ISO/IEC 27002 Manager exam-day guide
ISO/IEC 27002 Manager · Prepare for the day ahead.
Your checklist
Confirm the exact exam format with the provider
ISO/IEC 27002 itself is a guidance standard, not a certification scheme, so any 'ISO/IEC 27002 Manager' exam is delivered by a specific certification body or training provider. Before you plan anything, confirm with the provider: the number of questions, time allowed, pass mark, delivery method (test centre vs online proctored), whether it is open book, and whether question types include multiple response, drag-and-drop, or scenario matching. Do not rely on second-hand accounts of the format.
Government-issued photo ID matching your registration name
Bring the original document (passport or national ID card are the safest choices). The name must match your booking exactly, including middle names. Check the ID is unexpired. If you have changed your name or registered with a shortened form, contact the provider in advance to correct it; on the day it may be too late. Confirm with the provider which ID types they accept for online proctoring, as some reject certain documents.
Appointment confirmation and candidate number
Have the confirmation email, booking reference, and candidate/registration number accessible. For a test centre, note the address, building entrance, and arrival time. For online delivery, have the login link and any system-check pass code ready. Save a screenshot of the confirmation in case email access is unavailable at the venue.
Pre-run the online proctoring system check
If the exam is remotely proctored, run the provider's system test at least a few days ahead: browser version, webcam, microphone, bandwidth, and any secure browser lockdown client. Repeat the check 24 hours before. Confirm with the provider whether a wired connection is required and whether a second monitor must be physically disconnected.
Know the standard's structure well enough to navigate mentally
You cannot bring the standard into a closed-book exam, so be able to recall the clause architecture: the main security control clauses (organizational, people, physical, technological) and the theme of each. Practise locating a control by theme rather than by number, since questions are usually scenario-based rather than asking for clause numbers. If the exam is open book, confirm with the provider exactly which materials are permitted and whether annotated or tabbed copies are allowed.
Revise the control-purpose mindset, not memorised wording
Questions typically present a situation and ask which control area applies or what the next step should be. Train yourself to ask: what is the asset, what is the risk, which control theme addresses it, and what does the standard say the control is for. Review Annex A control objectives at the level of intent so you can distinguish similar controls (for example access control vs. privileged access management, or logging vs. monitoring).
Prepare permitted items only
Confirm with the provider what is allowed at the desk: water in a clear container, tissues, earplugs, a physical calculator, or nothing at all. For online exams, clear your desk completely, remove phones and smart watches, and close other applications. Unpermitted items can lead to invalidation regardless of intent.
Plan arrival, travel, and a buffer
For a test centre, arrive earlier than the stated check-in time to absorb transport delays and security screening. Identify parking or the nearest transit stop in advance. For online delivery, book a quiet room where you will not be interrupted, tell household members, and silence doorbells and notifications.
Confirm break and timing rules with the provider
Ask in advance whether scheduled or unscheduled breaks are allowed, whether the clock stops during a break, and what re-entry checks apply. Rules vary widely between providers, so treat this as something to confirm rather than assume. If no breaks are permitted, plan hydration and restroom visits accordingly.
Clarify scoring and review behaviour
Confirm with the provider whether scoring is criterion-referenced (a fixed pass mark) or scaled, whether questions are equally weighted, and whether there is a penalty for guessing. Ask whether you can flag and review questions before submitting and whether you can change answers. This determines your exam strategy far more than extra revision.
Set up a question-logging habit for practice
During practice, keep a short log of every question you got wrong and why: misread the stem, missed a qualifier such as 'BEST' or 'FIRST', or genuinely did not know the control. Review this log in the final 24 hours instead of re-reading the whole standard. This is the highest-yield revision activity for scenario-style exams.
Confirm results and certificate process
Ask the provider how and when results are issued (on-screen, by email, provisional vs. confirmed), how long any verification takes, and how the certificate or digital badge is delivered. Note any appeal or re-sit window. Knowing this reduces post-exam uncertainty and helps you plan a re-sit if needed.
Plan the day
Stop learning new material. Re-read your error log and any summary notes on control themes. Do one timed mock under realistic conditions, then review every wrong answer to identify the pattern of error. Confirm logistics: venue address or online link, ID validity, permitted items, break rules, and scoring, checking anything unclear with the provider.
Do a second, shorter practice set focused on your weakest themes. Rehearse the question approach: read the stem fully, note qualifiers like BEST, FIRST, MOST, LEAST, and eliminate options that describe controls from the wrong theme. Write a one-page sheet of the control areas you confuse most and read only that sheet afterwards.
Light review only: your one-page sheet and error log. Re-run the online system check if applicable and confirm the login works. Prepare ID, confirmation, and permitted items in one place. Check travel times or set up the exam room. Avoid cramming new clauses late in the day. Get a normal night's sleep; sleep is more valuable than an extra hour of reading.
Eat a normal meal and avoid excess caffeine if you are prone to anxiety. Re-read only your one-page summary. Arrive at the test centre with buffer time, or log in early for online delivery and complete ID verification and room scan. Keep the desk clear and phones away. Do not discuss question content with anyone.
Read each stem twice and identify what is being asked before looking at options. Watch for qualifiers and for answers that are true but not the BEST fit. Answer confident questions first, flag uncertain ones, and return to them. If guessing is not penalised, never leave a blank. Pace yourself against the clock: note the halfway point and check you are on schedule. Use any permitted review time to check flagged items, then submit deliberately.
Note any provisional result shown on screen. Confirm with the provider how and when the formal result and certificate will be issued, and keep the confirmation. If you did not pass, ask about the re-sit window and cooling-off rules before rebooking, and update your error log while the experience is fresh.
Rules to check
Identification: present the original government-issued photo ID registered on your booking. The name must match exactly. If there is any mismatch or doubt about accepted document types, confirm with the provider before exam day; venue staff generally cannot override identity rules.
Permitted materials: bring only items the provider explicitly allows. Unless the provider confirms the exam is open book, assume it is closed book and that notes, printed standards, phones, smart watches, and secondary devices are prohibited. For online delivery, clear the desk and close all other applications.
Breaks: do not assume breaks are available. Confirm with the provider whether breaks are permitted, whether the timer runs during them, and what re-entry or re-verification is required. Leaving the camera view or the test room without authorisation can lead to invalidation.
Prohibited conduct: no communication with other people about question content during or after the exam, no recording or screenshotting questions, no use of unauthorised aids, and no attempting to access external resources. These are typically treated as integrity violations independent of your score.
Scoring and guessing: confirm with the provider whether there is a penalty for incorrect answers and how the pass mark is set. If there is no penalty, answer every question. Do not assume a particular weighting for question types.
Technical failure: if the online platform fails, note the time and error, use the provider's stated support channel, and follow their instructions rather than restarting repeatedly. For test-centre issues, report to the invigilator immediately and ask for the incident to be logged.
Timing and submission: manage the clock yourself. Flag and revisit uncertain questions only if the provider's interface allows review. Submit only when you have checked flagged items; do not rely on auto-submit behaviour you have not confirmed.
Results and appeals: treat any on-screen score as provisional unless the provider states otherwise. Keep your confirmation and result correspondence, and follow the provider's published process and deadlines for verification, appeals, or re-sits.