Explore how ASIS International resources inform security risk assessment, professional development, and commercial security planning.
Request a Commercial Security Assessment
ASIS International is a professional association serving security management practitioners and organizations involved in protecting people, property, information and business operations.
For commercial and industrial organizations, ASIS is relevant because effective physical security involves more than cameras, card readers, alarms and other installed equipment. Security programs may also require risk assessment, governance, documentation, incident management, workplace-violence planning, investigations, resilience and clear responsibility for security decisions.
ASIS does not install security systems, approve individual projects, issue building permits or replace applicable codes and regulatory requirements. Its standards, guidelines, certifications and professional resources instead provide frameworks that security professionals and organizations can use when developing and managing security programs.
For broader NERSA resources involving codes, standards and compliance-sensitive commercial security planning, visit Regulatory Compliance & Inspection Readiness.
What Is ASIS International?
ASIS International supports the professional practice and management of security.
Its work includes:
- Security management
- Physical security
- Security risk assessment
- Enterprise risk management
- Investigations
- Workplace-violence prevention
- Organizational resilience
- Business continuity
- Information protection
- Security leadership
- Standards and guidelines
- Professional education
- Board certifications
That role is different from the role of a security-system manufacturer or integrator.
A manufacturer develops equipment.
A commercial security integrator evaluates, designs, installs, configures and supports technology.
Building and fire authorities enforce requirements within their jurisdiction.
ASIS contributes professional security-management frameworks, standards, guidance and education that can help organizations make more disciplined risk and security decisions.
Why ASIS Matters to Commercial and Industrial Organizations
Security technology should support an identifiable business or operational requirement.
A camera should provide a useful view.
A controlled door should protect an area that actually requires restricted access.
An alarm event should produce an understood response.
A security procedure should identify who is responsible for acting when an event occurs.
ASIS-related security-management concepts help move the conversation from:
“What equipment should we buy?”
to:
“What are we protecting, what can happen to it, what risk matters most and what security measure is appropriate?”
That distinction becomes increasingly important for:
- Warehouses
- Manufacturing facilities
- Distribution centers
- Healthcare properties
- Corporate offices
- Commercial campuses
- Multi-building facilities
- Multi-site organizations
- Utilities
- Institutions
- Logistics operations
- Government-adjacent commercial properties
Large organizations may have several facilities and technologies but still lack consistent security policies, documentation or responsibility.
Professional security planning helps connect those pieces.
Security Risk Assessment
One of the most relevant ASIS subjects for commercial physical security is security risk assessment.
A security risk assessment is intended to identify assets, threats, vulnerabilities and potential consequences so an organization can better understand where security measures are justified.
That process is fundamentally different from beginning with a predetermined quantity of cameras, readers or alarm devices.
Depending on the facility, an assessment may consider:
- People
- Buildings
- Equipment
- Inventory
- Information
- Business operations
- Restricted areas
- Entrances
- Vehicle movement
- Loading operations
- Exterior exposure
- Existing security systems
- Previous incidents
- Operating hours
- Emergency procedures
- Business dependencies
- Future growth
ASIS publishes a Security Risk Assessment Standard that provides a structured approach for establishing the assessment context and identifying, analyzing and evaluating security risks.
The value of that approach is prioritization.
Not every risk deserves the same investment, and not every portion of a property requires the same security treatment.
Enterprise Security Risk Management
ASIS also publishes guidance involving Enterprise Security Risk Management, commonly referred to as ESRM.
ESRM connects security decisions with the organization’s broader objectives and risk-management process.
Rather than treating the security department as the sole owner of every risk, the approach emphasizes collaboration between security professionals and the people responsible for the assets and operations being protected.
For a commercial organization, that can mean involving:
- Facility management
- Operations
- Information technology
- Human resources
- Executive management
- Legal or compliance personnel
- Safety personnel
- Property management
- Business-unit leadership
Security then becomes part of organizational decision-making rather than a disconnected equipment function.
A warehouse operations manager may understand freight exposure better than anyone else.
An IT department may understand network and remote-access risks.
Human resources may own workplace-violence procedures.
Facilities personnel may understand doors, lighting, utilities and building operation.
A stronger security program brings those perspectives together.
ASIS Professional Certifications
ASIS administers four principal board-certification programs for individual security professionals.
These credentials should not be confused with product certifications, contractor licenses, regulatory approvals or certifications of a specific building.
Certified Protection Professional — CPP
The Certified Protection Professional (CPP) credential covers broad security-management knowledge and is associated with experienced security leaders responsible for multiple areas of security management.
Its subject matter includes areas such as security principles, business practices, investigations, personnel security, physical security, information security and crisis management.
Physical Security Professional — PSP
The Physical Security Professional (PSP) credential is particularly relevant to physical security.
ASIS describes the PSP as demonstrating knowledge and experience involving:
- Physical security assessments
- Application of physical-security measures
- Physical-security system design
- System integration
- Implementation of security measures
This is closely related to the type of analysis required before commercial electronic-security systems are selected.
