ASIS PSP Study Guide - Chapter 2 Deep Dive

 This deep dive explores how organizations should treat their security programs as a proactive, continuous process instead of a static physical object. The exam breaks down the risk assessment process into six steps: identifying and valuing assets, identifying threats, determining vulnerabilities, conducting an impact analysis, and mitigating risks. The acronym "ATV am" helps candidates remember the order. It also explains the difference between threats, vulnerabilities, and hazards, and how to measure vulnerabilities based on observability and exploitability. Risk management helps to identify and mitigate potential threats to a company's assets. This process involves categorizing the assets, threats, and vulnerabilities, and then prioritizing them based on their impact and likelihood. A risk assessment may use both qualitative and quantitative methods, and there are five ways to address risk: avoidance, spreading, transfer, reduction, and a combination of all of these. When selecting and implementing measures to reduce risk, it is important to consider budget, psychological impact, and the capabilities of Chapter two of the Certified Physical Security Professional (PSP) exam covers risk assessment and security surveys. The difference between the two is that the assessment is a broad overarching program while the survey is a boots on the ground physical examination of the site. The survey is highly focused on identifying tangible vulnerabilities.