I85PREP
⌘ K
EXIN ISFS study materials
EXIN ISFS study resources

EXIN ISFS study guide

EXIN ISFS · Work through your exam, one topic at a time.

The EXIN Information Security Foundation based on ISO/IEC 27001 (commonly shortened to ISFS) is an entry-level certification aimed at anyone who needs a working grasp of information security concepts rather than hands-on technical depth. It suits new employees in IT and security roles, line managers, auditors, contract and HR staff, and anyone whose work touches confidential data and who must understand why security controls exist and what ISO/IEC 27001 expects of an organisation. The exam tests conceptual understanding of the core building blocks of information security: what information and information security are, the relationship between information and security, threats and risks, the value of information, and the countermeasures an organisation can take. It also covers the organisational and human side - security policy, roles and responsibilities, incident handling, business continuity, and the Plan-Do-Check-Act cycle that underpins an ISO/IEC 27001 management system. Expect scenario-based multiple-choice items that ask you to classify, distinguish and apply concepts rather than recite clauses. Preparation is best done in layers: learn the vocabulary and relationships first, then work through the ISO/IEC 27001 control themes, then practise scenario questions until you can justify each answer from principle. Topics on this exam: Information security fundamentals and ISO/IEC 27001. The EXIN ISFS study guide has 1 section and about 998 words.

01

Information Security Fundamentals

Domain 1 covers the vocabulary and mental models the rest of the exam depends on: what information security protects, how threats become risk, and how controls change that risk. Expect definition questions, classification of controls, and short scenarios asking you to identify a threat, vulnerability, or risk treatment. Data vs information : data are raw facts; information is data with meaning. Information security protects information, but controls often apply to data, systems, people, and premises.

998 words, about 5 min

More study resources for EXIN ISFS

  • Practice questionsWithin the ISO/IEC 27001 family of standards, which document provides guidance on the information security management system requirements themselves rather than on supporting controls?
  • FlashcardsConfidentiality. The property that information is not made available or disclosed to unauthorized individuals, entities, or processes.
  • Cheat sheetConfidentiality, Integrity, Availability (CIA triad) are the three core information security objectives; a control may support one or more of them.
  • Key termsInformation security. Protecting information and the systems that hold it from loss of confidentiality, integrity and availability, whether the threat is deliberate, accidental, or caused by natural events such as fire or flood.
  • Study planDefine information security and distinguish it from IT security and privacy, writing your own one-sentence definition and two contrasting examples.
  • Common mistakesCandidates memorise the three letters as a list and never practise applying all three to one event, so they stop at the first plausible label and miss the secondary loss of availability or trust.
  • Exam-day guideBring the original, unexpired identification document accepted by your test provider (typically a passport or government-issued photo ID).