Security professionals moving between physical security, investigations and security management need to know which ASIS International credential matches their experience, because the four ASIS board certifications have very different eligibility rules and exam scopes. ASIS offers the Associate Protection Professional (APP), the Physical Security Professional (PSP), the Professional Certified Investigator (PCI) and the Certified Protection Professional (CPP). This guide compares them using only facts published on ASIS pages and bodies of knowledge, checked on 8 November 2026: who each is for, exam size and domains, eligibility, preparation, fees where ASIS publishes them on the certification page, and recertification. It is written for practitioners in physical, corporate and converged security roles, and for cyber security leaders who manage physical security teams. Where an ASIS page does not state a fact, this guide says so and points to the ASIS Certification Handbook rather than guessing. Certifications are listed from entry level to senior.
Key takeaways
- Four credentials, four career stages. APP is entry level (one year of compensated experience), PSP is for physical security specialists, PCI is for investigators and CPP is the senior security management credential.
- CPP is the broadest exam. 200 scored questions plus up to 25 unscored pre-test questions in four hours, across seven domains from Security Principles and Practices (22%) to Investigations (9%).
- PSP is the technical physical security credential. Its three domains cover assessment (34%), design and integration of systems (35%) and implementation (31%), with 125 scored questions and up to 15 pre-test questions.
- The exams test judgement, not recall. ASIS describes its exams as experience based and advises candidates not to memorise the reference materials.
- Recertification is every three years. ASIS's recertification page states 60 continuing professional education credits per three-year cycle, aligned with the credential's exam domains.
Who the certification is for
ASIS International is a professional association for security management. Its certifications are positioned as board certifications for security practitioners rather than vendor or product credentials. Each requires full-time employment in a security-related role, no criminal conviction that would reflect negatively on the profession, ASIS or the programme, and agreement to the ASIS Certification Code of Conduct and the policies in the Certification Handbook.
| Credential | Positioning on ASIS pages | Typical holder |
|---|---|---|
| APP (Associate Protection Professional) | Entry level: security fundamentals, business operations, risk management, response management | Security officers moving into supervision, analysts, early-career converged security staff |
| PSP (Physical Security Professional) | Physical security assessments, system design and integration, implementing security measures | Physical security engineers, consultants, integrators, site security managers |
| PCI (Professional Certified Investigator) | Case management, evidence collection, reporting and testimony | Corporate investigators, fraud and loss prevention investigators |
| CPP (Certified Protection Professional) | Described by ASIS as the top credential for security management across all areas | Heads of security, regional security managers, CSOs |
For cyber security teams, the relevance is convergence: physical access control, video and identity systems now share networks, directories and credentials. A cyber leader who owns physical security systems benefits from understanding the PSP body of knowledge, and a physical security manager taking on cyber responsibilities benefits from a cyber credential alongside the CPP. See the Physical and cyber security convergence guide.
Exam format and domains
| Credential | Questions | Time | Domains |
|---|---|---|---|
| APP | 100 scored and 25 unscored multiple choice | Not stated on the APP page; see the Handbook | 4: Security fundamentals; Risk management; Business operations; Response management |
| PSP | About 140: 125 scored and up to 15 pre-test, four answer choices each (PSP Body of Knowledge, updated 2022) | Not stated in the body of knowledge; see the Handbook | 3: Physical Security Assessment (34%); Application, Design, and Integration of Physical Security Systems (35%); Implementation of Physical Security Measures (31%) |
| PCI | 125 scored and 15 unscored multiple choice | Not stated on the PCI page; see the Handbook | 3: Professional responsibility; Investigative techniques and procedures; Case presentation |
| CPP | 200 scored plus up to 25 unscored pre-test (up to 225) | Four hours, including pre-test items | 7 (weights below) |
The CPP Body of Knowledge weights its seven domains as follows.
| CPP domain | Weight | What it means in practice |
|---|---|---|
| Security Principles and Practices | 22% | Programme design, policies, metrics, security management fundamentals |
| Physical Security | 16% | Assessment and selection of physical protection measures |
| Business Principles and Practices | 15% | Budgets, business cases, contracts and working with executives |
| Information Security | 14% | Protecting information assets, including the cyber overlap |
| Crisis Management | 13% | Emergency planning, response, continuity and recovery |
| Personnel Security | 11% | Screening, insider risk, workplace violence and executive protection |
| Investigations | 9% | Investigative programme management and evidence handling |
The "what it means" column is this guide's interpretation of the domain names; the authoritative task and knowledge statements are in the CPP Body of Knowledge and the Certification Handbook. ASIS states that APP and PCI exams can be taken at a test centre or remotely proctored. The PSP body of knowledge notes that a 2022 job analysis produced minor changes that began appearing on the exam in late 2023, so use current materials.
Prerequisites and experience
| Credential | Experience requirement (as stated by ASIS) |
|---|---|
| APP | One or more years of related, compensated experience, or six months if you hold a related, approved certification |
| PSP | Three to five years of physical security experience (ASIS certification overview page; the PSP page could not be retrieved, so confirm the degree-dependent split in the Handbook) |
| PCI | Three to five years of investigations experience, including at least two years in case management |
| CPP | Nine years of security experience without a degree, or seven years with a bachelor's degree or higher from an accredited institution; in both cases at least three years in responsible charge of a security function |
The ASIS certification overview page summarises CPP experience as five to seven years, while the dedicated CPP page states seven or nine years depending on degree. Treat the CPP page and the Certification Handbook as authoritative and check both before applying. "Security experience" and "responsible charge" are defined in the Handbook, so read those definitions and document concrete examples from your own roles when you apply.
