Training, exams and certification
Training, exams and certification
Four questions. Eighty marks. Two and a half hours. Open book with five named standards, forty marks to pass. If that sounds unlike every other exam on this site, it is — and the shape tells you exactly what is being tested.
Reviewed by GoToCertify’s accredited trainers
The APMG ISO/IEC 27001 Practitioner certificate — Information Security Officer — tests whether you can apply the standard to manage information security, not whether you can describe it.
| Questions | 4 objective-testing questions, worth 80 marks in total |
|---|---|
| Duration | 150 minutes |
| Pass mark | 50% — 40 marks out of 80 |
| Materials | Open book: ISO/IEC 27000:2018, 27001:2022, 27002:2022, 27003:2017 and 27005:2022, printed or digital |
| Prerequisites | None stated |
| Accredited training | Not mandatory. Self-study and direct exam booking are supported |
| Typical course | Two days, where a course is taken |
The arithmetic of this paper is unlike anything else in the families we cover.
| Questions | 4 |
|---|---|
| Marks per question | 20 |
| Time per question | About 37 minutes 30 seconds |
| Marks to pass | 40 — the equivalent of two questions answered perfectly |
| Marks you can drop | 40 |
Each question is built around a scenario and split into objectively marked items worth twenty marks together: you choose, match or sequence answers rather than write them. There is little pure recall and no time pressure in the ordinary sense: thirty-seven minutes is a long time to sit with one scenario.
The risk is the opposite of the usual one. On a fast paper you run out of clock; here you run out of discipline, and pick the option that is true of ISO/IEC 27001 in general instead of the one that fits the scenario.
APMG frames this level as applying ISO/IEC 27001 to enable the management of information security — the officer’s job rather than the auditor’s.
Practically, that moves the questions from “does this comply” to “what would you do”: scoping an ISMS, deciding what belongs in a Statement of Applicability, treating a risk, planning what management review should look at. The standard supplies the frame; the decision is yours, and the marks are for the decision and the reasoning behind it.
It is the same distinction that separates the Auditor certificate from this one. An auditor judges a system that exists. An officer builds and runs one.
APMG calls this paper open book and names the standards you may have with you, in print or in digital form: ISO/IEC 27000:2018, ISO/IEC 27001:2022, ISO/IEC 27002:2022, ISO/IEC 27003:2017 and ISO/IEC 27005:2022. Nothing else, and no personal notes.
You may consult them, and with thirty-seven minutes a question you actually can — this is the one exam here where looking something up properly is affordable.
Use that. On a four-question paper, one misremembered requirement can cost a large share of twenty marks, and you have the time to check rather than guess. Confirm what the standard requires before you build an answer on top of it.
Practise on scenarios, not on single facts. The items are objectively marked, but every one of them has to hold up against the situation described.
Budget by question. Thirty-seven minutes each, and hold the line — overrunning on question one is how people lose question four.
Answer the question asked. Forty of the eighty marks are yours to lose, and they are most often lost to options that are right about the topic but wrong for the scenario.
Four, worth eighty marks in total.
Forty marks out of eighty — 50%.
Two and a half hours, which is about thirty-seven minutes per question.
Yes. APMG allows printed or digital copies of ISO/IEC 27000:2018, 27001:2022, 27002:2022, 27003:2017 and 27005:2022, and nothing else.
APMG does not state it as a prerequisite, though most providers sequence the levels that way.
The Auditor level judges a system against the standard. The Practitioner level designs and manages one — the information security officer’s role.
Sources. Every figure on this page comes from APMG International’s own published certification pages, checked in September 2026.
We run it as a two-day in-company course with an APMG-accredited trainer, the exam at your premises or by voucher. From €640 per participant, exam included, minimum four.
See the course
BITIL.COM is an ATO (Accredited Training Organization) of APMG-International for ISO/IEC 27001® courses.
