ISO/IEC 27005 Foundation
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The ISO/IEC 27005 Foundation credential is an entry-level certificate offered by PECB for individuals who want to demonstrate general knowledge of the information security risk management guidelines published in ISO/IEC 27005. It is aimed at risk management professionals, staff who manage information security risks within their own area of responsibility, people who simply want to become familiar with the standard's guidance, and anyone considering a career in information security risk management. No professional experience or prior risk management project work is required to attend the training course or to apply for the certificate. Preparation is built around a two-day, participant-centered training course that combines lectures with examples and discussion, encourages interaction through questions and suggestions, and includes quizzes structured similarly to the exam. Participants receive training material of over 200 pages containing information and practical examples, and those who attend receive an attestation of course completion worth 14 CPD credits. The exam covers two competency domains: fundamental concepts of information security risk management, and information security risk management approaches and processes. The course agenda spans an introduction to ISO/IEC 27005 and its fundamental concepts on day one, followed by information security risk management and the certificate exam on day two. Candidates who pass the exam can apply for the PECB Certificate Holder in ISO/IEC 27005 Foundation designation, an entry-level credential that also requires signing the PECB Code of Ethics. This page is an independent study resource and is not affiliated with or endorsed by PECB or ISO.
What you'll study
About ISO/IEC 27005 Foundation preparation
What does the ISO/IEC 27005 Foundation exam cover?
The exam covers two competency domains: Domain 1, fundamental concepts of information security risk management, and Domain 2, information security risk management approaches and processes. The source describes these as the domains the exam fully meets the requirements for, and directs candidates to the List of PECB Exams and Examination Rules and Policies for exam type, available languages, and other details.
Do I need experience to sit the exam or get the certificate?
No. The source states there are no prerequisites to participate in the training course, and no prerequisites on professional or risk management project experience for the certificate. For the PECB Certificate Holder in ISO/IEC 27005 Foundation designation, the requirements listed are passing the exam, no professional experience, no risk management experience, and signing the PECB Code of Ethics.
What happens if I fail the exam?
You can retake it. The source states that in case of exam failure, you can retake the exam within 12 months for free. Plan your schedule so a retake fits inside that window, and use your score feedback to focus revision on the domain where you lost the most marks before booking the second attempt.
How long is the training and what materials do I get?
The course is a two-day training course. Day 1 covers the introduction to ISO/IEC 27005 and fundamental concepts of information security risk management; Day 2 covers information security risk management and the certificate exam. Training material containing over 200 pages of information and practical examples is distributed, and attendees receive an attestation worth 14 CPD credits.
Is the exam included in the course price?
Yes. The source states that certificate and examination fees are included in the price of the training course. It does not publish a separate exam fee, exam duration, question count, or passing score on this page, so confirm those details through the official PECB exam listings and examination rules before you book.
How should I order my study?
Follow the course structure: first secure the vocabulary and principles in Domain 1, since risk terminology underpins everything else, then work through the process in Domain 2, covering context establishment, risk assessment, risk treatment, communication and consultation, recording and reporting, and monitoring and review. Use the included quizzes to test recall under exam-like conditions.
What are common failure modes on this exam?
Candidates typically lose marks by confusing risk assessment steps with treatment steps, mixing up communication and consultation with monitoring and review, and treating the standard's guidelines as prescriptive requirements. Others memorize definitions without being able to place them in the process. Practicing the quizzes with similar structure to the exam exposes these gaps early.
What can I call myself after passing?
After passing the exam you can apply for the PECB Certificate Holder in ISO/IEC 27005 Foundation designation, which the source describes as an entry-level credential demonstrating general knowledge of ISO/IEC 27005 guidelines for information security risk management. Passing the exam and applying for the certificate are the requisites, along with signing the PECB Code of Ethics.