ISO 27001 Transition exam-day guide
ISO 27001 Transition · Prepare for the day ahead.
Your checklist
Valid government-issued photo ID
Bring the exact ID document named on your registration. The name must match your registration record. If you registered with a passport, bring that passport, not a different document. Confirm with the provider which ID types are accepted for your delivery method (test centre versus online proctored).
Second form of ID (if required)
Some delivery providers require a second ID or a signature-bearing card. This varies by provider and location, so confirm with the provider before exam day rather than assuming one document is enough.
Appointment confirmation and candidate number
Have your booking confirmation, appointment time, and any candidate or eligibility number available, printed or on your phone. You may need the number if you contact support on the day.
Know your exam version and scope
Confirm whether your exam targets the current edition of ISO/IEC 27001 and its associated control set, and which transition path applies to your existing certification. Exam content and eligibility rules change between editions, so confirm the exact scope with your certification body.
Review the official candidate handbook
Read the provider's candidate handbook for rules on conduct, allowed materials, breaks, and scoring. Do not rely on second-hand summaries; the handbook is the authoritative source for your sitting.
Confirm allowed reference material
Most certification exams are closed-book, but confirm with the provider whether any standard text, notes, or calculator is permitted. Do not bring unauthorised material into the test room.
Test the online proctoring setup (if remote)
If sitting remotely, run the provider's system check in advance: camera, microphone, browser lock, bandwidth, and a quiet private room. Confirm with the provider which software and room conditions are required.
Plan travel and arrival buffer
For a test centre, arrive before the reporting time stated in your confirmation. Allow extra time for security checks and ID verification. Late arrival can mean refused entry and forfeited fees, so confirm the provider's cut-off.
Rest and logistics the night before
Confirm the start time in your local time zone, set two alarms, and prepare clothing and transport. Avoid last-minute cramming of new material; consolidate what you already know.
Prepare for the question style
Expect scenario-based questions on ISMS scope, risk assessment and treatment, Annex A control selection, and audit and continual improvement. Practise reading each stem fully and eliminating distractors before answering.
Know the scoring and pass mark in advance
Confirm with the provider the number of questions, time allowed, pass mark, and whether scoring is scaled. These details differ between certification schemes and editions.
Have provider support contact ready
Save the provider's candidate support number or email in case of technical failure or a scheduling problem on the day.
Plan the day
Re-read your own summary notes on the ISMS clauses (context, leadership, planning, support, operation, performance evaluation, improvement) and the structure of the control set. Focus on how risk assessment drives control selection, and on the difference between the standard's requirements and its guidance. Do not start new topics.
Do one timed practice set under exam conditions to check your pacing. Note which question types slow you down, such as multi-part scenarios or questions asking for the 'best' or 'most appropriate' action. Review only the explanations for questions you got wrong.
Confirm all logistics: appointment time in your local time zone, venue address or remote-session link, ID documents, and travel plan. Re-run the online proctoring system check if sitting remotely.
Do a light review of weak areas only, then stop. Prepare your ID, confirmation, and any permitted items in one place. Check the provider's rules on breaks, allowed items, and what happens if technical issues occur.
Protect your sleep. Avoid studying late into the night; recall and reasoning on scenario questions depend more on rest than on one more hour of revision.
Eat, hydrate, and arrive or log in early. Re-read only your one-page summary of key distinctions, such as corrective action versus preventive action, risk owner versus risk treatment, and internal audit versus management review.
Read each question fully and identify what is being asked before looking at the options. Answer the easier questions first if the platform allows navigation, then return to flagged items. Eliminate clearly wrong options and choose the best remaining answer.
Watch the clock against the number of questions remaining. Leave time to review flagged questions and to ensure no question is left unanswered if the platform does not penalise guessing. Confirm with the provider whether unanswered questions are scored as incorrect.
Note any question topics you found difficult while memory is fresh, for your own development. Follow the provider's stated process and timeline for results and any next steps in your certification transition.
Rules to check
Bring the ID document specified in your registration and confirm accepted ID types with the provider. If your ID does not match your registration details, you may be refused entry and your fee may not be refunded.
Follow all instructions from the invigilator or proctor. Unauthorised materials, notes, phones, or other devices in the test area can lead to invalidation of your result, so confirm with the provider what is permitted before you sit.
Do not communicate with other candidates during the exam and do not share, record, or reproduce exam questions afterwards. Certification schemes treat question disclosure as misconduct.
Confirm with the provider whether breaks are allowed, how they are timed, and whether the clock stops. Rules differ between test centre and remote proctored delivery, so do not assume.
Confirm with the provider how scoring works, including the pass mark, whether some questions are unscored pilot items, and whether incorrect answers are penalised. These details affect your answering strategy.
If a technical failure occurs during a remote exam, stop and follow the provider's stated support process rather than attempting workarounds. Report the issue promptly so it can be documented.
Arrive or log in before the reporting time stated in your confirmation. Late arrival may result in refused entry or a shortened exam, and rescheduling rules are set by the provider.
Raise any special accommodation needs with the provider well before exam day; arrangements cannot usually be made at short notice on the day itself.