ISO/IEC 27002 Foundation

You can apply for the designation "PECB Certificate Holder in ISO/IEC 27002 Foundation." The certificate requirements table lists only passing the exam, with no professional experience, no MS audit or assessment experience, and no ISCMS project experience required. You must also sign the PECB Code of Ethics. Certificate and examination fees are included in the training course price.

The source does not state the number of questions, the duration, the passing score, or the item format on this page. It only says the exam fully meets the requirements of the PECB Examination and Certificate Programme and directs candidates to the List of PECB Exams and the Examination Rules and Policies for exam type, languages, and other details. Check those documents before booking.

There are two competency domains, each weighted 50 percent: fundamental principles and concepts of information security, cybersecurity, and privacy, and information security controls based on ISO/IEC 27002. Because the weighting is even, do not treat the conceptual first domain as a warm-up. The controls domain is the larger body of factual detail, so budget study time accordingly.

No. The course page states plainly that there are no prerequisites to participate in the training course. The certificate requirements also list no professional experience, audit experience, or project experience. That makes it accessible to career changers, but it also means the course assumes no prior ISMS background, so expect to learn vocabulary such as ISMS and control themes from scratch.

You can retake the exam within 12 months for free. Plan your first attempt so that a retake is a safety net rather than the strategy: sit the exam soon after the course while the material is fresh, and keep your notes and quizzes, since a retake inside the 12-month window costs nothing but a failed attempt outside it may not be covered.

Follow the published agenda. Day 1 covers the introduction to ISO/IEC 27002 and the organizational controls; Day 2 covers people, physical, and technological controls, then the exam. Build the conceptual base first, then work theme by theme through the controls, and finish by practising interpretation, because the stated objective is to interpret controls in the specific context of an organization, not to recite them.

An attestation of course completion worth 14 CPD (Continuing Professional Development) credits is issued to participants who have attended the training course. Note that the attestation is tied to attendance, not to passing the exam, so the credits reflect course completion. The source does not state a separate recertification cycle or CPD requirement for maintaining the Foundation certificate.

Two traps stand out from the stated objectives. First, memorizing control names without being able to interpret them for a given organization, which is exactly what the third learning objective asks. Second, ignoring the relationship between ISO/IEC 27002, ISO/IEC 27001, and ISO/IEC 27003, which is a separate stated objective. Also verify exam logistics on the official exam pages rather than relying on secondhand summaries.

Training material containing over 200 pages of information and practical examples is distributed to participants. The educational approach uses lecture sessions illustrated with practical questions and examples, and participants complete quizzes and exercises structured similarly to the certificate exam. Use those quizzes as diagnostics: a wrong answer points to a theme you cannot yet interpret, not just a fact to memorize.

No. ISO/IEC 27002 Foundation is an individual knowledge certificate about information security controls. The course discusses how ISO/IEC 27002 relates to ISO/IEC 27001 and ISO/IEC 27003, but passing this exam does not certify an organization's management system and does not make you an auditor. If your goal is implementing or auditing an ISMS, look at the 27001 and 27002 Manager and Lead Manager tracks instead.