1.1 Current Exam Facts
Key Takeaways
- PECB ISO/IEC 27001 Foundation is a 40-question, 60-minute, multiple-choice exam with a 70% passing score
- The exam fee is $500 USD plus a $200 USD Foundation Certificate application fee, delivered online through the PECB Exams application (online proctored)
- Two domains are weighted 50/50: Fundamental Principles and Concepts of Information Security Management, and the Information Security Management System (ISMS)
- The Foundation certificate does not expire and is exempt from CPD, the Annual Maintenance Fee, and recertification — those requirements apply only to Lead Implementer and Lead Auditor
- PECB's candidate handbook requires completion of the ISO/IEC 27001:2022 Foundation training course (classroom, live online, eLearning, or self-study) for the certificate program — experience prerequisites remain none
Why This Exam Matters
The PECB Certified ISO/IEC 27001 Foundation exam is the entry-level credential validating that you understand the vocabulary, principles, and core requirements of an Information Security Management System (ISMS) based on ISO/IEC 27001:2022. It is the on-ramp to the ISO/IEC 27001 certification track and sits below the Lead Implementer and Lead Auditor credentials in PECB's qualification hierarchy. Whether you are a junior compliance analyst, an IT professional moving into governance, or a consultant who needs a defensible baseline of ISO 27001 literacy, Foundation is the credential that proves you can read the standard accurately and discuss it using the correct terminology.
A common mistake is treating Foundation as a trivia test. It is not. PECB frames every question around the standard's wording and the ISO/IEC 27000 vocabulary, so a candidate who can paraphrase but cannot match the standard's exact terms will lose points to distractors that sound right but are not. This guide is built to drill that precision.
Exam Body and Standard
- Exam body: PECB (Professional Evaluation and Certification Board). PECB personnel certifications are accredited under ISO/IEC 17024; the Foundation credential is a certificate program under ANSI/ASTM E2659 (successful candidates are certificate holders, not "certified" practitioners in the ISO/IEC 17024 sense).
- Standard edition examined: ISO/IEC 27001:2022. The 2022 revision replaced the 2013 version's 14 control clauses in Annex A with 93 controls organized into four themes. Questions about Annex A control counts must be answered against the 2022 numbers, not the legacy 114-controls structure.
- Companion vocabulary standard: ISO/IEC 27000 supplies the definitions for terms such as information security risk, risk owner, control, and Statement of Applicability. Treat 27000 as your glossary.
Exam Logistics
| Attribute | Value |
|---|---|
| Question count | 40 multiple-choice questions |
| Time allowed | 60 minutes (1.5 minutes per question) |
| Passing score | 70% (28 of 40 correct) |
| Delivery | PECB Exams application (online proctored) |
| Exam fee | $500 USD per attempt |
| Certificate application fee | $200 USD (one-time, paid after passing to issue the Foundation Certificate) |
| Prerequisites (experience) | None — no professional experience or prior certification required |
| Certificate-program training | Required — PECB's candidate handbook states all candidates must complete the PECB ISO/IEC 27001:2022 Foundation training course (classroom, live online, eLearning, or self-study) before the certificate is issued |
| Certificate validity | Does not expire for Foundation |
| Schedule at | https://pecb.com/en/exams |
Reading the fee structure correctly
The $500 USD exam fee and the $200 USD Foundation Certificate application fee are billed separately. You pay the exam fee when you book an online exam session; you pay the application fee after you pass, when you request issuance of the PECB Foundation Certificate. Candidates who budget only the $500 and are surprised by the $200 application step often delay receiving their certificate by weeks. Plan for $700 USD total to walk away with the credential.
Certification Path and What Does NOT Expire
A frequent exam trap conflates the Foundation certificate's lifecycle with the Lead Implementer and Lead Auditor lifecycle. They are different.
- Foundation certificate: Valid for life. No Continuing Professional Development (CPD) units, no Annual Maintenance Fee, and no recertification are required. Once issued, it does not expire.
- Lead Implementer / Lead Auditor certificates: Require Continuing Professional Development (CPD), payment of an Annual Maintenance Fee, and recertification every three years under PECB's Certification Maintenance Policy.
If a question asks which PECB credential requires recertification, the correct answer is Lead Implementer or Lead Auditor — never Foundation. Foundation's exemption from CPD and the Annual Maintenance Fee is a deliberate design choice: Foundation certifies baseline knowledge, not ongoing practitioner competence.
Where Foundation sits in the hierarchy
- Foundation — entry level; no experience prerequisites; certificate program requires the Foundation training course; no expiry.
- Lead Implementer — designs and runs an ISMS implementation project; requires CPD and recertification.
- Lead Auditor — performs first-, second-, and third-party ISMS audits; requires CPD and recertification.
Foundation is not a mandatory prerequisite for Lead Implementer or Lead Auditor, but it is strongly recommended because both higher exams assume the vocabulary and clause structure tested at Foundation.
