Training, exams and certification
Training, exams and certification
Fifty questions in forty minutes, closed book, and a pass mark of fifty per cent. Two numbers stand out and they pull in opposite directions: it is the fastest paper we cover, and the most forgiving.
The APMG ISO/IEC 27001 Foundation certificate tests knowledge of how the standard works in a typical organisation. It is the entry level of APMG’s three-level scheme.
| Questions | 50, multiple choice |
|---|---|
| Duration | 40 minutes |
| Pass mark | 50% — 25 correct answers out of 50 |
| Materials | Closed book |
| Prerequisites | None stated |
| Accredited training | Not mandatory. Self-study and direct exam booking are supported |
| Typical course | Three days, where a course is taken |
Fifty questions in forty minutes leaves forty-eight seconds each. For comparison:
| ISO 27001 Foundation | 48 sec/question | |
| PRINCE2 7 Foundation | 60 sec/question | |
| ITIL 5 Foundation | 90 sec/question | |
| IASSC Yellow Belt | 120 sec/question |
Forty-eight seconds is a recognition test, not a reasoning test. You either know which clause of the standard a term belongs to or you do not, and there is no time to reconstruct it.
The compensation is the pass mark: fifty per cent, the lowest of any exam on this site. Twenty-five right out of fifty. You can be wrong half the time and still hold the certificate.
A fifty per cent threshold on a forty-minute recognition paper says something about what the certificate is for. It is designed to establish that you can hold a conversation about an ISMS — that you know what Annex A is, what a Statement of Applicability does, why management review exists — not that you could run one.
The levels above it are where the standard gets applied. APMG’s Auditor certificate asks you to judge audit situations; its Practitioner asks you to make decisions as an information security officer. Both of those are open book, with far more time per question, precisely because recall is no longer the point.
ISO/IEC 27001:2022 restructured Annex A: the old fourteen clauses became four themes — organisational, people, physical and technological — and the control count fell from 114 to 93, with eleven controls new.
On a recognition paper, that restructure is exactly the kind of thing that gets asked. If your study material predates 2022, the shape it teaches you is the wrong one.
Learn the structure before the detail. Clauses 4 to 10, then the four Annex A themes. Structure is what a forty-eight-second question can test.
Check the vintage of everything you read. Anything written before 2022 describes an Annex A that no longer exists.
Practise at speed. The pass mark is kind; the clock is not.
Twenty-five out of fifty — 50%.
Forty minutes for fifty multiple-choice questions.
No. Training is advised but not mandatory, and exams can be booked directly.
No. Foundation is closed book. The Auditor and Practitioner levels above it are restricted open book.
APMG does not state Foundation as a prerequisite for either, though most training providers sequence them that way.
ISO/IEC 27001:2022 — the revision that reorganised Annex A into four themes and 93 controls.
Sources. Every figure on this page comes from APMG International’s own published certification pages, and the Annex A control counts from ISO/IEC 27001:2022 itself, checked in September 2026.
GoToCertify will offer preparation for the ISO/IEC 27001 certifications, with the exam voucher alongside it.
Not on sale on GoToCertify yet — we are setting it up. In the meantime the exam facts above are free to use.
