Hiring a Consultant

Security Consultant Certifications: CPP, PSP, PCI and More

By the FASC editorial team Updated Nov 4, 2026 5 min read

The most widely recognized security certifications for consultants are the three board certifications from ASIS International: the CPP (Certified Protection Professional) for security management, the PSP (Physical Security Professional) for physical security assessment and design, and the PCI (Professional Certified Investigator) for investigations. Specialty credentials such as the IAPSC’s CSC, the IAHSS’s CHPA, ATAP’s CTM and IAEM’s CEM matter in their own niches. Security certifications show tested knowledge and ongoing education, but they never replace relevant experience and references.

Security certifications: key takeaways

CPP signals broad security management knowledge; PSP signals physical security assessment and system design; PCI signals investigations.
All three ASIS board certifications require qualifying experience, a proctored exam and recertification every three years.
Match the credential to your project: a PSP for a facility assessment, a CHPA for a hospital, a CTM for threat management.
No certification is required by law to call yourself a security consultant in most settings, so verifying credentials is up to you.
Always confirm a credential with the issuing organization and ask how the consultant has used that knowledge in settings like yours.

Why do security certifications matter for consultants?

Anyone can print “security consultant” on a business card. Unlike engineering or architecture, security consulting has no single national license, and state rules (where they exist) usually focus on private investigators and guard companies rather than advisory work. Security certifications are one of the few objective signals a buyer has.

Serious security certifications tell you three things: the person met an experience requirement, passed an exam built around a defined body of knowledge, and keeps up with continuing education. For school boards, hospital leaders and corporate buyers who have to justify a hire, that is useful evidence. In litigation, credentials are also among the first things opposing counsel examines in a security expert witness.

What are the ASIS board certifications?

ASIS International is the largest professional association for security management, and its board certifications are the most commonly cited credentials in the field.

CPP: Certified Protection Professional

The CPP covers security management as a whole: security principles and practices, business operations, risk management, investigations, personnel security, physical security, information security and crisis management. It is aimed at experienced professionals who manage security programs. When you need someone who can look at your organization broadly and connect security to operations and budget, a CPP is a good sign.

PSP: Physical Security Professional

The PSP focuses on physical security: conducting assessments, applying and integrating physical security systems (access control, video, intrusion detection, barriers, lighting) and implementing those measures. For a physical security assessment or a system design project, the PSP is often the most directly relevant credential.

PCI: Professional Certified Investigator

The PCI covers case management, evidence collection and case presentation. It matters when you need internal investigations, workplace misconduct or fraud inquiries, or pre-litigation fact finding. See consultants who offer investigations.

APP: Associate Protection Professional

ASIS also offers the APP for professionals earlier in their careers. It is a solid foundation, but for a lead consultant on a significant engagement you would generally expect a CPP, PSP or PCI plus substantial field experience.

Which specialty security certifications should you know?

Several associations offer security certifications in specific areas. These can be more relevant than a general credential when your project is specialized.

Credential	Issued by	What it signals	Most relevant for
CPP	ASIS International	Security management across disciplines	Program reviews, security leadership, multi-site organizations
PSP	ASIS International	Physical security assessment and system design	Facility assessments, access control and video design
PCI	ASIS International	Investigations and case management	Internal investigations, fact finding
CSC	IAPSC	Independent consulting practice	Buyers who want a consultant free of product ties
CHPA	IAHSS	Healthcare security administration	Hospitals, clinics, behavioral health facilities
CTM	ATAP	Threat assessment and management	Behavioral threat assessment teams, workplace and school threats
CEM	IAEM	Emergency management	Emergency operations plans, continuity, exercises

The IAPSC (International Association of Professional Security Consultants) is worth a closer note. Its members must be independent of security product and service sales, which matters if you want advice not tied to a vendor. Our article on security consultants vs security integrators explains why that independence matters.

Cybersecurity credentials such as the CISSP are respected, but they cover information security. If your project is a building, campus or people focused program, look for physical security, threat management or emergency management credentials instead.

Which security certifications fit your project?

School safety assessment or district plan: look for school specific experience first, then a PSP or CPP. A CEM is useful for emergency operations planning. Browse school safety consultants.
Office, warehouse or retail facility assessment: PSP or CPP, with experience in your industry.
Hospital or healthcare system: CHPA, ideally alongside a CPP or PSP.
Workplace violence or threat management: CTM, plus experience building behavioral threat assessment teams.
Emergency planning and exercises: CEM or comparable emergency management background.
Expert witness work: a credential that matches the issue in the case, plus a track record of practice in that setting.

On larger engagements, look at the whole team rather than one name. A firm might pair a CPP who leads the project with a PSP who handles system design and a CEM who writes the emergency plan. Ask for a staffing list that shows each person’s role and credentials, and make sure the people named in the proposal are the ones who show up.

Do security certifications guarantee a good consultant?

No. A certification proves knowledge at a point in time and ongoing education since. It does not prove judgment, communication skill or experience in your type of facility. Some excellent consultants built long careers before security certifications were common, and some certified professionals have never led an engagement like yours.

Treat security certifications as a screening filter, then go further:

Ask for a sample report (redacted) from a similar project.
Ask for two or three references from clients like you, and call them.
Ask how many projects of your type they have led in recent years.
Ask who will actually do the work, and check that person’s credentials, not just the firm owner’s.
Ask whether they sell products or receive referral fees.

How do you verify security certifications?

Ask the consultant for the exact credential name, the issuing organization and the year earned. Then confirm with the issuer; most certifying bodies can confirm whether a credential is current. ASIS security certifications must be renewed every three years through continuing professional education, so a lapsed credential is a fair question to raise.

Be cautious with unfamiliar acronyms. Some security certifications come from short courses with no experience requirement or proctored exam. If you have not heard of a certification, ask what it took to earn it.

Find a certified security consultant for your project

Browse our directory of vetted consultants by specialty and state, or tell us about your project and we will match you with qualified consultants whose credentials and experience fit. Free, with no obligation.

Request free proposals

Frequently asked questions

What is the best certification for a security consultant?

There is no single best one among security certifications. The ASIS CPP is the most widely recognized credential for security management overall, while the PSP is the most relevant for physical security assessments and system design. For specialized work, credentials like the CHPA for healthcare, CTM for threat management or CEM for emergency management may fit your project better.

What is the difference between CPP and PSP?

The CPP covers security management broadly, including risk management, business operations, investigations, personnel and crisis management. The PSP focuses specifically on physical security, such as conducting assessments and designing and integrating systems like access control, video and intrusion detection. Many consultants hold both. For a facility assessment, a PSP is directly relevant.

Does a security consultant need a license?

It depends on the state and the type of work. Many states license private investigators and guard companies, and some of those rules can reach consulting activities. There is no single national license for security consultants. Ask any consultant whether a license is required for their work in your state and, if so, for the license number.

How long are ASIS security certifications valid?

ASIS board certifications, including the CPP, PSP and PCI, must be recertified every three years. Holders earn continuing professional education credits during that period to stay current. If a consultant lists an ASIS credential, ask whether it is current and confirm with ASIS, since a lapsed certification may indicate they are no longer active in the field.

Should I hire a consultant without certifications?

Possibly, if they have strong, relevant experience and excellent references. Some highly capable consultants built their careers before certifications were common. But for public entities and larger projects, security certifications make a hire easier to justify. Weigh credentials, experience in your setting, sample work and independence together rather than relying on any single factor.