Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to PECB's ISO/IEC 27001 Lead Implementer credential as of October 2026. It covers the seven exam domains and their weights, the 80-question open-book exam, the four credential tiers and the project hours behind each, what it costs to keep, and how it compares to Lead Auditor and CISM.
ISO/IEC 27001 Lead Implementer is PECB's credential for the people who build an organization's information security management system (ISMS) and get it ready for an ISO/IEC 27001 certification audit.
ISO/IEC 27001:2022 sets out what an ISMS must contain, from scope and risk assessment to internal audit and management review. It does not tell you how to build one. That gap is what this credential covers: scoping the system, running the risk assessment, choosing from the 93 Annex A controls, writing the Statement of Applicability, and getting the organization through the Stage 1 and Stage 2 audits a certification body will run. Auditing an ISMS is a different job, and PECB certifies it separately through its ISO/IEC 27001 Lead Auditor credential.
PECB (the Professional Evaluation and Certification Board) runs the scheme under ISO/IEC 17024 and is accredited for it by IAS and UKAS. Passing the exam does not settle your title. PECB awards one of four tiers, from Provisional Implementer to Senior Lead Implementer, based on the experience and ISMS project hours you can document, so two people with the same score can walk away with different credentials. The credential is issued and maintained by PECB.
Security concepts, risk, and control types. 18.75% of the exam.
Annex A controls and how they are chosen and documented. 15%.
Scope, policy, risk assessment, and the SoA. The heaviest at 22.5%.
Documentation, awareness, and incident handling. 17.5% of the exam.
Effectiveness, internal audit, and management review. 12.5%.
Nonconformities, root cause, and corrective action. 7.5%.
Stage 1 and Stage 2 readiness. The lightest at 6.25%.
Four things that set PECB's implementer credential apart from the security certifications people usually weigh it against.
The exam is built on the one document an accredited certification body will audit your organization against. You are tested on producing what that auditor reads: the ISMS scope, the risk assessment, the Statement of Applicability, and the 93 Annex A controls of the 2022 edition, sorted into organizational, people, physical, and technological groups.
You can bring a hard copy of ISO/IEC 27001 and your course notes. That helps with clause references and not much else. Many of the 80 questions come in sets of five about one organization, and you pick the best of three options for what it should do next.
Everyone sits the same exam. The credential you receive depends on documented experience and ISMS project hours, from Provisional Implementer with none to Senior Lead Implementer at 1,000. Our guide to how PECB exams and credentials work walks through the application.
PECB is accredited as a personnel certification body under ISO/IEC 17024 by the International Accreditation Service (IAS), and the scope on IAS certificate PCB-111 lists ISO/IEC 27001 Lead Implementer by name. UKAS lists the same credential under PECB's ISO/IEC 27001 Certification Scheme, version 4.7.
That matters when a contract or tender asks for certified personnel, because the buyer can check the accreditation and then the individual certificate. PECB lists every accreditation it holds on its accreditations page.
The credential, the exam, and what it takes to keep the certification active, as PECB publishes them in October 2026.
Lead Implementer shows you can build an ISMS. Most people then add the audit side of the same standard, or broaden into running a security program or managing IT risk. Three common next steps follow.
PECB's audit credential for the same standard, built around ISO 19011 audit practice. Passing both the Lead Auditor and Lead Implementer exams is the route to PECB's ISO/IEC 27001 Master, which asks for 20 years of experience and 5,000 combined audit and project hours.
ISACA's Certified Information Security Manager covers running the whole security program: governance, risk, the program itself, and incident management. It suits implementers who end up owning the program after certification. It requires five years of experience, three in security management.
ISACA's Certified in Risk and Information Systems Control goes further into the risk work at the center of every ISMS, from identifying and assessing IT risk to choosing and monitoring the response. It requires three years of related experience.
Lead Implementer sits in the middle of a GRC career. It builds on security fundamentals and leads into auditing, security management, risk, or the other ISO management system standards that reuse the same structure.
Build the baseline
The build credential
Two questions to answer before you commit: which tier you can hold today, and whether you should be building an ISMS rather than auditing one. Here's a straight answer to both.
You can certify at the Lead tier.
You have five years of professional experience, two of them in information security management, and 300 hours of ISMS project work such as drafting the business case, managing the implementation project, managing documented information, and running corrective actions. Pass the exam, apply with two professional references, and you hold the full Lead Implementer. Ten years (seven in security management) and 1,000 hours qualifies you for Senior Lead Implementer.
You can still pass now.
