- SAPPC is the Security Asset Protection Professional Certification, administered by CDSE under the Department of Defense security certification program.
- The exam has 110 multiple-choice questions (74 scored, 36 unscored) delivered through Pearson VUE in 2 hours 15 minutes.
- Information Security (31%) and Personnel Security (28%) together account for 59% of the exam.
- SFPC certification is required before you can pursue the SAPPC.
What a SAPPC Actually Is
When people ask "what is a SAPPC," the answer on this site is specific: it is the Security Asset Protection Professional Certification, a credential for security practitioners working within the Department of Defense security professional certification program. It is not a generic industry badge, and it should not be confused with any other credential that happens to share the same four letters. Everything on this page refers only to the Security Asset Protection Professional Certification.
The SAPPC validates that a security professional can apply knowledge across the core disciplines of protecting national security assets: classified and controlled information, the people cleared to access it, the facilities that house it, and the industrial base that handles it. It is a competency assessment, not a training completion certificate, which shapes how you should prepare.
If you want a quick orientation on naming and terminology, the companion articles on what SAPPC stands for and SAPPC meaning cover the vocabulary, while the broader SAPPC certification overview sets out the credential's place in the program.
Who Runs the Program
The SAPPC is administered by the Center for Development of Security Excellence (CDSE), part of the Defense Counterintelligence and Security Agency (DCSA), under the Department of Defense security professional certification program. The authoritative reference for the program is the DOD Professional Certification and Credentialing Handbook (August 2026 version), published by CDSE. That handbook describes the content areas as SAPPC Areas of Expertise and provides the official exam weights, so it is the document to treat as the source of truth whenever a third-party summary disagrees with what you read elsewhere.
Testing is delivered through Pearson VUE. The handbook and resources reviewed for this article did not state a public candidate fee, so no price is quoted here. For the cost picture as it is understood, see the SAPPC certification cost breakdown.
Exam Format and Question Style
The SAPPC assessment is a single computer-based exam with the following structure:
| Feature | SAPPC Detail |
|---|---|
| Total questions | 110 multiple-choice |
| Scored questions | 74 |
| Unscored questions | 36 |
| Time allowed | 2 hours 15 minutes |
| Question types | Stand-alone and scenario-associated multiple-choice |
| Scoring method | Dichotomous; one point per correct scored answer |
| Testing provider | Pearson VUE |
Scored versus unscored questions
Of the 110 questions, only 74 count toward your result. The other 36 are unscored items, and candidates are not told which is which. The practical consequence is simple: treat every question as if it counts. There is no safe place to coast.
Scenario-associated questions
Some questions stand alone, testing a definition or requirement directly. Others are tied to a scenario, where you read a situation and apply your knowledge to select the best response. Scenario questions reward understanding of why a requirement exists and how it plays out in real security operations, not just memorized lists.
Unanswered questions are marked wrong
All questions are incorporated throughout the assessment, and unanswered questions are marked incorrect. With one point per correct scored answer and no penalty structure described beyond that, a blank is strictly worse than an educated guess. Manage your time so that you have an answer recorded for every item. For a closer look at how the exam is scored, read the discussion of the SAPPC passing score; note that the public handbook reviewed does not state a fixed numerical pass mark, so be wary of any source quoting an exact percentage.
The Five Areas of Expertise
The handbook organizes exam content into five areas of expertise with official weights. The weights tell you where the exam's points are concentrated, which should directly influence where your hours go. For a deeper walk-through of each area, see the complete guide to all five SAPPC content areas.
| Area of Expertise | Weight |
|---|---|
| Information Security | 31% |
| Personnel Security | 28% |
| General Security | 18% |
| Industrial Security | 13% |
| Physical Security | 10% |
Domain 1: Information Security (31%)
The largest area, and the one most likely to decide your result. Official topic subheadings include:
- Information Security Fundamentals - the foundations of how national security information is protected
- Classification and Declassification Concepts - how information is classified, and how and when protection ends
- Classification Management - the lifecycle administration of classified material
- Information Protection Requirements - safeguarding, marking, storage, and handling expectations
- Cyber for Security Professionals - the cyber knowledge a security practitioner needs to protect information in modern systems
Domain 2: Personnel Security (28%)
The second-largest area, centered on who is trusted with access. Official topic subheadings include:
- Personnel Security Fundamentals - the purpose and structure of the personnel security program
- Personnel Security Standards - the criteria and requirements applied when making trust and eligibility determinations
Domain 3: Physical Security (10%)
The smallest area by weight, covering the protection of facilities, areas, and the assets inside them. Smaller does not mean skippable; scenario questions can blend physical measures with information or personnel concerns.
Domain 4: Industrial Security (13%)
Focuses on safeguarding classified information entrusted to industry, relevant to the qualifying contractors who perform security functions alongside government personnel.
