PECB ISO 28000 Foundation common mistakes
PECB ISO 28000 Foundation · Understand the traps and how to avoid them.
Treating ISO 28000 as a generic information-security standard and answering questions with ISO 27001 concepts (CIA triad focus, asset classification, risk treatment options).
Candidates arrive from an IT security background and pattern-match 'security management system' to the standard they already know, so they miss that ISO 28000 is a supply-chain security management system concerned with threats to the supply chain itself, not data confidentiality.
What to do instead
Before answering, restate the scope in your own words: ISO 28000 addresses security assurance across the supply chain, including physical, personnel, process, and information aspects, with the supply chain as the object of protection. Build a one-page comparison of ISO 28000 vs. ISO 27001 scope and vocabulary and review it before practising questions.
Confusing 'security management system' (SeMS) with a security plan or a set of guards and controls, and choosing answers that describe operational security measures rather than management-system elements.
The word 'system' is read colloquially as 'a set of controls', so candidates pick options describing CCTV, access control, or a guarding contract instead of the Plan-Do-Check-Act management cycle of policy, planning, implementation, evaluation, and improvement.
What to do instead
Memorise the SeMS as a management cycle with defined elements (policy, security risk assessment and planning, implementation and operation, checking and corrective action, management review, continual improvement). For any question, ask 'is this an element of the management system or an operational control?' and eliminate operational controls when the question asks about the SeMS.
Mixing up Clause 4 context-of-the-organization outputs, naming interested parties and their requirements but omitting the determination of the SeMS scope, or treating scope as a one-off statement unrelated to the security risk assessment.
Clause 4 has several distinct outputs (external and internal issues, interested parties and their requirements, scope, the SeMS itself) and candidates compress them into a single 'understand the business' step, so they miss the specific requirement being tested.
What to do instead
Learn Clause 4 as a sequence with named outputs: issues (external and internal), interested parties and their relevant requirements, scope of the SeMS (with justification for exclusions), and the establishment of the SeMS. Practise writing the four outputs for a fictional logistics company so each one is distinct in your memory.
Answering leadership questions with 'top management must appoint a security manager and delegate the SeMS', rather than recognising that top management retains accountability, provides direction, integrates the SeMS into business processes, and ensures resources.
In real organizations security is often delegated, so candidates describe practice rather than requirement. The standard's leadership clause deliberately separates accountability (top management) from authority (assigned roles), and candidates collapse the two.
What to do instead
Memorise the leadership clause as: top management demonstrates leadership and commitment, establishes the security policy, ensures roles, responsibilities, and authorities are assigned and communicated, and remains accountable. When a question mentions delegation, check whether the option preserves top-management accountability; discard options that transfer it.
Treating the security policy as a document to be written by the security team and approved later, and choosing answers that omit the requirement that the policy be appropriate to the organization's purpose and context, include commitment to satisfy applicable requirements and to continual improvement, and be communicated and available.
Candidates reduce the policy to a formatting exercise and forget that the standard prescribes content and communication requirements, not just existence.
What to do instead
Build a checklist of the policy requirements (appropriate to purpose and context including the nature and scale of security risks; commitment to satisfy applicable requirements; commitment to continual improvement; documented, communicated, available to interested parties as appropriate). Test each answer option against the checklist rather than judging whether it 'sounds like a policy'.
Skipping or under-specifying the security risk assessment: listing threats only, or producing a risk list without criteria, without considering likelihood and consequence, and without linking outputs to the controls selected.
Candidates are comfortable with threat identification and stop there, or they import a generic risk matrix without noticing that the standard requires defined criteria and a documented process whose results feed the selection of controls.
What to do instead
Learn the risk-assessment requirements as a process with inputs, criteria, and outputs: define and apply risk criteria (including acceptability), identify security threats and vulnerabilities relevant to the supply chain, analyse likelihood and consequence, evaluate against criteria, and record results. Practise explaining how each output is consumed by the next step so the chain from assessment to controls is explicit.
Treating documented information as 'all documents must be controlled by the security department' and missing the distinction between maintaining documented information and retaining it as evidence, plus the requirement that it be appropriate, available, protected, and controlled for revision and approval.
Candidates memorise 'document control' as a single idea and cannot distinguish creating/maintaining information from retaining evidence of results, which is exactly what questions probe.
What to do instead
Learn the two verbs: maintain documented information (needed for the effectiveness of the SeMS, such as policy, scope, risk criteria) and retain documented information (evidence of results, such as risk assessment results and monitoring records). For each clause, note which verb appears, and remember the control requirements: availability, suitability, protection, distribution, access, retrieval, and use.
Assuming ISO 28000 prescribes specific security controls and selecting answers that name particular measures (fencing height, patrol frequency, screening technology) as requirements of the standard.
Candidates expect a control catalogue like Annex A of other standards, so they look for prescribed measures. ISO 28000 requires a management system and risk-based selection of controls, and does not mandate specific technologies or numeric thresholds.
What to do instead
Anchor the principle: the standard specifies what the management system must do, not which controls to implement. When an option names a specific control as a requirement, treat it as a distractor unless the question asks for an example of an output of the risk assessment. Practise identifying options that are examples versus options that are requirements.
Confusing performance evaluation activities: describing monitoring and measurement as internal audit, or internal audit as management review, and failing to place corrective action in the improvement clause rather than in checking.
The clauses overlap in everyday language ('we check things'), and candidates map all checking activities to whichever clause they remember first. The programme structure (monitoring and measurement, internal audit, management review, nonconformity and corrective action) is a favourite exam discriminator.
What to do instead
Build a table with four rows: monitoring and measurement (what, how, when, who, and when results are analysed and evaluated), internal audit (planned intervals, audit criteria and scope, auditor objectivity and impartiality, reporting to management), management review (inputs and outputs, decisions on improvement and resources), and corrective action (react, evaluate the need to eliminate the cause, implement, review effectiveness, update risks if needed). Assign each practice question to a row before choosing.
Answering continual improvement questions with 'fix the nonconformity and close it', omitting the requirement to improve the suitability, adequacy, and effectiveness of the SeMS and to consider the results of analysis and evaluation and management review outputs.
Candidates equate improvement with corrective action, so they choose the narrow option. The improvement clause is broader than nonconformity handling and is often tested through scenario questions about management review outputs.
What to do instead
Separate the two: corrective action deals with nonconformity and its cause; continual improvement enhances the SeMS's suitability, adequacy, and effectiveness, drawing on performance evaluation and management review. When a scenario asks what happens after management review identifies a weak area, choose the option that changes the system, not just the option that closes a finding.