There is no experience requirement to sit the exam. With no documented experience you receive Provisional Implementer. Two years of experience (one in security management) and 200 project hours gets you Implementer. Upgrade through your PECB account as the hours build, for a $100 application fee. Start logging dates, scope, and your role on each project now, because PECB checks the log.
The credential maps to the roles that build and run an ISMS, in house or as an outside consultant. These are the jobs whose daily work lines up with the exam's seven domains.
Runs the ISO/IEC 27001 project from the business case to the certification audit. Drafting the case, managing the project and leading the implementation team are the exact activities PECB counts toward your project hours.
Owns the ISMS once it is live: objectives, internal audit results, management review and the surveillance audits that follow certification. Domains 5 and 6 of the exam are this job.
Takes client organizations through scoping, risk assessment and the Statement of Applicability, often several at once. PECB names consultants and expert advisers among the people the course is built for.
Keeps the organization in conformity with ISO/IEC 27001 requirements, answers customer security questionnaires and tracks corrective actions. PECB lists people responsible for maintaining ISMS conformity as a core audience.
Runs the risk identification, analysis and evaluation steps, proposes treatment options and keeps the risk register and Statement of Applicability current. Planning, the heaviest exam domain, leans hard on this work.
Writes procedures, maintains documented information, delivers awareness training and handles incidents under the ISMS. PECB lists members of the ISMS team as part of the intended audience.
Lead Implementer and Lead Auditor are two sides of the same standard, and their exams share one format. CISM covers similar ground from the security program side, under ISACA. Here's how they line up.
| 27001 Lead Implementer | 27001 Lead Auditor | CISM | |
|---|---|---|---|
| Issuer | PECB | PECB | ISACA |
| Focus | Building and running an ISMS | Auditing an ISMS against ISO/IEC 27001 | Security management and governance |
| Exam Format | 80 questions, 3 hrs, open book | 80 questions, 3 hrs, open book | 150 questions, 4 hours |
| Experience | 5 yrs (2 in infosec mgmt), 300 project hrs | 5 yrs (2 in infosec mgmt), 300 audit hrs | 5 yrs infosec, 3 in management |
| Passing Score | 70% | 70% | 450 / 800 |
| Renewal | 90 CPD hours over 3 years | 90 CPD hours over 3 years | 120 CPEs over 3 years |
| Accreditation | IAS and UKAS (ISO/IEC 17024) | IAS and UKAS (ISO/IEC 17024) | ANAB (ISO/IEC 17024) |
| Best For | ISMS project leads and consultants | Internal and certification body auditors | Security managers and governance leads |
PECB experience figures are for the Lead tier. Both PECB credentials also come in Provisional, mid and Senior tiers from the same exam, and passing both exams is the first requirement for the ISO/IEC 27001 Master.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our PECB-authorized boot camp covers all seven domains in four days of live, instructor-led training, in person or online. Official PECB courseware, the exam, the certification application fee, one free retake within 12 months, and the 31 CPD credit attestation are included.
Choosing between implementer and auditor, how PECB credentials work, and where ISO 27001 shows up in GRC work and regulation.
Lead Implementer builds the ISMS and gets it through the certification audit. Lead Auditor sits on the other side of that table. How the two PECB credentials differ, what the hours look like, and which one matches the job you have.
How PECB accreditation, credential tiers and application review work, including the professional references PECB contacts and why the tier you receive rests on the hours you can document.
GRC employers want people who can put frameworks like NIST CSF and ISO 27001 into practice. Which certifications those roles ask for, and how to stack them by career stage.
The EU NIS2 Directive overlaps heavily with ISO 27001. What American companies serving Europe must do, and where an existing ISMS still leaves gaps around incident reporting and supply chain security.
An ISO 27001 surveillance audit checks your program against the standard. A penetration test checks whether an attacker can get in. Why one never stands in for the other.
ISO/IEC 27001 expects an awareness program, and Domain 4 of the Lead Implementer exam tests how to build one. A practitioner view of what makes employee security training stick.
Why passing an ISO 27001 audit only proves you cleared the minimum bar on the day someone looked, plus nine other security terms that get misused in meetings.
PECB divides the Lead Implementer exam into seven competency domains, each carrying a set share of the 80 questions. Click any domain for what it covers.
15 of the 80 questions. Information security concepts and terminology, how information relates to assets, the chain from vulnerability to threat to risk and impact, confidentiality, integrity and availability, control types and functions, and the risk assessment and treatment process.
12 questions. Selecting, designing and documenting security controls, the 93 Annex A controls of ISO/IEC 27001 with their ISO/IEC 27002 guidance, the four control groups (organizational, people, physical, technological), and common security services and architecture frameworks.
