PECB ISO 28000 Transition common mistakes
PECB ISO 28000 Transition · Understand the traps and how to avoid them.
Treating ISO 28000:2022 as a clause-by-clause update of the 2007 edition and memorising a one-to-one mapping (for example assuming 2007 clause 4.2 'Security policy' simply became 2022 clause 5.2), then answering mapping questions from that assumed correspondence.
Candidates transfer their 2007 clause knowledge without checking the 2022 High Level Structure alignment; the 2022 edition renumbers and reassigns content (context in Clause 4, leadership in Clause 5, planning in Clause 6, support and operation in 7 and 8), so assumed pairings produce wrong answers on clause-comparison items.
What to do instead
Build a personal crosswalk table with three columns: 2007 clause, 2022 clause, and 'moved / new / deleted / retained'. Verify each row against the published clause titles of both editions before the exam, and practise answering 'which 2022 clause now carries this 2007 requirement' questions from the table rather than from memory.
Describing the 2022 standard as a 'security management system' standard only, and omitting that its scope is now framed around security and resilience across the organisation's activities, products and services, including supply chain and third-party interfaces.
The 2007 title and scope were written narrowly around security assurance for the supply chain; candidates who studied only the older scope statement miss the broader 2022 framing and pick distractor answers that limit applicability to physical guarding or logistics.
What to do instead
Write out the 2022 scope statement in your own words, explicitly listing the organisational activities, products, services and interested-party interfaces it covers, and compare it line by line with the 2007 scope. Use that written comparison to reject any answer option that narrows the standard to guarding or to transport security alone.
Confusing ISO 28000:2022 with ISO 28001 or with ISO 22301 when answering questions about supply chain security management, certification scope, or business continuity, and selecting answers that describe continuity management system requirements.
The ISO 28000 family and the ISO 223xx continuity family overlap in vocabulary (resilience, disruption, incident), and candidates who have not separated the documents by title, purpose and requirement type default to whichever standard they studied most recently.
What to do instead
Create a one-page comparison of ISO 28000:2022, ISO 28001 and ISO 22301 covering title, purpose, requirement type and intended user. Before answering any question, identify which document the stem names and eliminate options that describe the other documents' characteristic requirements.
Answering questions about 'context of the organisation' with generic ISO High Level Structure content (for example only internal and external issues) and failing to address the security-specific inputs the 2022 edition expects, such as the organisation's security environment, dependencies and the needs of interested parties.
Candidates learn Clause 4 from other management system standards and assume the wording is identical everywhere; the security-specific interpretation of context in ISO 28000:2022 is what the exam is testing, so generic answers are marked wrong.
What to do instead
For Clause 4, prepare a list of concrete inputs a security manager would actually gather: threat landscape, regulatory and contractual obligations, supply chain dependencies, interested-party expectations and internal capability. Practise writing a short context analysis for a fictional organisation so the security-specific content becomes automatic.
Assuming the 2022 edition removed the requirement for a security policy or for management commitment because the clause numbers changed, and therefore answering that leadership requirements were reduced.
Candidates see that the 2007 'security policy' clause no longer appears under the same number and infer deletion, when in fact leadership and policy requirements were retained and strengthened through alignment with the High Level Structure.
What to do instead
Mark every 2007 requirement as retained, relocated or removed using the actual text of both editions, and pay particular attention to requirements that moved into Clause 5. When a question implies a requirement was deleted, check your crosswalk before choosing.
Producing an implementation plan for a transition that starts with documentation rewriting (rewriting the security manual and procedures first) and only later addresses risk assessment, context and leadership.
Candidates default to a documentation-driven project because the 2007 edition was procedure-heavy, and they underestimate that the 2022 edition requires the risk and context work to drive the documented information rather than follow it.
What to do instead
Sequence the plan as: gap analysis, context and interested parties, risk assessment methodology and results, leadership and policy alignment, then documented information updates, then internal audit and management review. State the dependency logic explicitly in any planning answer so the examiner sees why documentation comes after risk.
Writing a transition plan with no gap analysis step, or with a gap analysis that only lists missing documents rather than comparing existing arrangements against each 2022 requirement.
Candidates treat gap analysis as a formality and equate it with a document checklist; exam scenarios reward a structured comparison of current practice against requirement, including evidence of what already conforms.
What to do instead
Design the gap analysis as a clause-by-clause matrix recording, for each 2022 requirement: current practice, evidence available, gap description, severity and owner. Include a column for requirements already satisfied so the plan shows effort is proportionate, and describe how findings feed the implementation roadmap.
Presenting a transition timeline with fixed dates but no defined roles, resources, competence requirements or communication activities, and no link to the organisation's risk priorities.
Candidates focus on the technical content of the standard and treat project management elements as padding, whereas the exam expects the plan to show who does what, with what competence and resource, and in what order.
What to do instead
For each implementation phase, specify the accountable owner, the resources and budget, the competence or training needed, the communication to interested parties and the completion evidence. Add a prioritisation rule that ranks actions by security risk so the plan reads as risk-driven rather than calendar-driven.
Planning the transition without addressing how performance will be monitored and measured under the 2022 edition, or without revising internal audit and management review inputs to reflect the new structure.
Candidates concentrate on clauses that visibly changed wording and skip the monitoring, measurement, analysis and evaluation requirements and the audit programme, which are easy to overlook but frequently examined in transition scenarios.
What to do instead
Add a section to the plan defining what will be monitored, the metrics and their frequency, who analyses results and how findings escalate. Explicitly state how the internal audit programme and management review agenda will be updated to cover context, risk, interested parties and outsourced or third-party processes.
Ignoring outsourced and third-party processes in the transition plan, or treating supply chain security as outside the management system boundary, when answering questions about implementation scope and control.
Candidates carry over the 2007 assumption that security assurance is largely about the organisation's own operations and forget that the 2022 edition expects the organisation to determine how outsourced processes are controlled and to consider supply chain dependencies within its management system.
What to do instead
In every implementation answer, include a step that identifies outsourced and third-party processes, defines the type and degree of control applied to each, and records the criteria in documented information. Practise phrasing this as a control decision based on risk rather than as an automatic requirement to audit every supplier.