- The One-Page Snapshot
- Exam Format and Scoring Mechanics
- Domain Weights at a Glance
- Information Security: The 31% Heavyweight
- Personnel Security: The 28% Runner-Up
- Physical, Industrial, and General Security
- Eligibility, Prerequisites, and Cost Notes
- What the Official Pass Statistics Say
- A Domain-Ordered Review Plan
- Validity and Maintenance
- Frequently Asked Questions
- The exam has 110 multiple-choice questions (74 scored, 36 unscored) and a 2 hour 15 minute time limit.
- Information Security (31%) and Personnel Security (28%) together make up 59% of the exam.
- SFPC certification is required before you can pursue the SAPPC; there is no mandatory prep course.
- CDSE reported a CY-2025 pass rate of 43.46% (113 of 260), so treat preparation seriously.
The One-Page Snapshot
This cheat sheet condenses the facts that matter most for the Security Asset Protection Professional Certification (SAPPC), a credential administered by the Center for Development of Security Excellence (CDSE) at the Defense Counterintelligence and Security Agency as part of the Department of Defense security professional certification program. The authoritative source is the DOD Professional Certification and Credentialing Handbook (August 2026 edition), which the program uses to define the Areas of Expertise and their official weights.
If you are brand new to the credential, start with What Is SAPPC Certification? for background, then return here for the compressed review. If you want a deeper walkthrough of how to structure your preparation, the SAPPC Study Guide covers the full approach.
| Item | Must-Know Fact |
|---|---|
| Certifying body | CDSE, Defense Counterintelligence and Security Agency (DOD security professional certification program) |
| Testing provider | Pearson VUE |
| Total questions | 110 multiple choice |
| Scored / unscored | 74 scored, 36 unscored |
| Time allowed | 2 hours 15 minutes |
| Prerequisite | SFPC certification |
| Certification validity | Two years |
| Maintenance | Active DAU account plus at least 100 PDUs per two-year period |
| Handbook version | August 2026 |
Exam Format and Scoring Mechanics
The SAPPC assessment mixes stand-alone multiple-choice questions with scenario-associated multiple-choice questions. Scenario items present a short situation and then ask one or more questions about the appropriate security decision. Expect to apply policy rather than recite definitions.
The 74 + 36 Structure
Of the 110 questions, only 74 count toward your score. The other 36 are unscored items, and you are not told which are which. The practical consequence is simple: treat every question as if it counts. Do not spend time trying to guess which items are "pretend" questions.
Scoring Rules That Affect Your Strategy
- Dichotomous scoring: each scored question is right or wrong, worth one point per correct scored answer.
- No penalty beyond a miss: unanswered questions are marked incorrect, so answer every item, even if you must make an educated guess.
- Questions are incorporated throughout: scored and unscored items are mixed across the whole assessment rather than grouped.
Domain Weights at a Glance
The handbook refers to these as Areas of Expertise and publishes official weights. Memorize the weights, because they tell you where the points are.
| Domain | Weight | Priority |
|---|---|---|
| Information Security | 31% | Highest |
| Personnel Security | 28% | High |
| General Security | 18% | Medium |
| Industrial Security | 13% | Medium-low |
| Physical Security | 10% | Lowest, but still testable |
The five weights add up to 100%. Information Security and Personnel Security combined account for 59% of the exam, which means more than half your result rides on two content areas. For a fuller breakdown of each area, see SAPPC Exam Domains: Complete Guide to All 5 Content Areas.
Information Security: The 31% Heavyweight
This is the largest area, and the official topic subheadings give you a clear map of what to study. Treat the subheadings below as your checklist.
Information Security Fundamentals
The foundation for everything else in the domain. Be fluent in the purpose of the information security program and the vocabulary used throughout.
- Core terminology and program objectives
- Roles and responsibilities in protecting classified and controlled information
- How the pieces of the program fit together
Classification and Declassification Concepts
Know what classification is, why it exists, and how information moves through its lifecycle, including when and how it leaves the classified system.
- The reasoning behind classifying information
- Concepts governing declassification
- The difference between originating and derivatively applying classification decisions
Classification Management
This is the applied side: marking, guidance, and the day-to-day handling decisions a security professional makes.
- Classification guidance and how it is used
- Marking requirements and common marking errors
- Managing classified holdings responsibly
Information Protection Requirements
Expect scenarios about safeguarding: how information is stored, transmitted, reproduced, and destroyed, and what to do when something goes wrong.
- Safeguarding, transmission, and destruction requirements
- Responding to incidents involving classified information
- Matching protection measures to the level of information
Cyber for Security Professionals
This subheading reflects the reality that security practitioners now work alongside information systems. You are not being tested as a network engineer; you are being tested on how cyber concepts intersect with security program responsibilities.
- Cyber concepts a security manager must recognize
- How information systems relate to protecting classified and sensitive data
Personnel Security: The 28% Runner-Up
The official subheadings in this area include Personnel Security Fundamentals and Personnel Security Standards. Together they point to two layers of knowledge: the big-picture purpose of the program, and the specific standards used to make determinations about people.
Personnel Security Fundamentals
The conceptual foundation: why personnel security exists and how the process flows from start to finish.
- Purpose and scope of the personnel security program
- The stages of the process and who is responsible at each stage
- How eligibility and access relate to one another
Personnel Security Standards
This is where scenario questions tend to bite. You need to apply standards to a described situation and identify the correct next step or determination.
