ISO 27002 Lead Manager exam-day guide
ISO 27002 Lead Manager · Prepare for the day ahead.
Your checklist
Confirm the exact exam format and logistics with your accredited training provider
ISO/IEC 27002 Lead Manager is delivered through accredited certification bodies and training providers, and the exam format (question count, duration, open- or closed-book status, pass mark, and delivery method-online proctored or test centre) can differ between providers. Do not rely on second-hand accounts; get written confirmation from the organisation that will administer your exam, and note whether any official standard text is permitted in the room.
Government-issued photo ID matching your registration name
Online proctoring and test centres almost universally require photo identification. The name must match the name on your exam registration exactly. Confirm with the provider which ID types are accepted and whether a secondary ID is required; bring the original, not a photocopy.
Your exam appointment confirmation and candidate number
Keep the confirmation email or booking reference accessible-printed and on your phone. You may need it at check-in or if the proctor has to verify your session. Save the provider's support phone number in case of technical failure.
Printed or permitted reference material, only if the provider confirms it is allowed
Some providers run open-book exams; others prohibit all materials. If open-book is confirmed, prepare a tabbed, annotated copy of the standard with your own index of clause numbers-but verify in advance whether printed materials, sticky notes, and annotations are permitted, since rules vary.
A reliable computer, webcam, microphone, and stable internet connection for online delivery
Run the provider's system check at least 48 hours before the exam. Close background applications, disable notifications, and have a backup plan (a phone hotspot or a second device) in case your primary connection drops. For test-centre delivery this item can be skipped.
A quiet, private, well-lit room with a clear desk
Proctored online exams typically require an enclosed room, no other people present, and a desk free of notes, phones, and secondary screens unless explicitly allowed. Expect a 360-degree room scan and screen sharing. Clear the space the night before.
Review your own summary sheet of ISO/IEC 27002:2022 structure
Be able to recall the four thematic clauses (organisational, people, physical, technological), the five attribute types (control type, information security properties, cybersecurity concepts, operational capabilities, security domains), and the total number of controls. A one-page personal index of clause numbers and control names is the highest-value revision artefact in the final days.
Practise scenario-style questions under timed conditions
Lead Manager exams test application and judgement, not recall alone. Work through practice scenarios where you must select, justify, or sequence controls, and practise writing concise audit-style answers if the exam includes constructed-response items. Confirm the item types with your provider first.
Know the difference between 27001 requirements and 27002 guidance cold
A frequent source of lost marks is treating 27002 as certifiable requirements. Be ready to explain that 27001 states requirements (including Annex A as a normative reference to the 27002 control set) while 27002 provides implementation guidance, and that a Statement of Applicability must justify inclusions and exclusions.
Water and a light snack for scheduled breaks only
Confirm the provider's break policy before the exam day. Some allow unscheduled breaks with time still running; others prohibit leaving the camera view. Eat properly beforehand so you are not distracted, and keep water in a clear container if permitted.
Plan the day
Re-read your own condensed notes rather than the whole standard. Focus on the control themes, the attribute scheme, and how controls map to risk treatment and the Statement of Applicability. Do one full timed practice paper and review every wrong answer to identify the pattern of your errors-usually confusing 27001 requirements with 27002 guidance, or misreading scenario questions that ask for the 'best' rather than the 'first' action.
Run the provider's technical system check for online delivery, or confirm the test-centre address, parking, and travel time. Verify your ID matches your registration name. Re-read the provider's candidate handbook for rules on materials, breaks, and misconduct so nothing surprises you on the day.
Do light revision only-review your one-page index of clause numbers and control names. Prepare your ID, confirmation, and any permitted materials in one place. Confirm the start time in your local time zone, including any daylight-saving difference. Set two alarms. Stop studying in the evening and get a full night's sleep; cramming new material now has poor returns.
Eat a proper meal and avoid last-minute cramming beyond a quick glance at your index. Log in or arrive early-typically 15 to 30 minutes ahead-to allow for identity checks and room scans. Have your workspace already cleared and your ID in hand. Take a few slow breaths; if a technical problem occurs, contact provider support immediately and note the time.
Read each question twice and identify the command word-'identify', 'justify', 'sequence', 'select the best'. For scenario questions, ask what a Lead Manager would actually do in a real audit or implementation, and eliminate options that skip risk assessment or bypass top management. Answer the questions you are sure of first, flag uncertain ones, and return to them. For constructed responses, structure answers with clear points and use standard terminology. Watch the clock: allocate time proportional to marks and reserve the final minutes to check that no question is unanswered.
Rules to check
Present original government-issued photo ID whose name matches your registration exactly; confirm accepted ID types and any secondary ID requirement with the provider before the exam day.
Bring only materials the provider has explicitly authorised. If the exam is closed-book, all notes, phones, smart watches, and secondary screens must be removed from the room; if open-book is permitted, confirm whether annotations and tabs are allowed.
Do not communicate with anyone other than the proctor during the exam, and do not leave the camera view without permission. Rules on unscheduled breaks and whether the clock keeps running vary-confirm with the provider.
Treat the exam content as confidential. Do not copy, photograph, record, or share questions or answers, and do not discuss specific items in public forums afterwards; doing so is typically treated as misconduct.
Report any technical failure, interruption, or suspected irregularity to the proctor or provider support immediately and keep a record of the time, so that your attempt can be reviewed fairly.
Scoring and pass marks are set by the certification body and may vary between providers and exam versions. Do not assume a pass threshold-confirm the current pass mark, scoring method, and any negative-marking policy with your provider.
If you need a resit, special accommodation, or a different delivery mode, request it through the provider's formal process rather than on exam day; accommodation requests usually have lead times.
Follow the provider's integrity declaration in full. Attempting to use unauthorised assistance or impersonating another candidate can result in invalidation of your result and exclusion from future certification attempts.