Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.

PECB Authorized Training Partner

PECB Certified ISO/IEC 27035 Lead Incident Manager

PECB Authorized Boot Camp. Official courseware, expert instructors, exam, certification fee, free retake, and 31 CPD credits included. Four days to run incident management.

Verified for 2026 ISO-27035-IM Exam
Student
Student
Student
Join 250,000+ certified alumni.
CISSP Professional

Free Retake

Exam Protection Included

Official PECB

Authorized Training

PECB Authorized Training Partner

Exam Ready in Four Days. Detect It. Contain It.

For incident response leads and security operations managers. Four days to design, run and improve an information security incident management process to the ISO/IEC 27035 series, with the PECB exam and one free retake included.

Program Abstract

REF: ISO-27035-IM 6
Curriculum aligned to the latest Exam Outline.
Format Live, Instructor-Led
Duration 4

Incidents Are Coming. The Process Decides How Bad.

The ISO/IEC 27035 series covers the whole incident lifecycle, from planning and detection through response, recovery and lessons learned. Four days on designing that process, standing up the response team, running it under pressure, and improving it after each incident.

Official PECB Training.

We deliver the official PECB courseware, taught live by PECB-certified instructors. Every module maps to the certification exam objectives.

System Integrity Check
Content Source PECB Official
Curriculum Ver. 2026v2
Instructor Auth. Verified
Exam Alignment 100% MATCH

Exam Fee Included.

We include your PECB certification exam in the course price. No surprise fees. You take the exam on the final day of your course.

Mobile Learning

Start Right Away

Unlock iOS/Android app immediately upon enrollment.

Authorized Material

Course from the Source

Official courseware, matched to the current exam version.

All-Inclusive

Exam Fee Included

We cover your Included ($500 value) exam fee. No hidden costs.

Sim Engine

Exam Deja Vu

Practice with CAT-style questions. No surprises.

Retake Policy

Exam Protection Included

Unlimited class returns if you need a second shot.

Flexible Schedule

Training Fits Your Life

Day, evening, online or in-person—your choice.

Test Center

Test While It's Fresh

Take your exam on-site within 7 days of class.

Expert Support

Never On Your Own

180 days of unlimited 1-on-1 coaching after class.

Free Retake Included.

If you do not pass on your first attempt, we include one free retake within 12 months, covered by your course fee. The exam is open-book: 80 multiple-choice questions in three hours.

Thursday 5PM
Bootcamp Concludes - You leave with a personalized attack plan.
Class Ends
Unlimited 1-on-1
AI Gap Analysis - We identify your weak domains using our simulation engine.
Gap Analysis
Exam Day
Exam Protection Active - If you don't pass, your next seat is free.
Certified
·
Training materials including official courseware and study guides
Practitioner Led
Instructors are working security professionals, not just trainers.

"I don't teach from a textbook. I teach what happens in the SOC when the alert fires."

Jeff Porch

VP Ed. Services • CISSP, CISM CISSP: Certified Information Systems Security Professional. CISM: Certified Information Security Manager.

Choose Your Delivery Mode.

Same Curriculum
In-person classroom training session
A

In-Person

Immersive classroom instruction with direct instructor access, hands-on labs and peer collaboration.

  • Face-to-face instruction
  • On-site exam option
Student attending live online training
B

Live Online

The same instructors and curriculum, delivered live from anywhere on our virtual learning platform.

  • Zero travel required
  • Interactive breakout rooms
Offer

Save on this course with a current special offer

Team pricing, military discounts and a limited-time offer of the week. See what applies before you book.

See special offers
Get Started Today

Explore Your Training Options

Tell us about your training needs and we'll create a personalized plan.

PECB Authorized Training Partner

PECB Authorized Training Partner

Official PECB courseware taught live by PECB-certified instructors. Four days that follow the official course structure through to the exam.

6 exam domains

All 6 Exam Domains in Four Days

Incident management fundamentals, the ISO/IEC 27035 process, designing it, preparing and executing the plan, implementing and improving.

Exam fee included

Exam and Certification Fee Included

The PECB exam is 80 multiple-choice questions, open-book, three hours, and both the exam and certification fees are in your course price.

ISO/IEC 27035 series

Built on the ISO/IEC 27035 Series

Plan, detect, respond and learn from incidents using ISO/IEC 27035-1 and 27035-2 (2023) and 27035-3, ready to slot into an ISMS.

Free retake

Free Exam Retake

If you do not pass your first attempt, we include one free retake within 12 months of the exam, covered by your course fee.

CPD credits

31 CPD Credits

PECB issues an attestation of course completion worth 31 CPD credits you can put toward other certifications’ continuing-education requirements.

