Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to PECB’s information security risk credential as of October 2026. It covers the six competency domains of the ISO/IEC 27005:2022 scheme and how many questions each carries, the 80-question open-book exam, the three credential levels and their experience rules, what it costs to keep, and how it compares to CRISC, ISO/IEC 27001 Lead Implementer, and ISO 31000 Lead Risk Manager.
PECB Certified ISO/IEC 27005 Lead Risk Manager is PECB’s certification for people who run information security risk management based on ISO/IEC 27005:2022.
ISO/IEC 27001 requires an organization to assess and treat information security risk, but it doesn’t prescribe a method. ISO/IEC 27005 is the guidance written to help meet those requirements, and this credential certifies that you can apply it. That means setting risk criteria, identifying assets, threats, and vulnerabilities, rating consequences and likelihood, choosing a treatment, and keeping the whole process recorded and reviewed. Half the exam is written at the evaluation level, so expect to judge decisions inside a scenario, not just recall terms.
The full Lead Risk Manager credential requires five years of professional experience, two of them in information security risk management, plus 300 hours of risk activities. Candidates without that history can still pass and hold the Provisional Risk Manager credential until they qualify. The scheme is issued and maintained by PECB, the certification body behind the ISO/IEC 27001 Lead Implementer and Lead Auditor credentials.
ISO/IEC 27005 structure, risk, threat, vulnerability, likelihood, and the risk owner’s role. 16.25% of the exam.
PDCA, leadership, context, scope, and risk acceptance criteria. The smallest domain at 8.75%.
Assets, threats, controls, vulnerabilities, consequences, and levels of risk. The heaviest at 25%.
Modify, retain, avoid, or share, then plan the treatment and accept residual risk. 18.75% of the exam.
Risk communication, records, reporting, review, and continual improvement. 12.5% of the exam.
OCTAVE, MEHARI, EBIOS, NIST, CRAMM, and Harmonized TRA. 18.75% of the exam.
Four things that separate this PECB credential from the IT risk certifications it usually gets compared with.
CRISC and most other risk credentials work from their issuer’s own body of knowledge. This one is tied to a published standard, ISO/IEC 27005:2022, which exists to help organizations meet the ISO/IEC 27001 requirements for addressing information security risk. If your company holds an ISO/IEC 27001 certificate or wants one, the risk criteria, assessment results, and treatment plan this exam covers are the records an ISMS auditor asks to see.
You can bring a hard copy of ISO/IEC 27005, the course materials, and your own notes. That helps less than it sounds. PECB writes half of the 80 questions at the evaluation level, and the scenario blocks of five questions ask what a risk manager should do next. Eighty questions in 180 minutes works out to about two and a quarter minutes each, which leaves little room to look everything up.
Pass the exam and your experience decides the title. With no qualifying experience you hold Provisional Risk Manager. Five years, two in risk management, and 300 hours of risk work make you a Lead Risk Manager. Ten years, seven in risk management, and 1,000 hours earn Senior Lead Risk Manager, and you can upgrade between levels as the experience builds.
PECB specifies its ISO/IEC 27005 Lead Risk Manager scheme in compliance with ISO/IEC 17024:2012, the international standard for bodies that certify people. The International Accreditation Service (IAS) scope for PECB, certificate PCB-111 with an effective date of October 30, 2025, lists ISO/IEC 27005 Lead Risk Manager by name.
PECB holds other accreditations as well, and they don’t all cover every scheme. If a contract or tender asks for an accredited credential, check the current scope linked from PECB’s accreditations page before you rely on it.
The certification, the exam, and what it costs to keep, as published by PECB and checked in October 2026.
Lead Risk Manager covers one part of an ISMS in depth. The usual next moves are running the whole management system, taking risk work beyond information security, or adding an ISACA credential that employers outside the ISO world screen for.
PECB’s credential for building the full information security management system, across seven domains from planning through preparation for the certification audit. The exam format matches this one: 80 multiple-choice questions, three hours, open book, 70 percent to pass.
ISACA’s Certified in Risk and Information Systems Control covers IT risk and controls without tying them to one standard: governance, risk assessment, response and reporting, and technology and security. It asks for three years of experience across two or more of its four domains. See our CRISC guide.
PECB’s ISO 31000 credential applies the same risk process to every kind of organizational risk, not only information security, across five domains. It suits risk managers whose remit grows past the ISMS into operational, financial, or strategic risk.
Lead Risk Manager is rarely a first certification. It sits where security or ISMS work turns toward owning the risk process, after a grounding in security or in the standard itself, and before the management system, enterprise risk, and security management credentials.
