ISO/IEC 27005 Foundation exam-day guide
ISO/IEC 27005 Foundation · Prepare for the day ahead.
Your checklist
Valid government-issued photo ID
Bring the exact ID document named in your booking confirmation. The name must match the name on your registration; if you have recently changed names or use a shortened form, confirm with the provider which document is accepted before test day.
Appointment confirmation and candidate number
Have the confirmation email or booking reference accessible. For online-proctored delivery, some providers require a registration or launch code; confirm with the provider what appears on your admission ticket.
Know your delivery format and platform
Establish whether you sit the exam at a test centre or online with remote proctoring, and which browser or app is required. Do a full system and webcam check at least 48 hours ahead if remote; confirm with the provider for any required software version.
Test your equipment and connection
For remote delivery, test camera, microphone, speakers, and a wired or stable connection. Close background applications. Have a fallback plan (phone hotspot, backup device) but note that switching devices mid-exam may not be permitted; confirm with the provider.
Prepare your workspace
Use a clear desk with only permitted items. Remove notes, phones, smart watches, and secondary screens unless the provider explicitly allows them. A quiet, private room with a closed door is normally required for remote proctoring.
Confirm permitted materials and format
ISO/IEC 27005 Foundation exams are typically closed-book multiple choice, but rules vary by certification body. Confirm with the provider whether any reference material, calculator, or scratch paper is allowed and whether scratch paper must be destroyed or shown on camera afterwards.
Check exam language and accommodations
Verify the language of delivery and whether you have approved extra time or other accommodations. Requests are usually handled before test day; confirm with the provider well in advance.
Plan arrival or login timing
Arrive at the test centre or log in 15–30 minutes early for identity checks and room scans. Confirm with the provider the exact check-in window and late-arrival policy.
Know the scoring and result process
Understand the pass mark, number of questions, and time limit for your specific exam version. Many bodies report a scaled score and issue preliminary results on screen, with formal certificates later; confirm with the provider.
Water and comfort items
Rules on drinks and snacks vary. At a test centre they may be stored outside the room; for remote delivery they may need to be declared to the proctor. Confirm with the provider rather than assuming.
Backup contact details
Save the provider's support phone number or chat link so you can report technical problems quickly. Note that a proctor may pause or invalidate a session if issues are not raised through the official channel.
Study summary sheet for the final review only
Prepare a one-page summary of ISO/IEC 27005 concepts (risk identification, analysis, evaluation, treatment, acceptance, communication, monitoring) for the last review. It must not be taken into the exam unless permitted; confirm with the provider.
Plan the day
Stop learning new material and consolidate. Review the ISO/IEC 27005 process flow: context establishment, risk assessment (identification, analysis, evaluation), risk treatment, risk acceptance, communication and consultation, and monitoring and review. Re-read your notes on how 27005 relates to ISO/IEC 27001 (risk criteria feeding the ISMS) and to ISO/IEC 27000 vocabulary. Take one full timed practice set under exam conditions to check pacing, then review every wrong answer for the underlying concept rather than memorising the option.
Complete technical setup for remote delivery or confirm travel to the test centre. Check ID validity and name match. Re-read the provider's candidate handbook for permitted items, breaks, and the reschedule policy. If anything is unclear, contact the provider now rather than on test day.
Do a light review of the areas you most often confuse: the difference between risk identification and analysis, qualitative versus quantitative approaches, risk criteria and risk appetite, treatment options (mitigate, transfer, avoid, retain), residual risk, and the role of the risk owner versus the asset owner. Prepare clothes, ID, confirmation, and any permitted items. Confirm the start time in your local time zone. Sleep a full night; avoid cramming new topics.
Eat and hydrate normally. Do a final 20–30 minute skim of your summary sheet only. Log in or arrive early as required. Close all other applications, silence devices, and clear your desk. Have ID ready and follow proctor instructions exactly.
Read the full question before looking at options; many items hinge on a single qualifier such as 'first', 'primary', or 'residual'. Answer easy items first and flag uncertain ones. Eliminate clearly wrong options. For process-order questions, recall the 27005 sequence rather than guessing. Watch the clock and reserve the last few minutes to review flagged items and confirm no unanswered questions. Do not attempt to look up answers; treat the session as closed-book.
Note which topics felt weak while memory is fresh, in case you need a retake or plan further study. Collect your score report and keep the confirmation of results. If a technical issue affected your session, report it to the provider immediately and ask what evidence they need.
Rules to check
Bring the exact ID document specified in your booking. If your ID name differs from your registration, resolve it with the provider before test day; do not assume a secondary document will be accepted.
Follow all proctor instructions. For remote delivery this typically includes a room scan, showing your desk, and keeping your face in view. Refusal or non-compliance can lead to the session being terminated; confirm with the provider what is required.
Treat the exam as closed-book unless the provider states otherwise. Do not use notes, phones, smart watches, or unauthorised software, and do not communicate with anyone other than the proctor during the session.
Do not reproduce or share exam questions afterwards. Most certification bodies treat content as confidential and may void results or bar future attempts if this rule is broken.
Confirm the break policy in advance. Many foundation exams are short enough that no scheduled breaks are offered, and unscheduled breaks under remote proctoring may not be allowed or may stop your clock. Confirm with the provider.
Understand how scoring works before you sit: number of questions, time limit, and pass mark for your exam version. Results may be reported as a scaled score, and some providers issue only a pass or fail; confirm with the provider.
If a technical failure occurs, stop and contact the provider's support channel immediately. Do not continue unaided, as undocumented issues are harder to remedy after the fact.
Arrive or log in within the stated check-in window. Late arrival may result in refused entry or a forfeited fee, and rescheduling terms vary by provider; confirm with the provider.