PECB Certified ISO/IEC 27035 Lead Incident Manager

Accepting Inquiries
+1

    Eligible for Special Pricing?

    We respect your privacy. No spam.

    COURSE STRUCTURE

    ISO 27035 Incident Manager
    Boot Camp Syllabus

    A structured path designed for working professionals.
    Each day builds on the last—momentum is everything.

    MODULE_ID: PREP

    Live Training QS: ~5
    BEFORE CLASS
    Critical Path

    Before Class

    Pre-course materials access
    L.prep.1
    Foundation concepts review
    L.prep.2
    Baseline self-assessment
    L.prep.3

    MODULE_ID: PECB-27035IM-01

    Live Training QS: ~5
    DAY 1
    Critical Path

    Incident Management Fundamentals

    Course Objectives, Structure, and the PECB Certification Process
    L.01.1
    ISO/IEC 27035-1:2023 Principles and the Incident Management Process
    L.01.2
    ISO/IEC 27035-2:2023 Planning and ISO/IEC 27035-3:2020 ICT Operations
    L.01.3
    Information Security Events, Incidents, and Vulnerabilities Defined
    L.01.4
    Incident Management Phases: Plan, Detect, Assess, Respond, Learn
    L.01.5
    Relationship With ISO/IEC 27001, ISO 22301, and NIST SP 800-61
    L.01.6
    Legal, Regulatory, and Breach Notification Obligations
    L.01.7
    Understanding the Organization and Its Incident Management Context
    L.01.8
    Interested Parties, Stakeholder Requirements, and Scope
    L.01.9
    Incident Management Policy and Top Management Commitment
    L.01.10
    Aligning Incident Policy With the Information Security Policy
    L.01.11
    Incident Management Procedures and Documented Information
    L.01.12
    Roles and Responsibilities Across the Incident Lifecycle
    L.01.13
    Exercise: Drafting an Incident Management Policy Statement
    L.01.14

    MODULE_ID: PECB-27035IM-02

    Live Training QS: ~6
    DAY 2
    Critical Path

    Designing the Incident Management Process

    Risk Assessment as Input to Incident Management Planning
    L.02.1
    Incident Management Plan Structure Under ISO/IEC 27035-2
    L.02.2
    Incident Classification Scale and Severity Criteria
    L.02.3
    Escalation Paths, Decision Points, and Authority Levels
    L.02.4
    Establishing the Incident Response Team: Models and Staffing
    L.02.5
    IRT Roles, Competence, and On-Call Arrangements
    L.02.6
    Exercise: Building an Incident Classification Scheme
    L.02.7
    Internal Relationships: Legal, HR, Communications, and Business Owners
    L.02.8
    External Relationships: CERTs, Law Enforcement, Regulators, and Vendors
    L.02.9
    Technical Support: Logging, Forensic Tooling, and Secure Communications
    L.02.10
    Other Support: Budget, Facilities, and Incident Tracking Systems
    L.02.11
    Incident Awareness and Training Program for Staff
    L.02.12
    Exercising the IRT With Tabletop Scenarios
    L.02.13
    Standard Operating Procedures for Common Incident Types
    L.02.14
    Exercise: Designing Escalation Procedures and Contact Trees
    L.02.15

    MODULE_ID: PECB-27035IM-03

    Live Training QS: ~6
    DAY 3
    Critical Path

    Incident Response Operations

    Testing the Incident Management Plan and Response Capability
    L.03.1
    Monitoring Systems and Networks: SIEM, EDR, and Log Sources
    L.03.2
    Detection Sources: Users, Technical Alerts, and Third Parties
    L.03.3
    Detect and Alert: Triage Criteria and Alert Prioritization
    L.03.4
    Information Collection for Incidents and Initial Documentation
    L.03.5
    Evidence Preservation and Chain of Custody
    L.03.6
    Exercise: Triaging Alerts From a Monitoring Feed
    L.03.7
    Reporting Information Security Events: Forms and Channels
    L.03.8
    Point of Contact Duties and Event Logging
    L.03.9
    Information Security Event Assessment and Incident Declaration
    L.03.10
    Assigning Severity and Confirming Incident Category
    L.03.11
    Internal, External, Regulator, and Media Communication Plans
    L.03.12
    Breach Notification Timelines Under GDPR and Sector Rules
    L.03.13
    Exercise: Assessing Events and Declaring Incidents From a Case
    L.03.14
    Handing Off to Response: Activating the IRT
    L.03.15

