7.2 CPTED, Defense-in-Depth, 4 Ds & Security Terminology

CPTED, Defense-in-Depth, the 4 Ds, and Security Terminology

Independent OpenExamPrep teaching for published PSP Domain 2 Task 1 knowledge is that design vocabulary is not decoration. Crime Prevention Through Environmental Design (CPTED), defense-in-depth, and the 4 Ds (deter, detect, delay, deny) are how you shape space and systems so a residual pairing is harder to complete. Respond is the operational companion: people and procedures that interrupt or recover. A short set of project terms—punch list, field test, as-built, substantial completion—will return in Domain 3; you need the names now so a design document does not pretend commissioning already happened.

Exam focus: Name the four CPTED ideas in Newman/Jeffery practitioner framing. Draw layers, not one super-device. Keep respond with people. Do not confuse a punch list with a finished design.

CPTED: Newman, Jeffery, and four practitioner ideas

C. Ray Jeffery used the phrase Crime Prevention Through Environmental Design for a broad criminological claim: the built environment can reduce opportunity for crime. Oscar Newman’s defensible-space work gave practitioners a spatial language: people protect places they feel they own, can see, and see as cared for. PSP-style items do not ask you to recite a biography. They ask you to apply four ideas that field designers actually specify.

Those four ideas are natural surveillance, natural access control, territorial reinforcement, and maintenance/image. Other CPTED lists add activity support or milieu as extra headings. For this independent guide, keep the four named above as the working set. If an exam stem gives a fifth label, map it to the same spatial tests: can people see, is the intended path the easy path, does the place look owned, and is that still true after six months of weather and staffing.

Natural surveillance

Legitimate users and passersby can see the approach, and an adversary can tell that the approach is seen. This is sight lines, window placement, lighting that supports seeing (not glare on a camera dome), trimmed landscaping, and a receptionist’s desk that actually faces the door. A camera is not automatic natural surveillance. A camera that nobody can use as a human view, behind a hedge, is electronics pretending to be CPTED. Natural surveillance is the human ability to observe as a product of form.

Worked lobby: a solid vestibule with a blank wall toward the street hides the reception desk. An adversary can close the last ten meters unseen. Opening a vision panel, pulling the desk to the glass, and lighting the threshold so faces are readable is CPTED. Bolting a camera under the soffit while the desk still faces the copy room is not.

Worked parking structure: columns and parked vans create concealment pockets. Natural surveillance here is bay spacing, paint and lighting that reduce deep shadow, and pedestrian paths that pass occupied storefronts rather than a dead alley. A single camera at the elevator lobby does not see the concealment pocket on level three.

Natural access control

Movement is guided by the design of paths, not only by a posted officer. Fences, hedges, pavement changes, door placement, and the difference between a public sidewalk and a staff court tell people where they are supposed to walk. Natural access control reduces the number of places you must put a lock. It does not replace a lock on a high-residual opening. A pretty hedge that still leaves a straight vehicle run at unrated glass is landscaping, not access control.

Worked campus: visitors used a service drive because the “main” walk was longer and poorly lit. Relocating the visitor path, lighting it, and closing the service drive with a gate that only docks use is natural access control. Adding a second camera on the old shortcut while leaving it open is not.

Worked clinic: a public corridor that also feeds the pharmacy anteroom invites wandering. Moving public waiting to a different wing, and giving the anteroom a single controlled leaf, is natural access control. A rope stanchion that staff take down at lunch is not.

Territorial reinforcement

Cues of ownership: paving, truthful signage, fencing that marks a boundary without creating a climbing ladder into a window, maintained thresholds, a change of material from public sidewalk to private court. Territorial cues support the feeling that this is someone’s, and someone will notice. Fake “24-hour surveillance” signs when the recorder is unplugged train insiders to ignore territorial claims. A fence that looks like a property line but has a missing panel at the dumpster is a territorial cue that contradicts itself.

Newman’s point was not “build a fortress aesthetic.” It was that ambiguous space—nobody’s sidewalk, nobody’s court—gets less guardianship. Design the change of place so a visitor knows when they have left the public realm.

Maintenance and image

Newman’s image point and later “broken windows” practice meet here: a site that looks abandoned invites testing. Burned-out lamps, graffiti left for months, a propped door that is never repaired, and a fence fabric that flaps in the wind all say the owner is not present. Maintenance is a CPTED measure, not janitorial leftover. If the design specifies lighting for natural surveillance and the lamps are dead, the CPTED function is gone even though the drawing is still pretty.

Image also includes the honest appearance of control. A manned booth that is empty, a camera housing hanging by a cable, and a keypad with worn digits that everyone in the neighborhood knows, are image failures that increase probing. Specify a maintenance responsibility when you specify the device. Domain 3 and Chapter 16 will pick up warranties and preventive work; Task 1 needs you to stop designing measures that only work on opening day.

CPTED is not a reason to omit electronic or structural measures on a high-residual asset. It is the site-planning layer that makes those measures cheaper and more likely to be used. A nursery still needs controlled openings. A stockroom still needs a latch. CPTED is how you stop designing a fortress in a parking lot that nobody can see.