- Decision guidance: if you have under three years of security experience, APP is the realistic target and builds towards CPP. If your work is assessments, system design and integration, PSP fits better than CPP even if you are senior. If you manage a security function across disciplines and meet the responsible charge requirement, go for CPP. Investigators should take PCI.
- Converged roles: cyber professionals who run physical security systems often meet PSP experience through work on access control and video platforms, but should check that their experience counts as physical security under the Handbook definitions.
Preparation plan
ASIS lists its own reference materials for each exam. For CPP: Protection of Assets (POA), the ASIS standards CSO, ORM.1 and WVPI.1, the guidelines FPSM, GSRA, IAP and PBS, and a practice exam of retired items. For APP: five standards (including Physical Asset Protection PAP-2021, Workplace Violence Prevention and Intervention WVPI AA-2020 and Security Risk Assessment SRA-2024), three Protection of Assets volumes, the APP Study Manual and flash cards. For PCI: Protection of Assets Investigations (2021), the Investigations Standard, the PCI Study Guide, flash cards, a practice exam and a practice test. ASIS also points to certification review courses and local chapter study groups.
- Confirm eligibility first: read the Certification Handbook, map your experience to its definitions and write down examples of responsible charge or case management before paying anything.
- Baseline: take the ASIS practice exam (retired items) to find weak domains. Weight study time by domain weight and by your gap, not evenly.
- Study by domain: work through the reference set domain by domain. ASIS warns against memorising; instead, for each topic ask how you would apply it at your own site.
- Apply to your workplace: for PSP, run a structured assessment of one of your own sites; for CPP, write a short business case and crisis plan outline; for PCI, review a closed case against the Investigations Standard.
- Join a group: chapter study groups and review courses help with the judgement-style questions that dominate these exams.
- Final review: retake the practice exam, revisit weak domains, and read the exam-day guidance on check-in procedures and results on the ASIS site.
A realistic plan for a working practitioner is several months of steady study, adjusted to your experience in the heaviest domains. ASIS does not publish a recommended study duration on the pages checked.
Cost, renewal and continuing education
| Item | What ASIS states |
|---|---|
| CPP exam fee | USD 300 for ASIS members, USD 450 for non-members, USD 200 retake (CPP page) |
| APP, PSP, PCI exam fees | Not listed on the pages checked; the Certification Handbook covers fees |
| Recertification cycle | Every three years |
| Continuing education | 60 continuing professional education (CPE) credits per cycle, aligned with the credential's exam domains |
| Recertification fee | USD 70 for members and USD 90 for non-members on the recertification page at the time of checking; late fees apply |
| Lapse | After the 31 December deadline a grace period applies; if no application is submitted in time the exam must be passed again |
The ASIS recertification page contains both a one-year grace period description and a note that from January 2019 the lapsed period was shortened to three months, so confirm the current grace period in the Recertification Guide or the Handbook rather than relying on either figure. Applications can be submitted in the second or third year of the cycle. Membership changes the exam fee for CPP by USD 150, so check whether ASIS membership pays for itself before booking.
CPE credits that also count towards cyber credentials (for example convergence, information security or crisis management training) can reduce the overall burden for people who hold both an ASIS certification and a cyber certification, but check each body's rules on what qualifies.
Where it fits on the career path
| Career stage | ASIS credential | Complementary credentials |
|---|---|---|
| Entry to supervisor | APP | Vendor training on the access control and video platforms you run |
| Physical security specialist or consultant | PSP | Network and OT security fundamentals for converged systems |
| Investigator | PCI | Digital forensics training for cases with electronic evidence |
| Security manager to CSO | CPP | A cyber security management credential where the role includes cyber |
Converged security leaders often pair CPP with a cyber management certification. See the Physical Security Manager Career Guide for the wider route. ASIS pages do not publish salary or pass-rate data, so this guide makes no claims about either.
- Value for employers: the credentials give a common vocabulary for security risk assessment, physical protection design and crisis management, which helps when physical security and cyber teams share responsibility for access control, video and identity systems.
- Value for cyber teams: the PSP domains on application, design and integration of physical security systems are where physical security meets networks, directories and credentials, the same ground covered in the Physical Access Control Systems Security Guide.
Practitioner checklist
- Pick the credential that matches your current work: APP for entry level, PSP for physical security design, PCI for investigations, CPP for security management.
- Read the ASIS Certification Handbook and confirm eligibility, especially the CPP responsible charge requirement.
- Check current fees in the Handbook and whether ASIS membership reduces your total cost.
- Buy or borrow the ASIS reference set for your exam and take the practice exam first.
- Weight study by domain percentage and your own gaps.
- Practise applying concepts to your own site rather than memorising references.
- After passing, plan 60 CPE credits across the three-year cycle and track them as you go.
- Confirm the current recertification grace period with ASIS before your first deadline.
Standards and references
- ASIS International: Certification
- ASIS International: Certified Protection Professional (CPP)
- ASIS International: CPP Body of Knowledge
- ASIS International: PSP Body of Knowledge
- ASIS International: Associate Protection Professional (APP)
- ASIS International: Professional Certified Investigator (PCI)
- ASIS International: Recertification
Related NHI Mgmt Group resources: Physical and cyber security convergence · Physical Security Manager Career Guide · Physical Access Control Systems Security Guide