Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to PECB's ISO/IEC 27002 Lead Manager as of October 2026. It covers the five exam domains and their weights, the 80-question open-book exam, the four credential levels and what each one asks of you, the fees and CPD rules, and how the credential compares to ISO/IEC 27001 Lead Implementer and CISM.
The PECB Certified ISO/IEC 27002 Lead Manager is a personnel certification for people who choose, implement and manage information security controls using ISO/IEC 27002:2022.
ISO/IEC 27002 is the guidance standard behind ISO/IEC 27001. An organization certifies its information security management system (ISMS) against 27001, whose Annex A lists the controls. 27002 explains each of those controls: what it is for, how to implement it, and what else to consider. PECB describes this credential as proof that you can determine the controls needed to treat the risks a risk assessment has identified. That makes it narrower than an ISMS credential and a good deal deeper on the controls themselves.
You earn it with one exam: 80 multiple-choice questions in three hours, open book, with 70 percent needed to pass. What the certificate says afterward depends on your experience, because the same exam leads to four levels, from Provisional Manager to Senior Lead Manager. PECB (the Professional Evaluation and Certification Board) writes the scheme to comply with ISO/IEC 17024, but this credential is not on PECB's published IAS or UKAS accreditation scopes. The scheme is run by PECB, and training is delivered through its authorized partners.
Security, cybersecurity and privacy basics. 12.5% of the exam.
Gap analysis, risk assessment and control selection. 12.5% of the exam.
Policies, roles, suppliers, incidents and staff. 25% of the exam.
Secure areas, malware, cryptography and networks. 25% of the exam.
Security testing, independent review and improvement. 25% of the exam.
ISO/IEC 27001 Lead Implementer and Lead Auditor train you to build or audit a whole management system. This one stays at the control level, and four details shape how it works.
ISO/IEC 27001 Lead Implementer teaches you to build the management system. The 27002 Lead Manager goes one layer down, into the 93 controls themselves: which ones your risks justify, how to put each one in place, and how to tell whether it works. If the ISMS already exists and the controls are where it struggles, this is the credential aimed at that gap.
You can use a copy of ISO/IEC 27002, the course materials and your own notes. That doesn't make it easy. Scenario questions come in sets of five, every question offers three options, and half the exam measures evaluation, which is judgment the standard can't supply for you.
Everyone sits the same exam. Your application decides whether the certificate reads Provisional Manager, Manager, Lead Manager or Senior Lead Manager. Our guide to how PECB exams and credentials work explains the tiers.
The exam follows ISO/IEC 27002:2022, the third edition of the standard. It cut the control set from 114 to 93, regrouped the controls into four themes (37 organizational, 8 people, 14 physical and 34 technological) and added 11 new ones, including threat intelligence, cloud services security and data leakage prevention.
Domain 2 also tests what changed between the 2013 and 2022 editions, so anyone who learned the old 14-category layout has a map to redraw. PECB lays out the changes in its ISO/IEC 27002:2022 white paper.
The certification, the exam, and what it costs to keep the credential as of October 2026, taken from PECB's published handbook and policies.
Lead Manager shows you can run the control layer. From there, most people widen out to the whole ISMS, the risk process that feeds it, or the audit side. These three PECB credentials are the usual next steps.
Builds and runs the entire ISMS the controls sit inside, from the implementation plan through monitoring and preparing for the certification audit. Its lead level asks for the same five years and 300 project hours, and it is on PECB's IAS and UKAS accreditation scopes.
Goes deep on the risk assessment and treatment process that decides which controls you need in the first place. It pairs well with Lead Manager for anyone whose control choices get challenged, and it uses the same 80-question, three-hour, open-book exam format.
Puts you on the other side of the table, judging whether someone else's ISMS and controls hold up. It suits control owners heading toward internal audit or certification body work, and it is also on PECB's IAS and UKAS accreditation scopes.
PECB's course assumes a fundamental understanding of ISO/IEC 27002 and solid knowledge of security controls, so most candidates arrive from a security or ISMS role. Afterward they branch toward the full ISMS, risk, or security management credentials.
Build the baseline
The control layer
Two questions to answer before you commit: can you hold the Lead Manager title, and should you pursue this credential at all. Here's a straight answer to both.
You can certify in full.
