Training, exams and certification
Training, exams and certification
Sixty questions in two hours, open book, seventy per cent to pass. Half of the paper is on the ISO/IEC 27005 framework and process; the rest is split between principles, programme implementation and other assessment methods.
Reviewed by GoToCertify’s accredited trainers
The PECB Certified ISO/IEC 27005 Risk Manager exam tests whether you can set up and run an information security risk management programme based on ISO/IEC 27005: context and criteria, assessment, treatment, communication and monitoring.
| Questions | 60, multiple choice with three options each — standalone and scenario-based |
|---|---|
| Duration | 2 hours |
| Pass mark | 70% — 42 of 60 |
| Materials | Open book — a hard copy of ISO/IEC 27005, the training course materials and your own notes from the course |
| Delivery | Online in the PECB Exams app with a remote invigilator, or on paper at a PECB partner’s site |
| Retakes | One free retake within 12 months for candidates trained by a PECB partner (included in our Exam Bundle) |
| Non-native language | 20 additional minutes for Manager-level exams taken on paper, on request |
| Typical course | Three days, plus the exam |
| Validity | Three years, with CPD and an annual maintenance fee |
| Credential | Passing the exam is one of several requirements. See below |
Four domains, sixty questions, weights from PECB’s ISO/IEC 27005:2022 certification scheme:
| Risk management framework and processes based on ISO/IEC 27005 | 31 questions · 51.67% | |
| Fundamental principles and concepts of information security risk management | 13 questions · 21.67% | |
| Other information security risk assessment methods | 9 questions · 15% | |
| Implementation of an information security risk management program | 7 questions · 11.67% |
Thirty-one questions on the framework and process, and a pass mark of 42: the process alone cannot carry you. You need at least eleven of the other twenty-nine, and in practice many more.
The fourth domain is specific to this exam: other risk assessment methods such as OCTAVE, MEHARI, EBIOS and the Harmonized TRA. Nine questions is enough to make it worth knowing what each method is for and how it differs from the ISO/IEC 27005 approach.
The exam is one requirement of several. PECB awards two credentials from this paper, separated by professional experience:
| Provisional Risk Manager | No experience required |
|---|---|
| Risk Manager | 2 years, 1 in information security risk management · 200 hours of risk management activity |
Know the process step by step. Context establishment and risk criteria; risk identification (event-based and asset-based), analysis and evaluation; treatment and the Statement of Applicability; acceptance; communication and consultation; monitoring and review.
Learn the other methods at the level of purpose. You will not be asked to run OCTAVE or EBIOS, but you may be asked which one fits a situation.
Budget two minutes a question. Open book helps on the scenario questions; on the standalone ones, looking things up costs more time than it saves.
Sixty multiple-choice questions, with three options each, standalone and scenario-based.
70 per cent, which is 42 of 60.
Two hours. Manager-level exams taken on paper allow 20 extra minutes, on request, for candidates sitting in a language other than their own.
Yes: a hard copy of ISO/IEC 27005, the course materials and your own notes from the course.
No. The Risk Manager exam can be taken directly.
Sources. Every figure on this page comes from PECB’s published certification scheme for ISO/IEC 27005:2022, candidate handbooks, brochures and certification pages, checked in October 2026.
The PECB Exam Bundle is on sale here: exam voucher, Learning Resource Kit and a retake, €670 excl. VAT. Not sure yet? Try 10 free practice questions first.
See the Exam Bundle
BITIL.COM is an Authorized Reseller and Silver Partner of PECB.