    MODULE_ID: PECB-27035IM-04

    Live Training QS: ~7
    DAY 4
    Critical Path

    Advanced Analysis, Improvement, and Exam

    Resolving Information Security Incidents: Response Strategy Selection
    L.04.1
    Containment: Short-Term Isolation and Long-Term Measures
    L.04.2
    Eradication: Removing Root Causes, Malware, and Persistence
    L.04.3
    Recovery: Restoring Services and Verifying Integrity
    L.04.4
    Root Cause Analysis Techniques for Incidents
    L.04.5
    Post-Incident Review Meetings and Lessons Learned Reports
    L.04.6
    Exercise: Running a Post-Incident Review on a Case
    L.04.7
    Monitoring, Measurement, Analysis, and Evaluation of the Process
    L.04.8
    KPIs: MTTD, MTTR, Incident Volume, and Recurrence
    L.04.9
    Management Review of Incident Management Performance
    L.04.10
    Continual Improvement of Controls, Plans, and Risk Assessments
    L.04.11
    Updating Policies, Procedures, and Training After Incidents
    L.04.12
    PECB Exam Format: Six Competency Domains, Open Book
    L.04.13
    Full-Length Practice Exam and Review
    L.04.14
    Exam: ISO-27035-IM
    L.04.15

    MODULE_ID: POST

    Live Training QS: ~7
    AFTER CLASS
    Critical Path

    After Class

    COURSE PROGRESS Day 0 of 4
    FREQUENTLY ASKED QUESTIONS

    ISO/IEC 27035 Lead Incident Manager
    Boot Camp FAQ

    Real questions from real professionals who passed.
    Here's how we answer them.

    The ISO/IEC 27035 series is the international standard for information security incident management, from planning and detection through response, recovery and lessons learned. The PECB Certified ISO/IEC 27035 Lead Incident Manager credential shows you can design, run and improve the incident management process for an organization.

    Incident response team leads and members, security operations managers, and anyone who owns the incident management process in an organization or advises one on it.

    PECB asks for general knowledge of incident management, information security principles and the ISO/IEC 27000 family of standards. Hands-on response experience helps but is not required.

    Day 1 introduces incident management concepts and the ISO/IEC 27035 series. Day 2 is designing and preparing the incident management plan. Day 3 covers detecting, reporting and responding to incidents. Day 4 covers monitoring the process and improving it after each incident. The four days follow PECB’s official course structure, with the exam at the end.

    The exam covers 6 competency domains: fundamental principles of information security incident management; the incident management process in ISO/IEC 27035; designing an organizational incident management process; preparing and executing the incident response plan; implementing incident management processes; improving incident management processes and activities. Questions are weighted across the domains, and the course is organized so every domain is taught before you sit the exam.

    The exam has 80 multiple-choice questions, a mix of standalone and scenario-based, and lasts 3 hours. It is open-book, and the passing score is 70%. Online exams are graded instantly.

    Yes. Both the PECB certification exam and the certification fee are included in your course fee, and the exam is scheduled at the end of the course. There is nothing extra to buy to get certified.

    Yes. We include one free exam retake within 12 months of your first attempt, and it is covered by your course fee.

    ISO/IEC 27001 requires that incidents be managed but leaves the process to you. The ISO/IEC 27035 series is the detailed guidance for that process, so it slots directly into an existing ISMS and gives an auditor something concrete to test. Compare all of our PECB courses side by side on the PECB training courses page.

    No, it is a management course. You learn to design, run and improve the incident management process, coordinate teams and communicate with stakeholders and regulators. It does not teach forensic tooling or hands-on malware analysis.

    As of 2026 the series stands at ISO/IEC 27035-1:2023 (principles and process), ISO/IEC 27035-2:2023 (planning and preparation) and ISO/IEC 27035-3:2020 (ICT incident response operations). This course covers the current parts.

    Yes. PECB issues an attestation of course completion worth 31 CPD (Continuing Professional Development) credits to everyone who attends the course.

    Yes. PECB is accredited to ISO/IEC 17024, the international standard for bodies certifying people, and its credentials are recognized internationally. Training Camp delivers the official PECB courseware as an authorized training partner.

    Get the Free
    PECB-27035IM Exam Guide

    • Expert strategies to spot trick questions
    • Question patterns examiners actually use
    • Proven pacing + pressure management tactics
    Articles and Certification Resources

    ISO/IEC 27035 Lead Incident Manager
    Articles & Resources

    What boards want to hear about incidents, how an audit differs from a penetration test, and how the PECB exams work.

    Weighing this against another certification? Compare them head to head in Certification Matchups →

    Continue Your Journey

    ISO 27035 IM Related Courses

    Advance your career with these recommended certifications

    Featured on