordinal. A 20 outranks an 8. It is not twenty dollars of expected loss and it is not a calibrated probability. Chapter 2 already treated workshop scores as ranking tools, not currency. Task 5 uses the product only to order treatment conversations. After the rank, write residual risk in words, or in dollars where incident history and asset values actually support dollars.
If two events both score 16, do not pretend the arithmetic settled which one to treat first. Read the how. A 16 that kills people outranks a 16 that steals landscaping equipment, even when the spreadsheet is blind to that distinction.
Scenario workshops
A scenario workshop walks a small cross-functional group through a timed story: if this adversary or this hazard meets this weakness, what happens in the first hour, the first day, and the first week? Workshops catch sequences a matrix cell hides. A flood that also kills the video system that would have documented looting is one event, not two unrelated rows. Keep the room small, time-boxed, and tied to assets you already valued. Facilities, operations, IT, EHS, and a security lead belong there. A vendor who needs to sell a platform does not belong in the scoring chair.
Do not let the loudest story set the score. The night supervisor’s single frightening encounter is a lead for verification, not an automatic “critical” rating for the whole perimeter.
Strategy What it produces Use it when Do not use it to
Qualitative matrix Ordinal rank of named pairings Many events, thin dollar history, leadership picture Invent a budget in dollars
Semi-quantitative score Ordered list from 1–5 factors You need a consistent ranking rule across sites Treat 12.0 as a probability or as cash
Scenario workshop Timed sequence of failure Complex chains, rare events, cross-system effects Replace logs and a site walk with conference-room folklore
Risk-Management Principles: Identify, Analyze, Evaluate, Treat, Monitor
Physical security risk work follows a cycle that enterprise risk programs also use, even when the forms differ.
Identify — assets, threats and hazards, vulnerabilities, and existing measures. Tasks 1–4 already did this labor. Analysis that re-identifies “the facility” as one blob has gone backward.
Analyze — estimate likelihood and consequence for each credible pairing. Separate inherent risk from residual risk. State assumptions (hours of operation, whether a camera is actually watched, whether a generator has fuel).
Evaluate — compare analyzed risk to the organization’s risk appetite and to a legal and life-safety floor. Appetite is a leadership choice. The floor is not. You do not evaluate a blocked exit into “accepted residual.”
Treat — avoid, mitigate, transfer, or accept, with a named owner and a due date. Treatment without an owner is a wish.
Monitor — incidents, tests, occupancy changes, new neighbors, failed maintenance, and bypassed procedures. Monitor is not a courtesy close-out paragraph. It is the feed that sends you back to analyze.
Skipping evaluate produces “we should buy everything on the integrator’s list.” Skipping monitor produces a report that was true on Tuesday and false after a remodel moved the dock office.
Inherent Risk Versus Residual Risk
Inherent risk is the risk of a loss-event pairing before you credit the countermeasures you are counting on, or the risk if those measures fail as designed. Residual risk is what remains after selected treatments are in place and operating. Exam items punish mixing the two.
If you rate a pharmacy as “low” solely because a camera exists, you have already jumped to residual—and you may be wrong even there, because a camera that nobody watches does not detect. State inherent first: high-value stock, public corridor, night hours, single-leaf door, key in an unlocked desk. Then state residual after lock hardware, alarm, dual-control procedure, and a watched or alarmed camera path.
Residual assumes as-operated , not as-specified. A maglock on a drawing that staff wedge open every delivery does not reduce residual risk. A central-station contract that expired last quarter does not reduce residual risk. Write the bypass in the analysis; do not hide it inside a green cell.
Four Treatments, Used on Purpose
Avoid — do not start, or stop, the activity that creates the pairing. Do not store bulk lithium cells in a basement flood zone. Do not put a public clinic waiting room on the same leaf as a cash vault door. Avoidance is a business decision with a security input, not a locksmith trick.
Mitigate — reduce likelihood, consequence, or both with structural, electronic, procedural, or personnel measures. Mitigation is the usual PSP recommendation. It is not the only honest one.
Transfer — insurance, indemnity, landlord duties, or shared operations. Read exclusions. Transfer rarely moves life-safety duty off the occupancy. A policy that pays for stolen laptops does not treat a blocked exit.
Accept — residual sits inside appetite, an accountable owner signs, and monitoring continues. Acceptance without a name is neglect dressed as a meeting minute.
Treatments can stack. You may mitigate a dock and still transfer a slice of cargo theft through insurance. You may accept a low-value landscaping-shed pairing while you refuse to accept an inherent life-safety pairing.
Interpreting Survey Data Without Drowning in Anecdotes
Task 4 collection gives you interviews, photographs, incident logs, crime statistics, drawings, and direct observation. Anecdotes are leads, not ratings. Three night-shift stories about a “creepy guy at the fence” send you to the logs, the lighting, and the fence line. If three years of incident data show zero fence events and the fabric and lighting are intact, you do not inflate residual to “critical” so a camera package will pass a budget committee. If the logs are empty because nobody records events, the empty log is itself a vulnerability in the monitoring step.
Practical rules that keep analysis honest:
Weight contemporaneous records and what you saw on the walk higher than remembered stories, then still verify a vivid story that might reveal an unlogged tailgate.
National or citywide crime rankings do not set a cell for this dock. They may support a workshop conversation about likelihood; they do not replace site history.
When qualitative rank and a dollar estimate disagree, write why. Do not average them in a hidden cell.
One photograph of an unlocked IT closet is evidence. Twenty photographs of the same closet are not twenty times the risk.
After-hours observation often contradicts daytime interviews. If the attendant “always” staffs the dock, watch a shift change.
- Evidence What it can support What it cannot do alone
- Interview story A lead, a process gap, a morale signal Set residual to critical
- Incident log Likelihood, repeat hows, hours of day Prove that unreported events did not happen
- Direct observation As-operated bypass, lighting, staffing Replace a three-year trend by itself
- Crime ranking Context for a workshop Score this loading dock
- Drawing or as-built Intended hardware and power path Prove the device still works
The output of 6.1 is not a purchase order. It is a ranked set of pairings, each with inherent and residual language, a treatment posture, and a paper trail that a later auditor or an exam item can follow. The next section writes those pairings as loss-event profiles. The diagram below is the cycle you are scoring against, not a slogan for the report cover.