ISO 27035 LIM exam-day guide
ISO 27035 LIM · Prepare for the day ahead.
Your checklist
Confirm the exact exam format and delivery method with the provider
ISO 27035 is a standard, not an exam. Any certification that tests it (for example a Lead Implementer or Lead Incident Manager credential from a training body) is delivered by that body. Before you plan anything, confirm with the provider whether the test is multiple-choice, essay/scenario-based, open-book, or a combination, and whether it is taken at a test centre or by remote proctoring. Do not assume the format from another certification you have taken.
Government-issued photo ID matching your registration name
Bring the original document (passport or national ID card), not a photocopy. The name must match your registration exactly, including middle names and diacritics. If your ID is expired or the names differ, contact the provider well before exam day; remote proctoring services often reject mismatches at check-in with no refund.
Registration confirmation and appointment details
Have the confirmation email or booking reference available, plus the provider's support phone number in case of technical failure. For remote exams, keep this off-screen but within reach so you can quote the reference if the proctor needs it.
Print or download the provider's exam regulations and permitted-materials list
Rules on open-book use, annotation, scratch paper, and calculators vary between providers. Read the version issued for your specific exam and note anything ambiguous. If the rules do not clearly state whether you may consult ISO/IEC 27035 during the test, confirm with the provider in writing before exam day.
A clean, working copy of ISO/IEC 27035-1 and 27035-2 if the exam is open-book
Use a bound printed copy or a provider-approved offline file; tabs and index notes are usually allowed only if the provider says so. Know the clause structure well enough to navigate in seconds, because open-book exams are time-pressured and searching costs marks. If the exam is closed-book, leave the standard at home as instructed.
Your own one-page summary of the incident-management process
Condense the plan-detect-report-assess-respond-learn cycle, key roles (incident response team, incident manager, communications lead), and the evidence-handling principles into a single sheet you can review in the final minutes. This is for pre-exam revision unless the provider explicitly permits notes in the room; confirm what counts as permitted material.
Settled logistics: travel time, parking, or a quiet remote-test room
For a test centre, arrive with buffer for traffic and security checks. For remote delivery, book a private room with a stable wired connection, close the door, and tell household members not to enter. Test your webcam, microphone, and browser check the day before.
Remote-proctoring system check completed in advance
Most remote providers require a system test and a room scan at check-in. Run the compatibility check at least 24 hours ahead so you have time to fix drivers or permissions. Close all other applications and disable notifications before you start.
Water and a light snack for before the exam, not during
Many providers prohibit food and drink at the desk during the test. Hydrate and eat beforehand, and use any scheduled break the provider allows. Confirm the break policy with the provider rather than assuming you can leave the room mid-exam.
A watch or awareness of the on-screen timer
Know the total duration and the number of questions so you can allocate time per question. If the provider publishes a mark scheme or weighting, use it to decide how long to spend on scenario questions versus short factual ones.
Scratch paper and pen only if the provider permits them
Some remote proctoring services forbid all paper and require an on-screen notepad. Check the permitted-items list and, if unsure, confirm with the provider. If paper is allowed, show both sides to the camera at check-in as instructed.
needs_review: Provider-specific pass mark and result timeline
Pass thresholds, whether results are immediate or delayed, and retake rules are set by the certification body and differ widely. Do not rely on figures from forums. Confirm the pass mark, scoring method, and retake policy with the provider before you sit the exam.
Plan the day
Re-read the provider's exam regulations and permitted-materials list line by line, and resolve any ambiguity by emailing the provider. Confirm the appointment time in your own time zone, the delivery method, and the cancellation or reschedule window. Then do a final structured revision pass over the incident-management process: planning and policy, detection and reporting, assessment and decision, response and containment, evidence handling, communication with internal and external parties, and post-incident review with lessons learned. Practise explaining, in your own words, how an incident-response plan links to risk assessment, business continuity, and legal or regulatory notification duties, because scenario questions often test those interfaces rather than isolated definitions.
Complete the remote system test or plan your route to the test centre with a realistic travel buffer. Prepare your ID and confirmation in one place. Pack only permitted items. Do a light revision of your one-page summary, then stop studying early enough to sleep properly; fatigue costs more marks than one extra hour of reading. Set two alarms and check that your exam-day room will be quiet and free of prohibited items.
Eat a proper meal and hydrate. Re-read only your one-page summary; do not start new material. Log in or arrive early as the provider instructs, complete identity checks and the room scan calmly, and keep your ID and booking reference within reach. Close every other application and silence your phone, placing it where the proctor requires. Take a few slow breaths and remind yourself of your time-per-question plan before the timer starts.
Read the whole question before answering, and watch for qualifiers such as 'first', 'most appropriate', or 'primary responsibility', which change the correct answer in scenario items. Answer the questions you know first and flag the rest; do not let one hard item consume the time budgeted for several. For open-book items, navigate by clause structure rather than reading whole sections. For scenario questions, identify the phase of the incident-management process and the role responsible before choosing an option. If a technical failure occurs, stop and contact the proctor or provider support immediately and note the time, rather than trying to fix it alone.
Rules to check
Bring original government-issued photo ID whose name matches your registration exactly; entry may be refused and fees forfeited if it does not. Confirm accepted ID types with the provider in advance.
Follow the provider's permitted-materials list strictly. Whether the ISO/IEC 27035 standard, annotated copies, or personal notes are allowed varies by exam, so confirm with the provider and do not bring anything the list does not authorise.
No unauthorised devices, communication, or assistance. Phones, smart watches, and second screens must be stowed or removed as instructed; during a remote exam, leaving the camera view or having another person enter the room can lead to invalidation.
Breaks are governed by the provider. Some exams allow a scheduled break with the timer paused, others do not pause the clock. Confirm the break policy with the provider and, if a break is allowed, follow the sign-out and sign-in procedure exactly.
Scoring and pass marks are set by the certification body, not by ISO. Confirm the pass threshold, whether questions are weighted, and whether wrong answers are penalised with the provider before the exam.
If you believe a question is defective or the system fails, report it to the proctor or provider support during or immediately after the session and keep any reference number; do not attempt to resolve it after leaving without a record.
Respect the provider's academic-integrity terms: do not share, reconstruct, or publish exam questions afterwards, and do not discuss live exam content with other candidates.