18 questions, the heaviest domain. Context of the organization, gap analysis, ISMS objectives, resources and roles, the project plan, defining and justifying the ISMS scope, the ISMS policy, the full risk assessment and treatment cycle, and drafting the Statement of Applicability.
14 questions. Documented information and its life cycle, the processes needed to operate the ISMS, organizational knowledge, awareness training and communication plans, incident management, business continuity versus disaster recovery, and how cloud, AI and big data change the picture.
10 questions. Measuring whether the ISMS is effective and meeting its objectives, setting up an internal audit program, telling a major nonconformity from a minor one, writing nonconformity reports, and running management review.
6 questions. Tracking and acting on nonconformities, root cause analysis, corrective action plans, monitoring the change factors that affect the ISMS, and advising an organization on how to keep improving it after go-live.
5 questions, the lightest domain. The certification audit process, Stage 1 and Stage 2 audits, choosing a certification body, judging readiness, preparing staff, audit follow-up, surveillance and recertification audits, and challenging findings with external auditors.
Domains and weights reflect the PECB ISO/IEC 27001 Lead Implementer Candidate Handbook (version 1.5, 2026). Questions in Domains 3, 4 and 7 measure evaluation, and the other four measure comprehension, application and analysis.
The questions candidates ask most often when researching the PECB Certified ISO/IEC 27001 Lead Implementer credential.
It is PECB's credential for professionals who plan, build, run, and improve an information security management system (ISMS) based on ISO/IEC 27001:2022 and prepare it for a certification audit. PECB issues it under ISO/IEC 17024, and the exam covers seven competency domains, from ISMS fundamentals to audit readiness.
It fits the people who own an ISO/IEC 27001 project, such as security and compliance managers, ISMS project leads, consultants who take clients to certification, and members of an ISMS team. If your job is to audit an ISMS rather than build one, PECB's ISO/IEC 27001 Lead Auditor is the closer match.
As of October 2026, PECB lists the Lead exam at $1,000 if you sit it without a training course, plus a $500 certification application fee. If you train with a PECB partner, the course fee covers the first exam attempt, one free retake, the application fee, and the first year of the annual maintenance fee.
The exam is 80 multiple-choice questions in three hours, and you need 70 percent to pass. Each question has three options, and many come in sets of five built on a single scenario. It is open book, so you can use a hard copy of ISO/IEC 27001, your course materials, and your own notes.
The full Lead Implementer credential requires five years of professional experience, two of them in information security management, plus 300 hours of ISMS project activities. You also list two professional references, who cannot be people you supervise or relatives, and sign the PECB Code of Ethics.
Yes. Nothing stops you from sitting the exam. With no documented experience you are awarded the Provisional Implementer credential, then you upgrade through your PECB account once your hours support Implementer, Lead Implementer, or Senior Lead Implementer. PECB charges $100 to apply for an upgrade.
The domains are fundamental principles and concepts of an ISMS, ISMS requirements, planning an ISMS implementation, implementing an ISMS, monitoring and measurement, continual improvement, and preparation for the certification audit. Planning is the heaviest at 22.5 percent, and audit preparation is the lightest at 6.25 percent.
PECB certifications are valid for three years. A Lead Implementer reports 90 CPD hours across each three-year cycle and pays the annual maintenance fee, which PECB lists at $390 per three-year cycle. Miss either and the certification is suspended for up to 12 months, then revoked if the gap is not fixed.
Yes. PECB is accredited under ISO/IEC 17024 by the International Accreditation Service (IAS) and by UKAS, and both accreditation scopes name the ISO/IEC 27001 Lead Implementer credential. An employer or client can confirm the scheme is independently assessed, and PECB also offers certificate verification for individual holders.
Lead Implementer prepares you to build and run an ISMS inside an organization. Lead Auditor prepares you to audit an ISMS against ISO/IEC 27001 and lead an audit team. The two PECB exams share a format (80 questions, three hours, open book, 70 percent to pass), and both Lead tiers need 300 logged hours, project hours for one and audit hours for the other.
Yes. PECB's certification scheme is built on ISO/IEC 27001:2022, and the exam expects you to know the 93 Annex A controls in their four groups, which are organizational, people, physical, and technological. The transition period for organizations certified to the older 2013 edition ended on October 31, 2025.
It is worth it if you are the person responsible for getting an organization to ISO/IEC 27001 certification or keeping it there, since the exam follows that project from scoping to the certification audit. It does less for hands-on technical roles. And if you have no ISMS project hours yet, expect the Provisional tier until you log them.
Whether you're weighing the credential, working out which tier you qualify for, or planning training for an ISMS team, tell us where you are and we'll help you map out the right path.