Download the certification brochure (Spanish): Click here

Exam Details

• Exam Name: ISO/IEC 27001:2022 Implementer Certified (27001-IC)
• Exam Format: Multiple choice, online with remote supervision (proctoring)
• Exam Delivery: Safe Exam Browser
• Number of Questions: 50 questions: 70% scenarios / 30% conceptual
• Exam Duration: 90 minutes
• Passing Score: 70% (35 out of 50 correct answers)
• Available Languages: Spanish / English
• Attempts: Maximum 2 attempts (minimum 15 days between attempts)
• Validity: 3 years · 15 CPD credits per year

Main Subjects

• ISO/IEC 27001:2022 and ISMS fundamentals (10%): High-level structure (Annex SL); The PDCA cycle applied to the ISMS; Changes from the 2013 version and restructuring of Annex A; ISMS terminology; Clauses 4 to 10 and their relationship with Annex A; Amendment 1:2024 on climate action.
• ISMS strategic planning (14%): Internal and external context, including climate change (Amd 1:2024); Interested parties and their requirements, including climate-related ones; ISMS scope; Information security policy and top management commitment; Roles, responsibilities and authorities; Measurable security objectives; ISMS implementation plan.
• Information security risk management (20%): Methodology, acceptance criteria and scales; Assets, threats, vulnerabilities and existing controls; Risk analysis, evaluation and prioritization; Treatment options and the Risk Treatment Plan; Statement of Applicability (SoA); Formal acceptance of residual risk; Climate threats where climate is relevant.
• Implementing the Annex A:2022 controls (24%): Organizational controls (5.1 to 5.37); People controls (6.1 to 6.8); Physical controls (7.1 to 7.14); Technological controls (8.1 to 8.34); Selection and tailoring with ISO/IEC 27002:2022; Verifying control effectiveness; Controls that respond to climate threats.
• Support, operation and performance evaluation (20%): Resources, competence and awareness; Communication and documented information; Operational planning and control, including change management; Performance indicators and the internal audit program; Management review.
• Continual improvement, integration and regulatory context (12%): Nonconformities, incidents and corrective actions; Continual improvement of the ISMS; Integration with ISO 9001, ISO 22301 and ISO/IEC 27701; GDPR, NIST Cybersecurity Framework and the NIS2 Directive; CertJoin Code of Ethics.

Who is this certification for?

• Information security and cybersecurity professionals: Who need to lead or take part in implementing an ISMS in accordance with ISO/IEC 27001:2022.
• Compliance and risk management leads: Who seek a structured reference for managing information security risks.
• Management system consultants and analysts: Who want to extend their skills portfolio to ISMS implementation.
• IT and security project leaders: Who need to apply a recognized framework for implementing security controls.
• Professionals starting the ISO/IEC 27001 path: Who want to start at the first level before specializing in auditing.

Prerequisites

No mandatory prerequisites. 27001-IC is the starting point of the CertJoin ISO/IEC 27001 path and gives access to ISO/IEC 27001:2022 Internal Auditor Certified (27001-IAE) and then to ISO/IEC 27001:2022 Lead Auditor Certified Expert (27001-LAE).