Professional Certified Investigator — PCI
The Professional Certified Investigator (PCI) credential focuses on investigations.
Investigation knowledge can be relevant to organizations using security systems for:
- Incident review
- Theft investigations
- Workplace events
- Evidence collection
- Employee incidents
- Visitor disputes
- Loss prevention
- Internal investigations
Video surveillance and access-control records can support investigations, but technology alone does not establish an investigative process.
Associate Protection Professional — APP
The Associate Protection Professional (APP) credential is intended for security professionals earlier in their careers and addresses foundational security-management knowledge.
Together, these certification programs illustrate the range of disciplines involved in professional security management.
ASIS Standards and Guidelines
ASIS publishes standards and guidelines addressing multiple areas of security practice.
Relevant subjects include:
- Security risk assessment
- Enterprise security risk management
- Workplace violence and active assailant prevention
- Organizational resilience
- Business continuity
- Investigations
- Physical asset protection
- Information asset protection
- Security awareness
- Supply-chain risk management
- Private security operations
These documents can help organizations develop more structured approaches to security.
They do not eliminate the need to evaluate the actual facility.
A warehouse, healthcare facility, office campus and manufacturing plant may all use professional security-management principles while requiring very different physical-security systems.
Workplace Violence Prevention and Security Technology
Workplace-violence prevention is another area where security management and electronic security can intersect.
ASIS publishes a Workplace Violence and Active Assailant Prevention, Intervention and Response standard addressing organizational policies, processes and protocols for identifying, assessing, responding to and mitigating threatening or violent behavior.
Electronic security can support a broader workplace-violence program through technologies such as:
- Controlled entrances
- Visitor communication
- Video surveillance
- Panic and duress signaling
- Intrusion detection
- Intercoms
- Emergency communication
- Event documentation
Technology is only one component.
A panic button does not establish a response procedure.
A camera does not create an intervention program.
Access control does not replace employee training.
Organizations still require policies, assigned responsibilities, communication procedures and appropriate response planning.
Physical Security Is More Than Electronic Equipment
Commercial security should consider the physical property as well as the electronic systems installed within it.
Conditions that may influence security include:
- Building layout
- Entrances
- Parking
- Exterior lighting
- Fencing
- Landscaping
- Vehicle routes
- Pedestrian routes
- Loading areas
- Gates
- Visibility
- Property maintenance
- Shared tenant areas
- Neighboring properties
Crime Prevention Through Environmental Design, commonly called CPTED, is one example of a broader approach that considers how site design and property conditions can influence security.
Electronic systems are most effective when they complement the actual property.
A camera cannot fully compensate for a badly obstructed view.
Access control cannot correct a door that does not reliably close and latch.
Remote monitoring cannot completely compensate for poor exterior lighting and uncontrolled site access.
The physical environment remains part of the security system.
ASIS Concepts in Industrial and Manufacturing Security
Industrial properties frequently require security decisions that extend beyond ordinary building access.
An industrial or manufacturing facility may need to protect:
- Employees
- Contractors
- Production areas
- Tools
- Materials
- Intellectual property
- Restricted processes
- Shipping operations
- Inventory
- Utilities
- Exterior storage
- Multiple buildings
Different departments may also own different pieces of the risk.
Operations may control production.
Facilities may manage the building.
IT may manage network infrastructure.
Human resources may manage employee procedures.
Security personnel may manage credentials, surveillance and incident response.
Risk-based planning helps establish why protection is required and who is responsible for the resulting procedures.
Security Governance for Multi-Site Organizations
Security becomes more difficult to manage as an organization adds locations.
Different sites may have:
- Different camera platforms
- Different access-control systems
- Separate alarm systems
- Inconsistent naming
- Different credential procedures
- Multiple administrator accounts
- Different monitoring instructions
- Incomplete documentation
- Different service providers
A professional security program should establish enough consistency that management can understand what is installed, who controls it and how incidents are handled.
That does not necessarily mean every building must use identical hardware.
The objective is manageable governance.
Organizations should understand:
- Who owns administrative accounts
- Who approves credentials
- Who receives alarms
- Who can retrieve video
- How access is revoked
- How incidents are documented
- How new locations are brought into the program
- What standards apply to new purchases
Those decisions often have greater long-term impact than selecting one specific camera model.
Physical Security and Cybersecurity Convergence
Modern commercial security systems increasingly depend on network infrastructure and software.
Cameras, recorders, access-control panels, readers, intercoms, servers and cloud platforms may all communicate across IP networks.
That creates overlap between physical security and information technology.
Planning may need to address:
- Network ownership
- Remote access
- Administrator accounts
- Password practices
- User permissions
- System updates
- Cloud services
- Network segmentation
- Data retention
- Cybersecurity policies
- Documentation
- Vendor access
Physical-security teams and IT departments should understand their respective responsibilities.
