The ASIS CPP certification, formally known as the Certified Protection Professional (CPP) certification, is one of the most recognized professional credentials in the global security industry. Awarded by ASIS International, the CPP designation demonstrates knowledge and management skills across major areas of security management.
For an experienced security manager, security consultant, security practitioner, or other security professional, the CPP can provide a structured way to demonstrate professional competency across physical security, information security, investigations, personnel security, crisis management, and business operations.
Unlike highly specialized IT-security or information-systems security credentials, the CPP takes a broader security management approach. It addresses both traditional security functions and areas increasingly connected with information assurance, business continuity, incident response, security awareness, and organizational resilience.
What Is the ASIS CPP Certification?
The Certified Protection Professional (CPP) is an ASIS board certification designed for experienced security professionals. ASIS describes the CPP as a credential providing demonstrable proof of knowledge and management skills across seven key domains of security.
The CPP body of knowledge covers areas including:
- Security principles and practices
- Business principles and practices
- Investigations
- Personnel security
- Physical security
- Information security
- Crisis management
The certification is particularly relevant to professionals working as security managers, security directors, security consultants, corporate security professionals, and subject-matter specialists.
Although information security is one component of the CPP, the certification should not be confused with specialized information systems security, cybersecurity, penetration testing, or network security credentials. Its purpose is to demonstrate broader security management competency.
Who Is Eligible for the CPP Certification Exam?
CPP prerequisites are based primarily on professional security experience, education, and experience in responsible charge of a security function.
According to ASIS’s current certification application information, candidates may qualify through one of the following pathways:
- Seven years of security work experience, including at least three years in responsible charge of a security function.
- A bachelor’s degree or higher plus six years of security work experience, including at least three years in responsible charge.
- A master’s degree or higher plus five years of security work experience, including at least three years in responsible charge.
ASIS also provides alternative eligibility pathways for professionals who already hold the APP designation.
“Responsible charge” generally refers to experience involving meaningful responsibility and decision-making authority over a security function.
Therefore, candidates should review the current ASIS requirements carefully before submitting an application. The eligibility requirements are an important part of the CPP certification process and should not be treated as optional prerequisites.
What Does the CPP Certification Exam Cover?
The CPP certification exam evaluates knowledge and practical application across seven security management domains.
The current CPP exam consists of 200 scored multiple-choice questions and 25 unscored questions.
The seven domains are:
1. Security Principles and Practices
This domain addresses fundamental security management concepts, security program development, risk management, security operations, and related practices.
2. Business Principles and Practices
Business principles connect security functions with organizational objectives. Topics can include budgeting, business operations, leadership, management, and strategic decision-making.
3. Investigations
The investigations domain covers investigative principles, procedures, evidence, interviews, investigations management, and related security responsibilities.
4. Personnel Security
Personnel security addresses areas such as background screening, insider threats, employee security, security awareness, and processes designed to reduce personnel-related vulnerabilities.
5. Physical Security
Physical security involves facility protection, security surveys, risk assessment, access control, protective systems, security technology, and countermeasures.
6. Information Security
Information security is an important part of the CPP body of knowledge. The domain includes information security management, information systems security, vulnerabilities, information protection, authentication, encryption, penetration testing concepts, forensic investigations, and security awareness.
This means CPP candidates may encounter concepts familiar to professionals working in infosec, network security, IT-security, and information assurance, although CPP is not primarily a technical cybersecurity certification.
7. Crisis Management
Crisis management addresses preparedness, emergency response, business continuity, crisis communications, recovery, and organizational resilience.
Together, these domains make CPP a broad security certification rather than a narrowly focused technical credential.
CPP Certification and Information Security
Modern security management increasingly overlaps with technology. A security manager may need to understand how physical security, cybersecurity, information systems, personnel, and business continuity interact.
The CPP information security domain includes subjects such as:
- Information security management
- Information systems security
- Security policies
- Risk assessment
- Vulnerability management
- Authentication
- Encryption
- Penetration testing
- Forensic investigations
- Employee security awareness
- Threat mitigation
- Information protection
ASIS’s CPP knowledge statements specifically include ethical hacking and penetration testing, protection technology, forensic investigations, and training and awareness programs addressing threats and vulnerabilities.
However, professionals seeking deeply technical expertise in areas such as penetration testing, network security engineering, vulnerability research, or security analysis may need additional specialized security certifications.
For example, CISSP certification has a different emphasis and is generally associated with broader information security and cybersecurity management knowledge.
How Should You Prepare for the CPP Certification Exam?
Effective CPP preparation should focus on understanding concepts and applying them to realistic security situations rather than simply memorizing definitions.
ASIS specifically notes that its exams are experience-based and recommends using its reference materials to develop knowledge rather than attempting to memorize the reference sets.
A structured preparation strategy can include the following steps.
1. Understand the CPP Body of Knowledge
Start by reviewing the seven CPP domains, tasks, and knowledge statements. This helps you identify your strongest and weakest areas.
2. Study the Recommended Reference Materials
ASIS recommends reference materials including Protection of Assets (POA) and applicable ASIS standards and guidelines. The CPP Study Manual can also help candidates organize their preparation.
3. Use Practice Questions
Practice exams can help you become familiar with the format of the certification exam and identify knowledge gaps. ASIS provides a practice exam containing retired certification questions for this purpose.
4. Focus on Application
The CPP is not simply a test of terminology. Candidates should develop the ability to apply security principles to situations involving risk, investigations, physical protection, personnel security, information security, crisis management, and business operations.
5. Strengthen Weak Domains
Use practice results to determine where additional security training is necessary. A candidate who is strong in physical security but weaker in information security management, investigations, or business principles should allocate additional study time to those areas.