Exam Blueprint — Two Domains, 50/50
PECB publishes the Foundation syllabus as two domains weighted equally. Half the exam comes from each, so do not over-index on one.
| # | Domain | Weight | What it covers |
|---|---|---|---|
| 1 | Fundamental Principles and Concepts of Information Security Management | 50% | Information security definitions, CIA triad, ISO/IEC 27000 vocabulary, roles, risk basics, AI and cloud computing characteristics, the ISO 27000 family of standards |
| 2 | Information Security Management System (ISMS) | 50% | ISO/IEC 27001 Clauses 4–10, Annex A controls, Statement of Applicability, PDCA, certification process |
Domain 1 is vocabulary and concepts; Domain 2 is the standard's requirements. A balanced study plan splits time roughly evenly, with slight extra time on Domain 2 if you have not previously read ISO/IEC 27001 itself.
Annex A:2022 Control Themes (Preview)
Annex A of ISO/IEC 27001:2022 lists 93 controls in four themes. The 2013 edition's 114 controls were consolidated and 11 new controls were added (for example, threat intelligence, information security for use of cloud services, and ICT readiness for business continuity). Expect at least one question that asks you to identify the correct theme for a named control or to recall the count per theme.
| Theme | Control count |
|---|---|
| Organizational | 37 |
| People | 8 |
| Physical | 14 |
| Technological | 34 |
| Total | 93 |
A memory hook that survives the exam: "Org 37, People 8, Physical 14, Tech 34" — read it as 37 + 8 = 45, plus 14 = 59, plus 34 = 93. The full Annex A breakdown is covered in Chapter 7.
Delivery: PECB Exams Application
The exam is delivered through the PECB Exams application, an online proctored platform. You take the exam from your own computer at home or office, but the proctor verifies your identity, scans your room via webcam, and monitors you throughout the 60 minutes. Schedule your session at https://pecb.com/en/exams.
Exam rules to internalize before booking:
- Closed book. No ISO/IEC 27001 copy, no notes, no browser tabs. The standard is not permitted during the exam.
- One monitor only. Disconnect secondary displays before launching the exam session.
- Quiet, private room. No other people, no phone on the desk, no background audio.
- Government-issued photo ID required at check-in; the name must match your PECB account exactly.
- Technical check in advance. Run the PECB Exams system test the day before — webcam, microphone, and internet bandwidth are all verified.
Retake Policy
If you score below 70%, you may retake the exam. How fees work depends on how you entered the certificate program:
- Training via a PECB partner (the common path): PECB's candidate handbook states that for candidates who completed the training course through a PECB partner, the applicable fee covers the first exam attempt and the first retake, plus the certificate application. Partner course packages commonly advertise a free retake within 12 months of the course — confirm the exact window on your voucher or with your partner.
- Exam purchased separately / additional attempts: Beyond the included first retake (or if you booked the exam outside a partner package that includes it), further attempts are charged at the published Foundation exam fee ($500 USD per PECB's handbook price list).
Failed candidates receive domain-level feedback to guide restudy. The $200 certificate application fee is associated with applying for the Foundation certificate after a successful exam, not with every failed attempt.
Official Resources to Use During Study
- PECB ISO/IEC 27001 Foundation page — official syllabus, domain weights, and learning objectives.
- ISO/IEC 27001:2022 — the requirements standard itself; Clauses 4–10 and Annex A are the source of truth for Domain 2 questions.
- ISO/IEC 27000:2024 — vocabulary standard; the authoritative definitions for every term the exam tests.
- PECB Exams page (https://pecb.com/en/exams) — scheduling, system test, and delivery rules.
Do not rely on third-party summaries that predate the 2022 revision. If a study source mentions "114 controls" or "14 Annex A clauses," it is describing the 2013 edition and will mislead you on Annex A questions.
Exam-Day Traps to Avoid
- Trap 1 — 2013 vs 2022 Annex A counts. A distractor may list "114 controls" or "14 clauses." Reject it; the 2022 edition has 93 controls in 4 themes.
- Trap 2 — Foundation recertification. Any option implying Foundation requires CPD, an Annual Maintenance Fee, or recertification is wrong. Those belong to Lead Implementer/Lead Auditor.
- Trap 3 — Confusing 27001 with 27002. ISO/IEC 27001 contains requirements ("shall"); ISO/IEC 27002 contains control guidance. Foundation questions about mandatory requirements point to 27001, not 27002.
- Trap 4 — Two fees, one certificate. A question about "the cost to obtain the Foundation certificate" must account for both the $500 exam fee and the $200 application fee, not just one of them.
- Trap 5 — Domain weights. Both domains are 50/50. An option that weights Domain 2 at 60% or 70% is incorrect.
What Comes Next in This Guide
Chapter 2 builds the vocabulary you need for Domain 1 — the CIA triad, security properties, ISO/IEC 27000 definitions, roles, and the AI and cloud characteristics PECB lists in Domain 1. Chapter 3 walks the ISO 27000 family so you can distinguish 27001 from 27002, 27005, 27006, and 27701 on demand. From Chapter 5 onward, the guide works through Clauses 4–10 and Annex A control by control, ending with the certification process in Chapter 8.
A candidate passes the PECB ISO/IEC 27001 Foundation exam and receives the Foundation certificate. Which of the following is true about maintaining that credential?
How many controls are listed in Annex A of ISO/IEC 27001:2022, and how are they distributed across the four themes?
A candidate budgets $500 USD for the PECB ISO/IEC 27001 Foundation exam. What is the total cost to actually receive the Foundation certificate after passing?