A system can be physically well designed while being poorly administered on the network.
Likewise, a securely configured network cannot compensate for cameras installed in ineffective locations or doors using inappropriate hardware.
Both disciplines matter.
Investigations and Evidence
Commercial security systems frequently become important after an incident has already occurred.
An organization may need to determine:
- Who entered a controlled area
- Which credential was used
- When a door opened
- What vehicle entered the property
- What occurred around a loading area
- Whether an alarm was received
- Whether video exists
- Whether the footage can be exported
- Who has authority to review the information
A security system should therefore be designed not only to detect or deter activity but also to produce useful information when an event requires investigation.
Good administration and documentation can be just as important as camera resolution.
What ASIS Does Not Replace
ASIS standards, guidelines, professional certifications and management concepts do not replace project-specific legal, regulatory or technical requirements.
ASIS does not replace:
- Applicable building codes
- Fire alarm requirements
- Electrical requirements
- Accessibility requirements
- Federal procurement rules
- OSHA requirements
- Manufacturer instructions
- Engineering requirements
- Licensing requirements
- Permit requirements
- Inspections
- Authorities having jurisdiction
A commercial project may involve several layers of requirements at the same time.
Professional security-management guidance can help an organization establish risk and governance expectations while the actual installation still follows the applicable requirements for that project.
Professional Security Planning and Project Standards
Security systems may remain in service for many years.
The quality of the long-term result depends on more than equipment selection.
Organizations should also consider:
- System ownership
- Administrator credentials
- Documentation
- Testing
- Training
- User management
- Monitoring procedures
- Service responsibility
- Software licensing
- Equipment support
- Cybersecurity
- Future expansion
- Project turnover
For additional guidance on documentation, ownership, workmanship and long-term project responsibility, visit Commercial Security Trust & Project Standards.
Security Assessment Before Equipment Selection
The most useful security planning begins with the property and operating requirements.
A facility assessment can help identify:
- Assets requiring protection
- Important entrances
- Restricted areas
- Employee movement
- Visitor activity
- Vehicle traffic
- Loading operations
- Exterior exposure
- Existing equipment
- Current procedures
- Infrastructure
- Monitoring requirements
- Administrative responsibilities
- Future expansion
The resulting security design can then be developed around defined requirements instead of a predetermined equipment package.
For larger commercial, manufacturing, warehouse, institutional and multi-building environments, visit Physical Plant Security Assessment.
Frequently Asked Questions About ASIS International and Commercial Security
What is ASIS International?
ASIS International is a professional association for security management practitioners. Its work includes security education, standards, guidelines, professional certifications, risk management and other security-management resources.
Does ASIS install commercial security systems?
No. ASIS is not a security-system contractor or manufacturer and does not install cameras, access control, alarms or other security equipment.
Does ASIS approve a commercial security installation?
No. ASIS does not issue project permits or approvals and is not an authority having jurisdiction for a specific installation.
Why is ASIS relevant to physical security?
ASIS publishes standards, guidance and professional resources involving security risk assessment, physical security, enterprise risk management and other areas that can help organizations develop more disciplined security programs.
What is ESRM?
Enterprise Security Risk Management, or ESRM, is an approach that aligns security risk management with organizational objectives and involves collaboration between security professionals and the people responsible for organizational assets and operations.
What ASIS certifications relate to physical security?
ASIS administers CPP, PSP, PCI and APP board certifications. The PSP credential is specifically focused on knowledge and experience involving physical security assessment, application, design, integration and implementation.
Is an ASIS certification the same as a contractor license?
No. ASIS professional certifications are credentials held by individuals. They do not replace contractor licensing, trade licensing, code requirements, permits or project approvals.
Does ASIS address workplace violence?
Yes. ASIS publishes standards and resources concerning workplace-violence and active-assailant prevention, intervention and response.
Does ASIS replace OSHA, NFPA, UCC or federal requirements?
No. ASIS standards and guidance do not replace applicable laws, regulations, adopted codes, procurement requirements, inspections or authorities having jurisdiction.
Can ASIS concepts apply to warehouses and manufacturing facilities?
Yes. Risk assessment, physical protection, investigations, workplace-violence planning, governance and resilience can all be relevant to industrial and logistics environments.
Can ASIS concepts apply to smaller commercial facilities?
Yes. The level of formality may differ, but risk-based planning can help organizations of many sizes determine what they are protecting and which security measures are justified.
How should a commercial security project begin?
A project should begin by understanding the property, operations, assets, people, security concerns, existing systems and expected response before equipment is selected.
Request a Commercial or Industrial Security Assessment
Professional security principles are most useful when they are applied to the actual property.
Northeast Remote Surveillance and Alarm, LLC can evaluate qualifying commercial and industrial facilities to identify security requirements, existing-system conditions, infrastructure needs, operational concerns and practical technology options.
Request a Commercial Security Assessment.
Northeast Remote Surveillance and Alarm, LLC
Commercial & Industrial Security Systems