Free ASIS CPP Exam Flashcards

Security decisions should protect assets that enable the organization's mission. Asset owners own the risks, while security professionals facilitate risk decisions and align safeguards with business priorities.

Governance assigns decision rights, accountability, escalation paths, and oversight. Without it, controls may exist but no one clearly owns risk acceptance, resources, or corrective action.

Evaluate the business need, accuracy, bias or privacy exposure, cybersecurity, interoperability, failure modes, human oversight, and full lifecycle cost. New capability must not create unmanaged risk.

Use qualitative ratings when reliable loss data are limited or rapid prioritization is needed. Quantitative analysis is stronger when credible frequencies and financial impacts support numerical comparison.

Threat describes a potential harmful actor or event, vulnerability is a weakness it could exploit, and consequence is the resulting impact. A defensible assessment considers all three rather than treating any one as risk by itself.

It is a secondary hazard created by an initial event, such as civil disorder after a prolonged outage. Planning should examine cascading effects, not only the initiating incident.

Avoidance stops the risky activity; acceptance knowingly retains the risk; transfer shifts defined financial or operational consequences; mitigation reduces likelihood or impact. The residual risk still needs an owner.

It compares documented requirements with actual performance, records evidence and gaps, assigns corrective owners and dates, and verifies closure. A finding alone does not improve the program.

An activity metric counts work performed, such as training sessions. An outcome metric shows the effect, such as fewer reporting errors or faster response, and is more useful for judging program value.

Liaisons create trusted channels before an incident for information sharing, coordinated planning, resource access, and jurisdictional clarity. Contact lists alone are not working relationships.

Set observable objectives, measure knowledge and behavior, analyze incident or reporting trends, and adjust content for different roles. Attendance proves delivery, not effectiveness.

Use funds for authorized purposes, maintain accurate records and approvals, protect assets, disclose conflicts, and support auditability. Good intentions do not replace financial controls.

Compare actual results with the approved plan, explain material differences, forecast their effect, and take or propose corrective action. Variance analysis is a management tool, not merely a year-end report.

A policy states management intent, requirements, and accountability; a procedure gives the ordered steps for carrying it out. Procedures should trace to policy and remain workable at the operating level.

It is tied to a defined objective, uses reliable data, has an owner and target, and encourages the intended behavior. A convenient count can be misleading if it rewards speed at the expense of quality or risk.

Job analysis identifies essential duties, competencies, authority, and working conditions. It supports defensible selection criteria, relevant screening, training plans, and performance measures.

It identifies critical roles, potential successors, competency gaps, and development actions before a vacancy. The goal is continuity of capability, not simply naming a backup.

Leaders set clear conduct expectations, model them, protect confidential information, provide safe reporting channels, investigate consistently, and apply consequences without favoritism.

Define the service, performance standard, measurement method, reporting interval, escalation process, remedies, and responsibilities. Monitoring those terms turns a vendor promise into manageable performance.

Define the allegation, objectives, scope, authority, legal or policy constraints, resources, evidence sources, roles, milestones, and reporting path. The plan should also protect independence and confidentiality.

Identify the item, collector, date, time, location, condition, packaging, every transfer, purpose, and final disposition. Each handoff should show who controlled the evidence and when.

Confirm lawful authority, necessity, proportionality, scope, privacy limits, data handling, operator competence, and approval. Capabilities such as drones or robotics do not remove legal and ethical constraints.

Match the allegation and evidence to needed expertise, independence, legal authority, tools, and preservation methods. Cyber, financial, intellectual-property, and violent-crime matters may require different specialists.

Use a planned, lawful, noncoercive approach; account for language and culture; ask open questions before specifics; document accurately; and preserve required rights. Seek counsel when legal exposure exceeds the investigator's authority.

Tie each check to job-related risk, obtain required consent, use reliable sources, protect the data, and apply criteria consistently. More intrusive screening is not automatically more defensible.