- The standards used to evaluate whether someone is suitable for access
- Continuous evaluation and reporting concepts
- What a security professional can and cannot decide on their own
Because this area is 28% of the exam, you cannot treat it as a secondary topic. Many candidates who already work in personnel security feel comfortable here, but the exam draws on the formal standards, not on local office habits. Verify what you "know" against the official materials.
Physical, Industrial, and General Security
The remaining three areas carry 41% of the exam together (18% General Security, 13% Industrial Security, and 10% Physical Security). Public sources reviewed list the detailed subheadings only for Information Security and Personnel Security, so for these three, rely on the handbook and CDSE preparatory resources for the authoritative topic lists.
General Security (18%)
The third-largest area and easy to under-study because it sounds broad. Expect cross-cutting program management and security concepts that tie the other domains together.
Industrial Security (13%)
Focuses on security as it applies to industry partners working with government programs. Candidates who come from government-only backgrounds should allocate extra time here.
Physical Security (10%)
The smallest weight, yet every point counts. Do not skip it just because it is the lowest percentage.
Eligibility, Prerequisites, and Cost Notes
The single most important gating requirement is that SFPC certification is required. You cannot move to the SAPPC without it. Beyond that, general SPēD eligibility applies: the program is open to eligible DOD personnel, federal employees of participating agencies, and qualifying contractors who perform security functions. Check SAPPC Requirements: Eligibility, Prerequisites & How to Qualify for the full qualification picture.
Training Is Not Mandatory
The program is training agnostic. No prescribed course must be completed before you sit for the assessment. CDSE supplies Competency Preparatory Tools through STEPP, and it identifies D-SEBOK as an additional foundation resource. Read SAPPC Training for how candidates typically combine these resources.
The Fee Question
Scheduling
Testing is delivered through Pearson VUE. For windows and deadlines, see SAPPC Exam Dates: Testing Windows, Deadlines & Scheduling.
What the Official Pass Statistics Say
CDSE's Certification Tracker publishes period-specific figures. They are official program statistics, but they describe particular time windows rather than a permanent lifetime rate.
| Period | Passed | Delivered | Pass Rate |
|---|---|---|---|
| CY-2025 | 113 | 260 | 43.46% |
| June 2026 | 10 | 16 | 62.5% |
Note the sample sizes. The June 2026 figure comes from only 16 delivered exams, so it is far more volatile than the full-year 2025 figure based on 260. A single month can swing widely with so few candidates. The reasonable takeaway is that a majority of 2025 candidates did not pass, which suggests the exam rewards real preparation. For more context, read SAPPC Pass Rate: What the Data Shows and How Hard Is the SAPPC Exam?
Key Takeaway
Do not anchor on the higher June 2026 percentage. With only 16 delivered exams, it is a snapshot, not a trend. Prepare as though the more robust CY-2025 figure of 43.46% is the better indicator of difficulty.
A Domain-Ordered Review Plan
If you only have time for one planning idea, make it this: sequence your review by weight and by dependency. Information Security vocabulary supports several other areas, so it goes first, and the lightest area goes last as a reinforcement pass.
Information Security Foundations
- Fundamentals, plus Classification and Declassification Concepts
- Build the vocabulary you will reuse in every later domain
Information Security Applied
- Classification Management and Information Protection Requirements
- Cyber for Security Professionals
Personnel Security
- Fundamentals first, then Standards
- Practice scenario-style questions on determinations and reporting
General, Industrial, and Physical Security
- Work from the handbook and CDSE preparatory tools for each area's topic list
- Finish with a timed full-length practice set at 110 questions
Adjust the pacing to your own background; a seasoned industrial security specialist might compress Week 4 and add time to Information Security. For a complete preparation approach, see the SAPPC Study Guide, and use the SAPPC practice tests to rehearse the 2 hour 15 minute timing under realistic conditions.
Validity and Maintenance
Earning the credential is only part of the story. The certification is valid for two years. To keep it active, you must maintain an active DAU certification account and earn at least 100 professional development units during the two-year maintenance period.
- Track PDUs from day one: do not wait until the final months to start accumulating them.
- Keep your DAU account active: an inactive account can complicate maintenance.
- Calendar the end of your cycle: the two-year clock starts when you certify.
Where the Credential Fits in a Career
The SAPPC is associated with security professionals in DOD and participating federal agencies, as well as qualifying contractors who perform security functions. That makes defense contractors and government security offices the natural employers. Because no verified salary data is cited in this article, we will not offer figures here; see SAPPC Salary Guide and SAPPC Jobs for career-side discussion, and Is the SAPPC Certification Worth It? for a return-on-investment view.
If you are still orienting yourself on terminology, the explainers What Is SAPPC? and What Does SAPPC Stand For? are quick reads. When you are ready to test your recall under pressure, head to the main practice test site.
Frequently Asked Questions
The exam has 110 multiple-choice questions, of which 74 are scored and 36 are unscored. You are not told which questions are which, so answer every question carefully.
You have 2 hours and 15 minutes. Because unanswered questions are marked incorrect, pace yourself so that every item receives an answer before time expires.
The public handbook describes dichotomous scoring with one point per correct scored answer, but the reviewed public sources do not state a fixed numerical pass mark. Prepare broadly across all five domains rather than targeting a specific percentage.
Information Security (31%) and Personnel Security (28%) are the two largest, together accounting for 59% of the exam. General Security is 18%, Industrial Security is 13%, and Physical Security is 10%.
No. The program is training agnostic and does not prescribe a course. SFPC certification is required, and CDSE offers Competency Preparatory Tools through STEPP, with D-SEBOK identified as an additional foundation resource.
The certification is valid for two years. To maintain it, keep an active DAU certification account and earn at least 100 professional development units during the two-year maintenance period.