What You’re Actually Walking Into

Here’s something that trips people up before they even start studying: SCF isn’t one exam, it’s two. You sit F1 (Security Strategy & Planning) and F2 (Security Management & Design) separately, and both have to be passed on their own merits — 75% or higher, each. Scoring 90% on F1 doesn’t buy you any slack on F2 if you come in weak there.

Each module gives you 60 minutes for 48 multiple-choice questions, spread evenly across six knowledge domains. And there’s a catch a lot of people don’t realize going in: you can’t just sign up and take the exam whenever. SABSA requires you to complete training through an Accredited Education Provider first, with the Foundation exams usually scheduled for the last day of that course. Which means your first-attempt odds are shaped almost entirely by how you use that training week — not by some separate study period afterward.

Small but useful detail: if English isn’t your first language, you can request 15 extra minutes per module. Worth asking for if timing feels tight.

Why Getting It Right the First Time Actually Matters

Some certifications let you retake the exam for a small fee and barely notice the setback. SABSA isn’t really one of those. The training course is a real investment — in both money and a full week of your time — and depending on the provider, a resit isn’t automatically included. There’s also the scheduling headache most working professionals will recognize: clearing another five-day block isn’t something you do casually.

What Seems to Actually Help

Pay attention during the training week itself, not just at the end. Trainers tend to flag which sections carry more exam weight as the course progresses — candidates who’ve gone through it often say catching those signals mattered more than any last-minute review.

The six architecture layers are worth knowing cold before exam day: Contextual, Conceptual, Logical, Physical, Component, Management. Same goes for the six matrix columns — What, Why, How, Who, Where, When. Almost everything else in SABSA gets built on top of these, so if they’re shaky, a lot of otherwise-sensible answers start to feel like guesswork under time pressure.

Spacing your review out beats cramming it into one long session near the end. The five-day course covers a lot of ground fast, and trying to absorb it all the night before rarely sticks. Flashcards with spaced repetition work well here — short, repeated exposure rather than one marathon session.

It also helps to build your own versions of the models instead of just reading someone else’s. Sketching out domain relationships or trust models yourself forces a level of understanding that passively scrolling through slides doesn’t really give you. Doesn’t need to be fancy — a basic diagramming tool does the job.

Don’t assume general familiarity is enough, either. Because both exams are split evenly across six domains, you can feel solid overall and still fail if two of those domains are noticeably weaker than the rest. Worth being honest with yourself about where those gaps are before exam day, not during it.

And inside the exam, watch your pace. Roughly 75 seconds per question sounds fine until you hit two or three where you’re torn between answers. Flagging a tough one and coming back later usually beats sitting there burning minutes on it.

Who This Is Actually For

SCF fits people stepping into security architecture roles, or already doing that kind of work informally and wanting something formal to show for it. There’s no prerequisite to attend the training — which makes it more accessible than you’d expect — though arriving with some baseline security or governance knowledge means the material clicks faster instead of feeling like a firehose.

Questions People Usually Ask

How many exams do I need to pass for SCF certification?
Two. F1 and F2, each passed independently at 75% or above.

How long is each SABSA Foundation exam?
60 minutes per module, plus 15 extra minutes available if you’re not a native English speaker.

Can I take the SCF exam without going through official training first?
No — SABSA requires completing training with an Accredited Education Provider before you can sit either Foundation exam.

What if I pass one module but not the other?
You’ll need to retake whichever one you didn’t pass. There’s no averaging between the two.

Do I need prior security experience to start the SABSA Foundation course?
Not formally. That said, some existing familiarity with information security or governance concepts makes the pace of the course much easier to keep up with.