ISO 27005 RM exam-day guide
ISO 27005 RM · Prepare for the day ahead.
Your checklist
Government-issued photo ID
Bring the original ID document you used for registration, with a name that matches your booking exactly. Confirm with the provider which ID types are accepted and whether a second form is required.
Appointment confirmation and candidate number
Print or save offline the booking confirmation, test-centre address, start time, and any candidate or registration number. Screenshots work if network access fails.
Exam delivery format and allowed-aids rules
Confirm with the provider whether the exam is open book, whether the ISO/IEC 27005 standard text or a summary sheet may be brought in, and which note formats are permitted. Do not assume; rules differ by scheme and delivery partner.
Remote-proctoring setup verified (if online)
If sitting remotely, run the system and equipment check in advance: webcam, microphone, browser lock, bandwidth, and a quiet private room. Confirm with the provider the room-scan and desk-clear requirements.
Test-centre logistics plan
Know the arrival time (often earlier than the start time for check-in), transport route, parking or transit, and locker or storage arrangements for bags and phones.
Time budget and question strategy
Decide in advance how long to spend per question, how to handle flagged items, and whether unanswered items score zero or can be revisited. Confirm the scoring and negative-marking policy with the provider.
Personal ISO/IEC 27005 revision sheet
One page in your own words: risk-management process steps, risk-assessment versus risk-treatment activities, risk criteria, risk register concepts, monitoring and review, and the vocabulary you must use precisely.
Scenario-practice notes
Summaries of practice scenarios you have worked through: how you identified assets, threats, vulnerabilities, existing controls, likelihood, consequence, and treatment options. Bring the reasoning patterns, not memorised answers.
Break and refreshment plan
Confirm with the provider whether breaks are allowed, whether the clock stops, and whether water or snacks are permitted at the desk. Plan hydration and medication around the confirmed rules.
Technical backup for remote delivery
Charged laptop, charger, backup internet option such as a phone hotspot, and the provider's support contact number written down offline in case the platform fails.
Provider support contacts
Save the exam provider's support line and email offline. If a technical or ID issue arises, contacting support promptly and documenting it matters more than improvising.
Rest and focus routine
Plan a normal night's sleep, a light meal, and a short arrival buffer. Avoid last-minute cramming of unfamiliar material that can erode confidence on process questions.
Plan the day
Re-read your own one-page summary of the ISO/IEC 27005 risk-management process and confirm the exam format, allowed aids, and scoring rules with the provider. Do one timed practice set under exam conditions and review only the questions you got wrong, focusing on why the chosen option was weaker than the correct one.
Work through two or three end-to-end scenarios: define scope and risk criteria, identify assets, threats, and vulnerabilities, assess risk, select treatment options, and describe monitoring and review. Practise writing or choosing answers that use precise vocabulary such as risk source, event, consequence, likelihood, residual risk, and risk owner.
Light revision only: skim your summary sheet, the process steps, and your list of recurring mistakes. Verify logistics: ID, confirmation, address or remote-setup check, transport, and support contacts. Pack what you are allowed to bring. Confirm with the provider anything still unclear about breaks, aids, or arrival time. Sleep early.
Eat properly, arrive with buffer time, and avoid new material. At check-in, follow ID and security instructions exactly. For remote delivery, start the platform early, complete the room scan, and keep your support contact visible.
Read the instructions and confirm the number of questions, time limit, and how to flag and revisit items. Do a quick scan of the paper or screen to gauge difficulty distribution before committing to a pace.
Answer confident questions first and flag uncertain ones. For scenario questions, identify what is being asked (assessment, treatment, acceptance, communication, or monitoring) before choosing. Eliminate options that skip a process step, confuse risk with control, or treat residual risk as zero. Return to flagged items with remaining time and check that every required item is answered.
Confirm no unanswered items remain, review flagged questions only where you have a clear reason to change an answer, and submit deliberately. Note any technical incidents for the provider if something went wrong.
Rules to check
Bring the original photo ID that matches your registration and present it when asked. If your ID has changed or the name differs, confirm with the provider before exam day; do not rely on improvisation at check-in.
Follow all security and conduct instructions from the invigilator or proctor, including desk clearance, phone storage, room scans for remote delivery, and restrictions on leaving the view of the camera.
Do not communicate with others, use unauthorised materials, or attempt to capture or share exam content. Treat the questions as confidential; misconduct can void your result.
Use only the aids, standard text, or notes that the provider explicitly permits. If you are unsure whether something is allowed, confirm with the provider in advance rather than bringing it.
Confirm the break policy with the provider before the exam. Unless breaks are explicitly allowed, plan to remain at your station for the full duration; if breaks are permitted, know whether the clock continues.
Understand the scoring rules before you start: whether there is negative marking, whether multiple responses are penalised, and what the pass mark is. Confirm these with the provider rather than assuming.
If a technical failure, interruption, or ID issue occurs, stop and contact provider support immediately, note the time and details, and follow their instructions; do not attempt to fix platform problems by yourself.
Arrive or log in at the time the provider specifies, which may be earlier than the stated start. Late arrival may mean refused entry or reduced time, so confirm the cut-off with the provider.