You have five years of work experience, at least two of them in information security management, plus 300 hours of security management activities such as drafting an ISMS implementation plan, selecting controls, and implementing and evaluating them. Pass the exam, name two professional references, sign the PECB Code of Ethics, and you hold the full Lead Manager.
You can still pass now.
Pass the exam and apply at the level you meet today. Provisional Manager needs no experience. Manager needs two years (one in security management) and 200 hours. Once you cross the Lead Manager bar, upgrade from your PECB dashboard for a $100 application fee, and PECB decides whether another exam is needed. After training, apply within 12 months of finishing the course.
The credential fits roles that decide, run or measure security controls, mostly in organizations that follow ISO/IEC 27001. PECB's own audience list names managers, consultants, ISMS team members, and people responsible for security, compliance, risk or governance.
Owns the control set day to day: which controls are in scope, who runs each one, and whether they hold up. PECB lists managers implementing controls in an ISO/IEC 27001 ISMS first in its audience for this course.
Runs the project that takes an ISO/IEC 27001 program from gap analysis to working controls. Domain 2, with its gap analysis and risk treatment planning, maps straight onto this job.
Advises clients on which ISO/IEC 27002 controls fit their context and how to put them in place. Control-level depth is what lets a consultant go past handing over a policy template.
Maps controls to legal, statutory, regulatory and contractual requirements and checks compliance with internal policies and standards. Domain 3 covers this ground directly.
Tests and monitors whether controls work as designed, then feeds the results into continual improvement. That work is Domain 5, a quarter of the exam.
Manages information security across supplier relationships, supplier agreements and the ICT supply chain, all areas ISO/IEC 27002 covers in its organizational controls.
Two PECB credentials that share an exam format, plus ISACA's security management credential. They aim at different work: the controls, the whole ISMS, and running a security program.
| ISO 27002 LM | ISO 27001 LI | CISM | |
|---|---|---|---|
| Issuer | PECB | PECB | ISACA |
| Focus | Selecting and managing ISO/IEC 27002 controls | Building and running an ISO/IEC 27001 ISMS | Security management and governance |
| Exam Format | 80 questions, 3 hrs, open book | 80 questions, 3 hrs, open book | 150 questions, 4 hours |
| Experience | 5 yrs, 2 in security mgmt, 300 hrs | 5 yrs, 2 in security mgmt, 300 hrs | 5 yrs infosec, 3 in management |
| Passing Score | 70% | 70% | 450 / 800 |
| Renewal | 90 CPD hours over 3 years | 90 CPD hours over 3 years | 120 CPEs over 3 years |
| Accreditation | Not on PECB's IAS or UKAS scope | IAS and UKAS (ISO/IEC 17024) | ANAB (ISO/IEC 17024) |
| Best For | Control owners and ISMS team members | ISMS builders and program leads | Security managers and governance leads |
PECB exam and certification fees are usually bundled into partner training, and ISACA pricing depends on membership status. Many practitioners eventually hold more than one of these credentials.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our PECB authorized boot camp covers all five exam domains in four days of live instruction, in person or online. Official PECB courseware, the certification exam, the certification application fee, one free retake and 31 CPD credits are included in the course price.
How PECB credentials work, the ISO/IEC 27001 tracks, GRC careers, and the topics the controls themselves cover.
How PECB assigns a credential tier from your application rather than your exam score, why the project log matters, and where the ISO/IEC 27002 Lead Manager sits in the PECB catalog.
The two ISO/IEC 27001 tracks compared by the seat you sit in afterward. Useful context if you are deciding what to add after a control-level credential.
GRC job postings mix credentials in every combination. Which certifications fit governance, risk and compliance work, and why hands-on experience with frameworks like ISO 27001 matters to employers.
What makes an awareness program work in practice. It is the same ground ISO/IEC 27002 covers in its people controls on security awareness and training.
What the EU NIS2 Directive asks of U.S. companies operating in Europe, and how far an existing ISO 27001 program gets you toward it.
Why an audit and a pen test answer different questions. Both show up in Domain 5 of the exam, which covers security testing and independent reviews of controls.
Privacy as control over who collects personal data and what they do with it. Domain 1 of the exam tests privacy terms and principles alongside security fundamentals.
PECB splits the ISO/IEC 27002 Lead Manager exam into five competency domains. The two concept domains carry 10 questions each, and the three control and measurement domains carry 20 each. Click any domain for what it covers.