Build the baseline
The pivot point
Pick your path
Two questions to answer before you commit: which level you can certify at, and whether you should pick this credential over the alternatives.
You can certify at Lead level.
You have five years of professional experience, at least two of them in information security risk management, and you can log 300 hours of risk activities such as defining a risk approach, setting objectives and scope, performing risk assessments, and evaluating treatment options. Name two professional references who can vouch for the work (not someone you supervise and not a relative), pass the exam, and apply. With ten years, seven in risk management, and 1,000 hours, apply for Senior Lead instead.
You can still pass now.
Sit the exam anyway. A pass without qualifying experience earns the Provisional Risk Manager credential, which carries no experience, CPD, or maintenance fee requirement. When you can document the experience, apply to upgrade for a $100 fee. Watch one deadline: PECB expects the certificate application within 12 months of course completion for instructor-led training, so apply at the Provisional level on time rather than waiting to qualify for Lead.
The credential maps to people who own, run, or advise on information security risk. PECB’s scheme names ISMS professionals, risk owners, security managers, consultants, and privacy officers in its intended audience. These six roles are where it lines up with the day-to-day work.
Owns the information security risk process end to end: the risk criteria, the assessment cycle, the treatment plans, and the risk register that feeds the ISMS. The 300 hours of risk activities PECB asks for (defining the approach, assessing risk, evaluating treatment options, monitoring the program) read like this job description.
Runs the management system that an ISO/IEC 27001 certificate covers. The standard’s requirements for risk assessment and risk treatment land on this desk, and ISO/IEC 27005 is the guidance written to help meet them.
Keeps the risk register, control evidence, and compliance obligations lined up. The credential gives a GRC analyst a documented, standards-based method to point to when an auditor asks how a risk rating was reached.
Builds or repairs risk programs for clients working toward ISO/IEC 27001 certification. PECB names consultants and expert advisers in the scheme’s intended audience, and the method coverage in Domain 6 helps when a client already runs OCTAVE, EBIOS, or a NIST process.
Needs a defensible way to rate risk to personal data. PECB lists privacy officers among the people the course is written for, and the asset, threat, and consequence work in Domain 3 carries straight over to personal data processing.
Reports information security risk to the board and approves the risk acceptance criteria everyone else works to. The Senior Lead Risk Manager level, with ten years of experience behind it, is the version of this credential that fits a security leader.
Four risk and ISMS credentials that end up on the same shortlist. Three come from PECB and share an exam format. CRISC comes from ISACA and covers IT risk without tying it to one standard.
| 27005 Lead Risk Manager | CRISC | 27001 Lead Implementer | 31000 Lead Risk Manager | |
|---|---|---|---|---|
| Issuer | PECB | ISACA | PECB | PECB |
| Focus | Information security risk (ISO/IEC 27005) | IT and enterprise risk, controls | Building an ISMS (ISO/IEC 27001) | Enterprise risk (ISO 31000) |
| Domains | 6 | 4 | 7 | 5 |
| Exam Format | 80 questions, 3 hours, open book | 150 questions, 4 hours | 80 questions, 3 hours, open book | 80 questions, 3 hours, open book |
| Experience | 5 yrs (2 in infosec risk), 300 hrs | 3 yrs across 2+ domains | 5 yrs (2 in infosec management), 300 hrs | 5 yrs (2 in risk management), 300 hrs |
| Passing Score | 70% | 450 / 800 | 70% | 70% |
| Exam Cost | $1,000 without training | $575 member / $760 non-member | $1,000 without training | $1,000 without training |
| Renewal | 90 CPD hours over 3 years | 120 CPEs over 3 years | 90 CPD hours over 3 years | 90 CPD hours over 3 years |
| Credential Levels | Provisional, Lead, Senior Lead | One credential | Provisional, Implementer, Lead, Senior Lead | Provisional, Risk Manager, Lead, Senior Lead |
| Best For | ISMS risk managers, risk owners, consultants | IT risk managers, GRC and controls professionals | ISMS managers and implementers | Enterprise and operational risk managers |
PECB exam prices are for candidates who test without a training course, and a PECB partner course includes the exam, one retake, and the application fee. CRISC pricing varies by ISACA membership. If your organization is certified to ISO/IEC 27001, Lead Implementer plus Lead Risk Manager covers both the system and the risk method behind it.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Training Camp is a PECB Authorized Training Partner. Our four-day ISO/IEC 27005 Lead Risk Manager boot camp is taught live, in person or online, by PECB-certified instructors using official PECB courseware, and it covers all six exam domains. The PECB exam, the certification application fee, and one free retake within 12 months are included, and PECB issues an attestation of course completion worth 31 CPD credits.
