- How the SAPPC Blueprint Is Built
- Domain 1: Information Security (31%)
- Domain 2: Personnel Security (28%)
- Domain 5: General Security (18%)
- Domain 4: Industrial Security (13%)
- Domain 3: Physical Security (10%)
- Question Format, Scoring and Pass-Rate Context
- Sequencing Your Preparation by Domain Weight
- Who Takes This Exam and Where It Leads
- Frequently Asked Questions
- Information Security (31%) and Personnel Security (28%) together account for 59% of the Security Asset Protection Professional Certification blueprint.
- The exam has 110 multiple-choice questions, but only 74 are scored; 36 are unscored and unidentifiable.
- You have 2 hours 15 minutes, and unanswered questions are marked incorrect, so never leave blanks.
- SFPC certification is required before you can pursue SAPPC.
How the SAPPC Blueprint Is Built
The Security Asset Protection Professional Certification (SAPPC) is part of the Department of Defense security professional certification program administered through the Center for Development of Security Excellence (CDSE), which operates under the Defense Counterintelligence and Security Agency. The current DOD Professional Certification and Credentialing Handbook (August 2026 version) organizes the content into five Areas of Expertise and publishes the official weight of each. This article walks through every one of them, in order of exam weight rather than the order they happen to appear on a syllabus.
If you are still orienting yourself on the credential itself, start with our explainers on what SAPPC certification is and the eligibility and prerequisite requirements. This guide assumes you already know the credential exists and want to understand precisely what the exam asks of you.
| Domain | Official Weight | Share of 74 Scored Items (approx.) |
|---|---|---|
| Domain 1: Information Security | 31% | About 23 items |
| Domain 2: Personnel Security | 28% | About 21 items |
| Domain 5: General Security | 18% | About 13 items |
| Domain 4: Industrial Security | 13% | About 10 items |
| Domain 3: Physical Security | 10% | About 7 items |
The item counts above are simple arithmetic applied to the published weights and the 74 scored questions; treat them as rough planning figures, not guarantees, since the exam's actual form assembly may vary slightly.
Domain 1: Information Security (31%)
This is the heaviest domain on the exam, and the CDSE handbook breaks it into official topic subheadings. Candidates should expect scenario-driven questions that test judgment, not just recall of definitions.
Information Security Fundamentals
The foundation: what is being protected, why, and under what authorities.
- The purpose and scope of the DOD information security program
- Roles and responsibilities of those who handle protected information
- How security policy flows from national-level direction to local procedures
Classification and Declassification Concepts
Understanding how information acquires, keeps, and eventually loses its protected status.
- Original versus derivative classification and who may do each
- Classification levels and the damage standards that distinguish them
- Duration, review, and declassification principles
Classification Management
The day-to-day mechanics of marking, handling, and tracking classified material.
- Marking requirements and how errors are identified and corrected
- Use of classification guidance in real documents
- Program-level oversight of classification decisions
Information Protection Requirements
The safeguarding rules once information is classified.
- Storage, transmission, reproduction, and destruction requirements
- Accountability and control measures
- Responding to compromises and security incidents
Cyber for Security Professionals
Security generalists are expected to understand the cyber dimension even if they are not network engineers.
- How information systems intersect with classification and protection rules
- Basic cyber threat awareness from a security-program standpoint
- Where the security professional's responsibilities end and the IT team's begin
A practical note: questions in this domain often present a short scenario, such as a document found in the wrong place or a marking that looks wrong, and ask for the most appropriate action. Memorizing rules without understanding the reasoning behind them is the most common way candidates lose points here. For a broader view of how demanding the exam is overall, see our difficulty analysis.
Domain 2: Personnel Security (28%)
Personnel Security is the second-largest area and, together with Information Security, forms the core of the exam. The official subheadings include Personnel Security Fundamentals and Personnel Security Standards.
Personnel Security Fundamentals
The structure of the program that decides who may be trusted with access.
- The purpose of personnel vetting and the principle of trustworthiness determinations
- Key roles in the investigation, adjudication, and access process
- The distinction between eligibility and access
Personnel Security Standards
The criteria applied when evaluating individuals.
- The adjudicative guidelines and how they are weighed together
- Reporting requirements for cleared personnel
- Continuous evaluation concepts and handling of derogatory information
Because this domain involves people-focused judgment calls, candidates who work primarily in industrial or physical security roles sometimes underestimate it. At 28%, that is a costly mistake.
Domain 5: General Security (18%)
General Security is the broadest and least self-contained domain. It collects the cross-cutting knowledge that supports every other area, which is exactly why it rewards candidates with real field experience.
- Program management concepts: how a security program is organized, resourced, and evaluated.
- Risk management: identifying assets, threats, and vulnerabilities, and selecting proportionate countermeasures.
- Security education and awareness: how organizations train personnel and measure effectiveness.
- Incident handling and reporting: recognizing and escalating security events.