Promotion, retention, or assignment to a sensitive role can change the risk and required trust level. Any rescreening must follow law and policy, be job related, give notice where required, and protect confidentiality.

No reliable demographic profile predicts violence. A multidisciplinary team should evaluate concerning behavior, context, capability, stressors, protective factors, and changes over time, then select proportionate interventions.

Provide traveler briefing, tracking and contact methods, medical and evacuation options, escalation triggers, local support, and a response protocol. Risk intelligence is useful only when it drives decisions and assistance.

A current threat and vulnerability assessment should drive protective intelligence, advance work, transportation, staffing, communications, medical support, and liaison. The proprietary-versus-contract choice follows requirements and risk.

Combine document review, site observation, interviews, system records, tests, and asset or threat data. A checklist organizes the work, but evidence and analysis support the findings.

Renovations, undocumented pathways, changed uses, and disabled devices can make drawings inaccurate. Field validation reveals dependencies and gaps that a desk review can miss.

It compares current safeguards and performance with risk-based requirements or an approved target state. The resulting gaps should be prioritized by risk, feasibility, and dependency.

Detection must provide enough reliable warning, and barriers must delay the adversary long enough for an effective response to arrive and intervene. A strong barrier alone may only postpone an unopposed loss.

Choose a layered mix that addresses identified threats and vulnerabilities, meets legal and operational needs, integrates with existing systems, and produces acceptable residual risk at sustainable lifecycle cost.

Assign automation to consistent sensing, logging, and control while preserving trained people for judgment, communication, exception handling, and response. Staffing and technology must be designed as one operating system.

Define measurable requirements, interfaces, test cases, documentation, training, defect resolution, and acceptance authority in the procurement package. Factory, site, and commissioning tests should trace to those criteria.

Predictive maintenance uses condition data to anticipate failure; preventive maintenance follows planned intervals; corrective maintenance restores a failed or deficient asset. A resilient program deliberately combines them.

It examines physical, procedural, personnel, system, awareness, destruction, and recovery controls together, then traces data flows and dependencies across facility and network boundaries.

Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized or undetected alteration, and availability keeps information and services accessible when needed. Controls may support more than one objective.

It suspends routine destruction for information potentially relevant to a legal or regulatory matter. The organization should identify custodians and systems, preserve content and metadata, document actions, and release the hold only with authority.

Classification ties sensitivity, value, legal duties, and business impact to handling rules. It lets the organization apply proportionate access, storage, transmission, retention, and destruction controls.

It uses independent factor categories, such as something known, possessed, or inherent. Two passwords are two credentials of one factor type, so they do not provide true multifactor authentication.

Encryption transforms data with a cryptographic key and can be reversed by an authorized holder. Masking obscures selected values for display or use; depending on the method, it may be irreversible.

Obtain written authorization and define scope, timing, methods, excluded assets, data handling, stop conditions, contacts, reporting, and remediation ownership. Testing without these rules can itself create an incident.

Compare credible likelihood, consequences, vulnerabilities, dependencies, and existing capability, then consider the cost and effect of mitigation. Rare but catastrophic events may still demand preparation.

It identifies critical activities, dependencies, impacts over time, and acceptable disruption, helping leaders set recovery priorities and resource needs. It does not estimate how likely each threat is.

It builds common capabilities—command, communications, accountability, resource management, and recovery—that work across many events, while hazard-specific annexes address unique actions such as CBRNE controls.

Define activation authority, resources, command relationships, communications, qualifications, cost and liability terms, logistics, and demobilization. A verbal expectation may fail when every party is under pressure.

Incident command directs tactical operations at or near the incident. The EOC supports coordination, policy, information, and resource allocation across the organization; it should not create competing tactical command.

Restore priority operations, support affected people, document decisions, and use damage assessment and after-action findings to correct root causes. Rebuilding the same vulnerability only restores the prior risk.