How PECB credentials work, the 27001 credentials next door, CPD rules, risk vocabulary, and reporting risk to the board.
How PECB’s model differs from vendor exams. A pass earns eligibility, and the credential tier you receive depends on documented work history, logged hours, and two references PECB contacts directly. It also shows where ISO/IEC 27005 sits next to 27001 and 27002.
The two ISO/IEC 27001 credentials that sit closest to this one. Who each fits, how the three-hour open-book exams work, and PECB’s move from essay questions to scenario-based multiple choice.
How PECB’s three-year CPD cycle lines up against ISACA, ISC2, and CompTIA, and what happens to an ISO/IEC 27005 risk credential when the CPD hours or the maintenance fee go missing.
CRISC, CISA, CISM, CGRC, and the rest of the GRC shortlist, sorted by career stage. Useful for seeing which gap a standards-based risk credential fills next to the ISACA and ISC2 options.
A vulnerability, a threat, and a risk are three different things, and one of PECB’s published sample questions for this exam tests exactly that distinction. A short refresher on the terms people mix up.
Question two asks for the biggest unmitigated risk and why it hasn’t been fixed. That is risk communication to top management, the subject of Domain 5, seen from the board’s side of the table.
PECB calls them competency domains, and it publishes the question count for each one. How to turn an exam outline into a study plan weighted by those numbers.
PECB divides the Lead Risk Manager exam into six competency domains and publishes how many of the 80 questions each one carries. Click any domain for what it covers.
The vocabulary and the frame. The structure of ISO/IEC 27005 and how it relates to ISO 31000 and the rest of the ISO/IEC 27000 family, confidentiality, integrity, and availability, the definitions of risk, threat, and vulnerability, event, consequence, and likelihood, the difference between risks and opportunities, control types and functions, and the role of the risk owner. 13 of the 80 questions.
Getting a program started. Fitting the plan-do-check-act cycle into risk management, top management leadership and commitment, the responsibilities of the risk manager and other stakeholders, internal and external context, the strategic and operational cycles of risk assessment, scope and boundaries, and setting risk acceptance criteria and risk assessment criteria. The smallest domain at 7 questions.
The heaviest domain on the exam at 20 questions. Identifying primary and supporting assets, asset valuation, threats, existing controls, vulnerabilities, and consequences, then assessing consequences and likelihood with nonnumerical categories, numerical rating scales, or practical values. It also covers inherent, residual, and target risk, evaluating risk against criteria, prioritization, and the main concepts of quantitative risk assessment.
Deciding what to do about each risk. The ISO/IEC 27005 treatment options of risk modification, retention, avoidance, and sharing, choosing controls that bring the level of risk down, drafting and implementing the risk treatment plan, defining risk ownership, and evaluating and accepting residual risk. PECB writes all 15 of these questions at the evaluation level.
Keeping the program running after the first assessment. The risk communication plan, consultation between decision makers and internal and external stakeholders, documenting the process, recording and reporting assessment and treatment results, maintaining risk records, monitoring and review, management review, corrective actions on the treatment plan, and continual improvement. 10 questions.
The methods that sit outside the standard itself. OCTAVE (the original method, OCTAVE-S, OCTAVE Allegro, and OCTAVE FORTE), MEHARI and its three phases, EBIOS and its five workshops, the NIST risk management publications and the seven steps of the NIST Risk Management Framework, CRAMM, and the five phases of Harmonized Threat and Risk Assessment (TRA). 15 questions.
Domains and weights come from PECB’s ISO/IEC 27005:2022 Certification Scheme and the ISO/IEC 27005 Lead Risk Manager Candidate Handbook (version 1.5), current as of October 2026. PECB writes Domains 1 to 3 at the comprehension, application, and analysis level and Domains 4 to 6 at the evaluation level, so the questions that ask you to weigh a decision cluster in treatment, communication, and methods.
The questions candidates ask most often when researching the PECB Certified ISO/IEC 27005 Lead Risk Manager certification.
PECB Certified ISO/IEC 27005 Lead Risk Manager is a personnel certification from PECB that shows you can establish, manage, and improve an information security risk management program based on ISO/IEC 27005, the guidance standard for the risk assessment and treatment that ISO/IEC 27001 requires. You earn it by passing an 80-question open-book exam and then documenting your risk management experience.