- Counterintelligence and insider-threat awareness: the security professional's role in recognizing indicators and reporting them.
Treat General Security as a connective layer. Questions here often blend elements from the other four domains, so strong command of Information, Personnel, Industrial, and Physical Security pays dividends in this section too. Our one-page SAPPC cheat sheet is useful for reviewing these cross-cutting concepts quickly.
Domain 4: Industrial Security (13%)
Industrial Security covers how classified information and security requirements extend to private-sector contractors performing work for the government. Although it carries only 13%, it matters disproportionately for candidates who work for or alongside cleared contractors.
Core Industrial Security Concepts
What candidates should be comfortable explaining.
- The government-industry relationship and how contractors become cleared facilities
- Contract-level security requirements and how they are communicated
- Oversight responsibilities, including assessments and compliance monitoring
- Foreign ownership, control, or influence considerations at a conceptual level
One common trap: candidates who spend their careers on the government side treat this domain as an afterthought and lose easy points. Even if you never touch a contractor facility, the exam expects fluency in how the program works across that boundary.
Domain 3: Physical Security (10%)
Physical Security is the smallest domain at 10%, but it is also the most concrete and often the most learnable in a short window.
- Layered protection (defense in depth): perimeter, building, and interior controls working together.
- Access control and intrusion detection: how systems and procedures limit and monitor entry.
- Protection of classified holdings: storage containers, areas, and the standards that apply to each.
- Security assessments: evaluating a facility against its threat environment.
Key Takeaway
Do not skip Physical Security because it is the lightest domain. With only about 7 scored items, a single weak area can still cost you several points, and these questions are often the easiest to earn through straightforward preparation.
Question Format, Scoring and Pass-Rate Context
The exam delivers 110 multiple-choice questions through Pearson VUE, with 74 scored and 36 unscored, over 2 hours 15 minutes. Questions come in two flavors: stand-alone items and scenario-associated items, where several questions hang off a single situation description. Candidates do not know which questions count toward the score.
- Scoring method: the handbook describes dichotomous scoring, one point per correct scored answer.
- Unanswered questions: marked incorrect, so answer everything.
- Passing mark: the public handbook does not state a fixed numerical pass mark, so be wary of any source that quotes a specific percentage. We cover this in our passing score guide.
- Fee: no public candidate fee was stated in the current CDSE handbook and resources we reviewed; see our cost breakdown for what is and is not known.
On outcomes, CDSE's Certification Tracker reports a calendar-year 2025 pass rate of 43.46% (113 of 260 delivered) and a June 2026 pass rate of 62.5% (10 of 16 delivered). These are period-specific official figures, and the June 2026 sample is very small, so avoid reading it as a trend. Our pass rate analysis goes deeper on interpreting these numbers.
Sequencing Your Preparation by Domain Weight
Rather than a generic schedule, sequence your study so effort tracks exam weight and conceptual dependency. Information Security comes first because its vocabulary (classification, marking, safeguarding) reappears throughout the rest of the exam.
Information Security (31%)
- Work through all five official subheadings, including Cyber for Security Professionals
- Practice spotting marking and handling errors in scenarios
Personnel Security (28%)
- Learn the fundamentals, then the standards and reporting requirements
- Focus on risk-based reasoning rather than memorized lists
Industrial and Physical Security (23% combined)
- Cover contractor oversight concepts and layered physical protection
General Security and full-length practice
- Tie the domains together through program management and risk concepts
- Take timed practice sets to rehearse the 2 hour 15 minute pace
For a fuller plan, including resource selection, see our SAPPC study guide. If you are working backward from a target date, check the exam dates and scheduling guide first.
Who Takes This Exam and Where It Leads
SAPPC is aimed at security practitioners within the DOD security professional certification program: eligible DOD personnel, federal employees of participating agencies, and qualifying contractors performing security functions. SFPC certification is a prerequisite, so SAPPC is a step along a progression rather than an entry point.
Once earned, the certification is valid for two years. Maintaining it means keeping an active DAU certification account and earning at least 100 professional development units during the two-year maintenance period. That ongoing requirement is worth factoring into your value assessment before you commit. If you are weighing career impact, our guides to SAPPC jobs and the salary picture discuss what we can and cannot say with confidence.
Frequently Asked Questions
Information Security at 31%, followed by Personnel Security at 28%. Together they make up 59% of the blueprint, so they deserve the largest share of your preparation time.
There are 110 multiple-choice questions, of which 74 are scored and 36 are unscored. Candidates cannot tell which are which, so treat every question as if it counts.
The reviewed public handbook describes dichotomous, one-point-per-correct-answer scoring but does not state a fixed numerical pass mark. Be cautious of sources quoting an exact percentage.
No. The assessment is training agnostic. CDSE provides Competency Preparatory Tools through STEPP and identifies the D-SEBOK as an additional foundation resource, but no prescribed course is required.
Two years. To maintain it, keep an active DAU certification account and earn at least 100 professional development units during the two-year maintenance period.