ISO 27400 Foundation
PECB ISO/IEC 27400 Foundation
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The PECB ISO/IEC 27400 Foundation certification is an entry-level credential for people who need a working grasp of Internet of Things (IoT) security and privacy as framed by ISO/IEC 27400. PECB describes the associated training course as building fundamental knowledge of IoT concepts, principles and life cycles, the stakeholders of IoT systems, and the security and privacy controls related to IoT. The credential awarded after passing the exam is "Certificate Holder in ISO/IEC 27400 Foundation". It suits managers and consultants who want to know more about IoT security, professionals getting acquainted with ISO/IEC 27400 guidance for an IoT security and privacy program, individuals engaged in or responsible for IoT security activities, and people pursuing a career in IoT security. There are no prerequisites to take the training course, and the certificate itself requires no professional experience or IoT security project experience - only passing the exam and signing the PECB Code of Ethics. The exam covers two competency domains: fundamental concepts and principles of IoT security and privacy, and risk sources plus privacy and security controls for IoT systems. Preparation typically combines the training course (whose materials exceed 200 pages and whose quizzes mirror the exam structure) with free PECB resources such as articles, whitepapers, magazines and webinars. Course attendance earns 14 CPD credits.
What you'll study
About ISO 27400 Foundation preparation
What exactly do I earn by passing the PECB ISO/IEC 27400 Foundation exam?
You can apply for the designation "Certificate Holder in ISO/IEC 27400 Foundation". The certificate requirements are passing the PECB ISO/IEC 27400 Foundation exam, no professional experience, no IoT security project experience, and signing the PECB Code of Ethics. PECB states that a Foundation certificate shows you understand the fundamental principles, concepts, and security and privacy controls for an IoT security and privacy program based on ISO/IEC 27400.
Do I need prior experience or qualifications before enrolling?
No. PECB states plainly that there are no prerequisites to participate in the training course. The certificate table likewise lists "None" for professional experience and "None" for IoT security project experience. The only other certificate requirement beyond the exam is signing the PECB Code of Ethics. This makes the course accessible to career changers as well as experienced managers and consultants.
Which domains does the exam cover, and how is the training course structured?
The exam covers two competency domains: Domain 1, fundamental concepts and principles of IoT security and privacy; and Domain 2, risk sources and privacy and security controls for IoT systems. The course mirrors this over two days: Day 1 covers IoT concepts, principles, life cycle, and stakeholders of IoT systems; Day 2 covers risk sources for IoT systems and security and privacy controls. PECB does not publish a domain weighting on this page.
How should I sequence my study across the two days of content?
Follow the course order. Build vocabulary and mental models first: what IoT systems are, their life cycle stages, and who the stakeholders are, since Domain 1 concepts underpin everything in Domain 2. Only then move to risk sources and the privacy and security controls. Attempting controls questions before you can explain the life cycle and stakeholder roles tends to produce shallow memorization that fails on scenario-style items.
What learning materials and support does the training course include?
PECB states that participants receive more than 200 pages of comprehensive training materials, including practical examples, exercises, and quizzes. The quiz structure within the course closely mirrors that of the certification exam. Participants are also encouraged to use free PECB resources such as articles, whitepapers, magazines, and webinars to reinforce learning and stay current. Participants who attend receive an attestation of course completion worth 14 CPD credits.
What happens if I fail my first exam attempt?
Candidates who completed the training course with one of PECB's partners and failed the first exam attempt are eligible to retake for free within a 12-month period from the course completion date, because the course fee includes a first exam attempt and one retake. Otherwise, retake fees apply. Note the conditions: partner-delivered course, first attempt only, and the 12-month window measured from course completion.
Are the exam and certificate fees separate from the training price?
According to PECB, certificate and examination fees are included in the price of the training course. PECB does not list a standalone exam fee on this page, so candidates who only want the exam without the course should confirm current pricing and rules directly with PECB or a partner before budgeting. Retake fees apply where the free-retake conditions are not met.
How long is the exam, how many questions, and what is the passing score?
PECB does not state the exam duration, question count, or passing score on this course page. It directs candidates to the List of PECB Exams and the Exam Rules and Policies for specifics on exam type, available languages, and other details. Treat any figure you see elsewhere as unverified unless it comes from those PECB pages or your exam invitation.
What are the most common ways candidates underprepare?
Two recurring mistakes: treating IoT security as generic IT security and skipping the IoT-specific life cycle and stakeholder content in Domain 1, and memorizing control names without being able to interpret or apply them, which is what Domain 2 asks. A third is ignoring privacy, treating it as a subset of security. Use the in-course quizzes as diagnostics, and revisit weak areas with PECB articles and whitepapers.
Is this certification tied to any official standards body or accredited by one?
The exam is a PECB certification and PECB states it fully meets PECB Examination and Certification Program requirements. This page does not describe accreditation of the Foundation exam by a separate accrediting body. Verify any accreditation claim with PECB directly, and note that this study resource is independent and is not affiliated with, endorsed by, or sponsored by PECB or ISO.