The ISO/IEC 27000 family, confidentiality, integrity and availability, how threats relate to vulnerabilities, the categories of security controls, the definition of information security risk, and privacy terms and principles. 10 questions.
What an ISMS is, the Plan-Do-Check-Act cycle, the structure of ISO/IEC 27002 and how the 2022 edition differs from 2013, analyzing the existing security architecture, gap analysis, risk assessment methods and risk treatment. 10 questions.
Security policies, roles and segregation of duties, legal and contractual requirements, project management and cloud services, asset classification, access control, hiring and awareness training, supplier relationships, business continuity and incident management. 20 questions.
Physical perimeters and secure areas, clear desk and clear screen, storage media and equipment, malware protection, technical vulnerabilities, data masking and leakage prevention, cryptography, secure development, privileged access, logging and network security. 20 questions.
Security testing across the development life cycle, outsourced development, keeping development, test and production apart, protecting test information and systems during audit testing, independent reviews, network monitoring and continual improvement. 20 questions.
Domains and weights reflect the PECB ISO/IEC 27002 Lead Manager Candidate Handbook, version 1.5 (2026). Domains 3 and 4 hold the 40 evaluation questions, and Domains 1, 2 and 5 test comprehension, application and analysis.
The questions candidates ask most often when researching the PECB Certified ISO/IEC 27002 Lead Manager certification.
It's a PECB personnel certification for people who select, implement and manage information security controls based on ISO/IEC 27002:2022. PECB describes it as proof that you can determine the controls needed to treat the risks a risk assessment has identified.
PECB aims it at managers and consultants implementing controls in an ISO/IEC 27001 ISMS, people responsible for security, compliance, risk or governance, IT professionals, and members of ISMS implementation or security teams. If you're new to security, Security+ is the better first step.
As of October 2026, PECB lists the Lead exam at $1,000 and the certification application at $500 when you take the exam without a course. Training with a PECB partner includes the first attempt, one free retake, the application fee and the first year of the maintenance fee.
The exam has 80 multiple-choice questions with three options each, and you get three hours. It's open book, so you can use ISO/IEC 27002, the course materials and your own notes. Questions are stand-alone or tied to a scenario, and you need 70 percent to pass.
The Lead Manager level requires five years of work experience, two of them in information security management, plus 300 hours of security management activities. You also need two professional references and must sign the PECB Code of Ethics.
Yes. Experience only decides which credential you receive after you pass. With none, you can apply as a Provisional Manager. With two years (one in security management) and 200 hours, you can apply as a Manager, then upgrade to Lead Manager later for a $100 application fee.
The domains are fundamental concepts of information security, cybersecurity and privacy (12.5 percent), the ISMS and initiation of controls implementation (12.5 percent), organizational and people controls (25 percent), physical and technological controls (25 percent), and performance measurement, testing and monitoring of controls (25 percent).
PECB certifications are valid for three years. To renew the Lead Manager, you report 90 CPD hours across the three-year cycle, pay the maintenance fee ($390 per three-year cycle as of October 2026) and follow the PECB Code of Ethics. Missing CPD hours or fees leads to a 12-month suspension.
PECB holds ISO/IEC 17024 accreditation from IAS, UKAS and COFRAC, and its handbook says this scheme is written to comply with ISO/IEC 17024. As of October 2026, though, the ISO/IEC 27002 Lead Manager is not on the published scope of any of the three. ISO/IEC 27001 Lead Implementer and Lead Auditor are on the IAS and UKAS scopes.
ISO/IEC 27001 Lead Implementer covers building and running the whole ISMS, from planning through preparing for the certification audit. ISO/IEC 27002 Lead Manager goes deeper on one part of it, choosing, implementing and measuring the security controls. Both use an 80-question, three-hour, open-book exam.
The exam is built on ISO/IEC 27002:2022, the edition that sorts controls into organizational, people, physical and technological themes. The handbook also tests the differences between the 2013 and 2022 editions. The 2022 revision cut the control set from 114 to 93 and added 11 new controls.
It's worth it if you run or advise on security controls inside an ISO/IEC 27001 program and want real depth on the 2022 control set. It's a weaker pick if a contract asks for an accredited credential or DoD 8140 approval, which PECB doesn't claim for this one, or if you're building a whole ISMS, where ISO/IEC 27001 Lead Implementer fits better.
Whether you're weighing the certification, working out funding, or planning training for an ISMS team, tell us where you are and we'll help you map out the right path.