It fits people who run or advise on information security risk: ISMS professionals and risk owners, information security managers and consultants, security team members, IT professionals, and privacy officers, plus anyone responsible for keeping an organization in line with ISO/IEC 27001. PECB expects a fundamental understanding of ISO/IEC 27005 and solid knowledge of risk management and information security before the course.
As of October 2026, PECB lists the Lead exam at $1,000 if you take it without a training course, and the certification application fee is a separate $500. When you train with a PECB partner, the course fee covers the first exam attempt, one free retake, the application fee, and the first year of the annual maintenance fee, as long as you finish that cycle within 12 months of the course.
The exam is 80 multiple-choice questions in three hours, and you need 70 percent to pass. Each question has three options. Some stand alone and others hang off a short scenario that carries five questions. Half the exam measures comprehension, application, and analysis, and the other half measures evaluation. You can take it online through the PECB Exams application with a remote invigilator or on paper through the training partner, and online results come back instantly.
Yes. You can use a hard copy of the ISO/IEC 27005 standard, the training course materials, and any personal notes you took during the course, either printed or through the PECB Exams application. Open book doesn’t make it easy. The scenario questions ask you to judge a situation, and the method content in Domain 6 lives in the course materials, not in the standard.
The Lead Risk Manager credential requires five years of professional experience, two of them in information security risk management, plus a total of 300 hours of risk management activities such as defining a risk approach, performing risk assessments, and evaluating treatment options. You also need two professional references and must sign the PECB Code of Ethics. Senior Lead Risk Manager raises the bar to ten years, seven in risk management, and 1,000 hours.
Yes. Passing the exam without qualifying experience gets you the PECB Certified ISO/IEC 27005 Provisional Risk Manager credential, which has no experience or hours requirement and no maintenance requirement. Once you can document the experience, you can apply to upgrade. PECB charges a $100 upgrade application fee and decides during its review whether another exam is needed.
PECB’s six domains are fundamental principles and concepts of information security risk management (16.25 percent), implementation of a risk management program (8.75 percent), information security risk assessment (25 percent), risk treatment (18.75 percent), risk communication, monitoring, and improvement (12.5 percent), and risk assessment methodologies (18.75 percent). Risk assessment is the largest, with 20 of the 80 questions.
The certification is valid for three years. To renew, you report 90 hours of continuing professional development (CPD) across the cycle, pay the annual maintenance fee, which PECB lists as $390 per three-year cycle as of October 2026, and keep to the PECB Code of Ethics. Miss the CPD or the fee and the certification is suspended for up to 12 months while you catch up, then revoked if it stays outstanding.
The exam is built on PECB’s ISO/IEC 27005:2022 certification scheme. ISO/IEC 27005:2022 is the fourth edition of the standard, published in October 2022 under the title “Information security, cybersecurity and privacy protection: Guidance on managing information security risks.” PECB’s scheme says holders who passed an earlier version of the exam must retake an exam at the end of their three-year validity.
ISO/IEC 27005 Lead Risk Manager from PECB is tied to one standard and the ISMS it supports, with an 80-question, three-hour open-book exam and a 70 percent pass mark. CRISC from ISACA covers IT and enterprise risk and controls more broadly, with 150 questions over four hours and a scaled pass mark of 450 out of 800. CRISC asks for three years of experience, while the full Lead Risk Manager credential asks for five, two of them in risk management. If your organization runs ISO/IEC 27001, the PECB credential maps more closely to the work.
ISO/IEC 27001 Lead Implementer covers building the whole information security management system across seven domains, with risk as one part of it. ISO/IEC 27005 Lead Risk Manager spends all six of its domains on risk: the program, assessment, treatment, communication, and the methods. Both PECB exams are 80 multiple-choice questions over three hours, open book, with a 70 percent pass mark, and both Lead credentials ask for five years of experience, two of them in the field.
PECB specifies the scheme in compliance with ISO/IEC 17024:2012, the standard for bodies that certify people. The International Accreditation Service (IAS) scope for PECB (PCB-111, effective October 30, 2025) lists ISO/IEC 27005 Lead Risk Manager among its accredited certifications. PECB holds other accreditations too, but they don’t all cover this scheme, so check the current IAS scope if accreditation matters for a contract or tender.
It’s worth it if information security risk is the main part of your job and your organization runs ISO/IEC 27001 or is moving toward it, because it certifies the method behind the risk assessment and treatment plan an ISO/IEC 27001 auditor will review. It’s less useful if the employers you target screen only for ISACA or ISC2 credentials, or if you want a broad security management credential, where CISM or CISSP fit better.
Tell us where you are, from choosing between Lead Risk Manager and Lead Implementer to planning training for an ISMS team, and we’ll help you map out the right path.