6. Use Hands-On Professional Experience
Professional experience can be particularly valuable because CPP questions require candidates to apply security management knowledge to practical situations.
What Are the Career Benefits of CPP Certification?
The CPP designation can demonstrate professional knowledge and commitment to the security management profession.
ASIS identifies benefits including validating security expertise, gaining global recognition, enhancing career and earnings potential, and achieving professional recognition.
Potential career benefits include:
Professional Credibility
A recognized professional certification can provide employers and clients with an additional way to evaluate a security professional’s credentials and competency.
Career Development
CPP may be relevant to professionals pursuing positions such as:
- Security Manager
- Security Director
- Corporate Security Manager
- Security Consultant
- Security Program Manager
- Security Executive
- Risk and Resilience Professional
The value of the certification will vary according to an individual’s experience, employer, industry, location, and job requirements.
Global Recognition
ASIS International operates a global professional community, and its certifications are designed for security professionals working across different sectors and geographic markets. ASIS states that its board certifications are accredited under ISO/IEC 17024 through the ANSI National Accreditation Board (ANAB).
Professional Network
CPP certification can also connect professionals with the broader ASIS community and opportunities for professional development, education, and knowledge sharing.
How Much Does the CPP Certification Cost?
CPP certification costs depend on ASIS membership status and applicable Emerging Market pricing.
ASIS currently lists the following CPP examination fees:
- ASIS members: $580
- Nonmembers: $910
- Emerging Market 1: $480 for members / $720 for nonmembers
- Emerging Market 2: $460 for members / $680 for nonmembers
ASIS also lists a separate retake fee of $480 for members and nonmembers, with reduced Emerging Market rates. Fees can change, so candidates should verify the current price before applying.
Candidates may also have additional expenses for study manuals, training programs, practice materials, travel, or examination-related costs.
How Long Is the CPP Certification Valid?
The CPP certification is maintained through recertification. ASIS requires certified professionals to complete 60 Continuing Professional Education (CPE) hours during each three-year certification cycle.
CPE activities can include education, instruction, authorship, volunteering, professional service, and other qualifying activities connected to security or business management.
This continuing education requirement helps professionals maintain their knowledge as security practices, technology, threats, regulations, and organizational requirements evolve.
Can You Retake the CPP Certification Exam?
Yes. Candidates who do not pass the CPP exam can retake it subject to ASIS policies.
Current ASIS policy states that candidates may take the examination up to three times during their one-year eligibility period, with at least 60 days between testing dates. A separate retesting fee applies.
Candidates preparing for a retake should review their weaker domains, reassess their study strategy, and focus on understanding the underlying concepts rather than memorizing previous questions.
CPP vs. PSP, CISSP, and Other Security Certifications
Different security certifications address different professional competencies.
CPP focuses broadly on security management and leadership across seven domains.
PSP (Physical Security Professional) focuses specifically on physical security assessment, design, integration, and implementation.
CISSP certification focuses primarily on information security and cybersecurity knowledge.
Other credentials may specialize in investigations, penetration testing, network security, vulnerability management, incident response, or information assurance.
Therefore, choosing a professional certification should depend on your career responsibilities, existing experience, professional goals, and the competencies required in your target role.
Is the ASIS CPP Certification Worth Considering in 2026?
The CPP remains a significant professional credential within security management. ASIS describes the CPP as a certification for experienced security managers and emphasizes its role in validating security expertise and management knowledge.
For an experienced security practitioner seeking a recognized professional designation, the CPP can provide a structured framework for demonstrating knowledge across security operations, business principles, investigations, personnel security, physical security, information security, and crisis management.
However, its relevance depends on the individual’s career path. A professional working primarily in cybersecurity, penetration testing, network security, or vulnerability research may require specialized technical security certifications in addition to or instead of a management-focused credential.
Frequently Asked Questions About ASIS CPP Certification
What is the ASIS CPP certification?
The ASIS Certified Protection Professional (CPP) is a professional certification demonstrating knowledge and management skills across seven key areas of security management.
How many questions are on the CPP exam?
The current CPP exam contains 200 scored and 25 unscored multiple-choice questions.
What are the CPP certification prerequisites?
Current eligibility pathways include seven years of security experience, six years with a bachelor’s degree, or five years with a master’s degree, with at least three years in responsible charge of a security function.
Is CPP an information security certification?
CPP includes an information security domain, but it is broader than a dedicated information security or cybersecurity certification. Its scope covers seven areas of security management.
Does CPP cover penetration testing?
Yes. The CPP information security knowledge statements include ethical hacking and penetration testing techniques and practices.
Is CPP the same as CISSP certification?
No. CPP is focused on broad security management, while CISSP is primarily an information security and cybersecurity credential. Professionals should compare the competencies, prerequisites, and career requirements associated with each certification.
How long does CPP certification last?
The certification cycle is three years. Certified professionals must complete 60 CPE hours during the cycle to maintain their certification.
Can I retake the CPP exam?
Yes. Under the current policy, candidates can take the exam up to three times during their one-year eligibility period, with a minimum 60-day interval between testing dates.
Final Thoughts
The ASIS CPP certification provides an established professional framework for experienced security practitioners who want to demonstrate competency in security management.
Its broad body of knowledge covers traditional security functions as well as modern areas such as information security management, vulnerabilities, security awareness, business continuity, risk management, and organizational resilience.
For professionals pursuing careers as security managers, security consultants, security executives, or other senior security practitioners, understanding the CPP prerequisites, certification exam structure, study requirements, and continuing education obligations is an important first step.
As with any professional certification, candidates should review the latest ASIS requirements before applying because eligibility criteria, fees, examination policies, and other certification requirements can change over time.