Domain 5: General Security (18%)
Broad security program knowledge that cuts across the other disciplines. Because it spans topics, it often shows up in scenario-associated questions that ask you to reason across more than one area.
Key Takeaway
Information Security and Personnel Security together make up 59% of the exam. If your study hours are limited, these two areas deserve the majority of them, with General Security next in priority.
Who Can Sit for It
The SAPPC is not an open-enrollment exam. Two layers of eligibility apply:
- SFPC certification is required. You must already hold the SFPC before pursuing the SAPPC, which makes it a progression step rather than an entry-level credential.
- General SPēD eligibility. The broader program is open to eligible DOD personnel, federal employees of participating agencies, and qualifying contractors performing security functions.
For the full eligibility and qualification walk-through, see SAPPC requirements: eligibility, prerequisites and how to qualify. Scheduling specifics, including testing windows, are covered in SAPPC exam dates and scheduling.
Training-agnostic by design
No prescribed course is required before the assessment. The program is training agnostic: it tests competency, however you acquired it. That said, CDSE provides Competency Preparatory Tools through STEPP and identifies D-SEBOK as an additional foundation resource. These are the natural starting points, since they are produced by the same organization that administers the exam. More on preparation resources is available on the SAPPC training page.
What the Official Pass Data Shows
CDSE publishes pass statistics through its Certification Tracker. Two data points are available for the SAPPC, and both are period-specific rather than a lifetime rate:
| Period | Delivered | Passed | Pass Rate |
|---|---|---|---|
| CY-2025 | 260 | 113 | 43.46% |
| June 2026 | 16 | 10 | 62.5% |
What these figures do suggest is that a meaningful share of candidates do not pass on a given attempt, which is consistent with a credential that tests applied competency instead of rewarding recall alone. For a fuller treatment, see SAPPC pass rate: what the data shows and how hard the SAPPC exam really is.
Staying Certified: Two-Year Validity
A SAPPC does not last forever. The certification is valid for two years. To maintain it you must:
- Keep an active DAU certification account, and
- Earn at least 100 professional development units (PDUs) during the two-year certification maintenance period.
This maintenance model matters when you weigh the credential's long-term value. It signals ongoing professional engagement, not a one-time exam hurdle. If you are evaluating whether that commitment pays off, the SAPPC ROI analysis weighs the investment against career outcomes.
Where a SAPPC Fits in a Security Career
Because the SAPPC sits inside the DOD security professional certification program, its natural home is the defense security workforce: DOD components, federal agencies participating in the program, and contractors performing security functions on classified work. Typical roles are those responsible for administering information security, personnel security, physical security, or industrial security programs.
The credential is most useful as a signal of verified, standardized competency in an environment where many roles touch classified information and cleared personnel. It builds on the SFPC, so it reads as evidence that you have progressed beyond the foundational level. For role-oriented detail, see the SAPPC jobs overview, and for compensation context, the SAPPC salary guide. Specific earnings depend on grade, location, and employer, so no figures are asserted here.
Sequencing Your Preparation by Weight
Rather than a generic study calendar, let the official weights dictate order. The logic is to front-load the areas that carry the most points and that other areas lean on. A simple sequence:
Information Security (31%)
- Work through classification and declassification concepts first, since classification management and protection requirements build on them
- Cover Cyber for Security Professionals while the information protection material is fresh
Personnel Security (28%)
- Start with fundamentals, then move to standards and the criteria applied in determinations
- Practice scenario questions that ask you to apply standards to a described situation
General, Industrial, and Physical Security
- General Security (18%) first, as it connects the other disciplines
- Industrial Security (13%) and Physical Security (10%) last, then revisit areas where practice results are weakest
Use the CDSE Competency Preparatory Tools in STEPP and D-SEBOK as your primary content sources, then test yourself under timed conditions that mirror 110 questions in 2 hours 15 minutes. A fuller plan is in the SAPPC study guide, and the SAPPC cheat sheet is useful for last-pass review. When you are ready to measure yourself against realistic questions, try the SAPPC practice tests.
Frequently Asked Questions
On this site, SAPPC means Security Asset Protection Professional Certification, a credential administered by CDSE under the Department of Defense security professional certification program.
The exam has 110 multiple-choice questions, of which 74 are scored and 36 are unscored. You are given 2 hours 15 minutes, and you will not know which questions are scored.
Yes. SFPC certification is required, in addition to general SPēD eligibility for eligible DOD personnel, federal employees of participating agencies, and qualifying contractors performing security functions.
The public handbook describes dichotomous scoring with one point per correct scored answer, but the reviewed source does not state a fixed numerical pass mark. Treat any quoted percentage skeptically unless it comes from CDSE.
The certification is valid for two years. To maintain it, keep an active DAU certification account and earn at least 100 professional development units during the two-year maintenance period.