Defense-in-depth: concentric layers

Defense-in-depth means an adversary must defeat successive, independently useful layers before the asset is lost. Layers are typically site/perimeter, building envelope, interior circulation, and the asset container (cage, safe, cabinet, vault). Each layer should still do some work if the layer outside it fails. Three identical cameras looking at the same lobby tile are not three layers. They are one detection idea with redundant glass.

Independently useful is the test. If the fence is only a line on a civil drawing and the gate stands open, you do not have a perimeter layer. If the envelope door is latched but the interior cage is a rope, you do not have an asset layer. If the “layer” is a single maglock whose power supply sits in an unlocked closet, the layer has a trivial bypass.

Concentric does not mean circular on a cartoon. A loading dock may be the weak sector of an otherwise decent envelope; that sector needs its own inner measures. Heritage sites may put the strong layer inside because the facade cannot take hardware. Retail may put delay at the stockroom rather than at the public leaf, because the public leaf must stay welcoming. The diagram is a thinking tool: what is still true if this ring fails?

Worked hospital: the public lobby is welcoming (weak delay, strong natural surveillance and a receptionist). The envelope still latches after hours. The pharmacy is an interior layer with ACS and dual control. Narcotics sit in a container layer. If a tailgater beats the lobby, the pharmacy leaf and the container should still deny. If you spent the entire budget on lobby analytics and left the pharmacy on a classroom lock, you do not have depth. You have a show ring.

Defense-in-depth also prevents the catalog fantasy of one silver product. Analytics at the fence do not replace a lock on the pharmacy. A lock on the pharmacy does not replace a person who can respond when the contact goes into alarm. Layers are mixed families: CPTED and lighting at the site, structure at the envelope, electronics and escorts inside, containers at the asset, people at respond.

The 4 Ds as design intents, respond as operations

Chapter 6 used deter, detect, delay, deny, and respond as selection logic. Domain 2 uses the first four as design intents you can draw and specify. Respond remains an operational function: officers, console operators, dock attendants, supervisors, and the procedures they follow. You design so respond has time (delay) and information (detect). You do not design respond by writing “call the police” on a title sheet.

Deter. Make the pairing look unattractive before it starts: real lighting, real territorial cues, a post that is actually present, hardware that looks like it will work because it will. False deterrence—stickers for a dead system—is a CPTED-image failure and an operations failure.

Detect. Someone or something knows the event is happening in time to act. Recording is not detecting. A door contact that reports to an empty room is not detecting. Design detect to a named person or a named console with a stated time. Section 7.3 will turn that time into a performance number.

Delay. Consume adversary time after detection so respond can arrive. Locks, fences, safes, distance, mantraps where the occupancy and residual actually warrant them. Delay without detect is a silent clock. Detect without delay is a loud clock with no seconds on it. Delay on a required egress path still has to survive Chapter 6’s life-safety floor.

Deny. The asset is not reachable along that how: a credential that will not open the lab, a cabinet that will not open without dual control, a vehicle that cannot reach the glass. Some programs fold deny into delay. Independent teaching for published PSP tasks still expects you to say when access is not granted, versus merely slowed.

Respond. People and procedures. Preview: Domain 2 Task 2.4 and Chapter 15 treat staffing as a countermeasure family, not as leftover labor. If the design assumes a 30-second officer arrival and the post is 400 meters away on a bicycle, the delay budget is fiction.

The 4 Ds are not a sequence you must buy in order from a brochure. A vault may deny first. A public plaza may deter and detect with almost no delay. Match functions to the residual pairing, then layer them so a single device failure is not the whole story.

Project terminology you will need before Domain 3

These words show up on drawings, meeting minutes, and exam stems. Details of how you run them live in Domain 3 (especially Chapter 14). Learn the distinctions now so you do not treat them as synonyms in a design narrative.

Punch list. Remaining deficiencies after inspection or testing: a strike that will not latch, a camera aimed at a wall, a missing end-of-line resistor. A punch list is evidence the work is not finished. Designing “we will punch it later” is not a substitute for a specified function.

Field test. On-site demonstration that a specified function actually occurs: the door latches in the stated time, the alarm prints at the named console, the camera supports the stated identification task at the named plane. Field tests are how performance requirements become pass/fail. Domain 3 will teach factory versus site versus final acceptance. Here, know that a design you cannot field-test is not yet a requirement.

As-built. Record drawings and schedules that show what was actually installed, including pathway routes and device addresses that drifted from the schematic. Designs should require as-builts because the next assessment (Domain 1 again) will need them. An as-built is not a license to install whatever the technician had on the truck.

Substantial completion. A construction concept: the work is sufficiently complete for the owner to occupy or use it for its intended purpose, even if punch items remain. Security programs get hurt when someone declares substantial completion before field tests pass on the openings that carry residual risk. Preview only: Domain 3 will teach you not to sign as if testing were optional. Domain 2’s job is to write requirements clear enough that “substantial completion” cannot hide a dead detect path.

Keep CPTED, layers, 4 Ds, and these terms in one mental picture: you shape the site so people can see and belong, you stack independently useful rings, you assign deter/detect/delay/deny to those rings, you staff respond, and you write functions that a field test can fail. Section 7.3 turns that picture into operational, functional, and performance sentences.