Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
PECB's incident management credential as of 2026: how the 80 exam questions split across six competency domains, the open-book format, the four credential levels and the experience each one needs, cost, maintenance, career paths, and how it compares to ECIH, CISM and CompTIA CySA+. Written for anyone weighing the credential or trying to work out what it covers.
The PECB Certified ISO/IEC 27035 Lead Incident Manager is PECB's lead-level credential for information security incident management, built on the ISO/IEC 27035 series.
It covers the management side of incidents: scoping the process, writing the policy and the plan, standing up an incident response team, and then detecting, assessing, responding to and learning from each incident. The exam is 80 multiple-choice questions in three hours. It is open book, and the pass mark is 70%.
The credential is issued and maintained by PECB (the Professional Evaluation and Certification Board), which aligns the course with ISO/IEC 27001 and ISO/IEC 27005 and publishes the candidate handbook (version 1.5) that sets out the exam domains and credential rules. One exam leads to four credential levels, and the experience you can document decides which one you hold.
Policy, plan, response team, awareness, and testing, all in place before an incident.
Spot information security events through monitoring or people reporting them, and record them.
Assess each event, decide whether it is an incident, and classify it.
Contain the incident, handle the evidence, resolve it, and escalate when the plan says to.
Review what happened and update the risk assessment, the plan, and the controls.
Four things that set the Lead Incident Manager apart from security certifications that treat incident response as one topic among many.
The course and exam follow the ISO/IEC 27035 series, the ISO and IEC guidance for information security incident management, and PECB aligns the course with ISO/IEC 27001 and ISO/IEC 27005. The process you learn maps onto an information security management system instead of a single vendor's tooling.
The exam mostly asks what you would decide and who you would bring in. Domains 4 and 5, the response plan and running incidents, carry 45 of the 80 questions between them.
You can bring a copy of ISO/IEC 27035, the course materials and your own notes. The hard part is applying them: scenario sets have five questions each, and every question has three options.
Everyone sits the same exam. What you hold afterward depends on the experience you can document, from Provisional Incident Manager with none up to Senior Lead Incident Manager with ten years and 1,000 hours of incident management activities.
You can apply for a higher level later through your PECB account once your experience catches up. PECB charges $100 for an upgrade application and evaluates each one to decide whether another exam is needed.
The credential, the exam, and what it takes to keep the certification current, as published by PECB and checked in October 2026.
Three directions people take after the Lead Incident Manager: higher up the same scheme, into PECB's Cybersecurity Master, or outward into the information security management system that incident management sits inside.
The top tier of the same scheme, on the same exam. It takes ten years of professional experience, seven of them in information security incident management, and 1,000 hours of incident management activities. You apply to upgrade through your PECB account.
PECB's Master credential that pairs the PECB Lead Cybersecurity Manager with the ISO/IEC 27035 Lead Incident Manager. It also asks for 20 years of experience, 10 in a leadership role, and 5,000 hours of combined auditing and project activities.
PECB's credential for building the information security management system (ISMS) that incident management plugs into. A logical next step for people who end up owning both the ISMS and its incident process.
PECB expects a general knowledge of incident management, information security and the ISO/IEC 27000 family before the course. The Lead Incident Manager usually comes after a foundation credential and a few years of security work, and it opens into hands-on response, ISMS and risk, or leadership tracks.
Build the baseline
The process owner seat
Two questions to answer before you commit: which credential level can you hold, and should you take this certification specifically. Here's a straight answer to both.
You can apply for the full Lead credential.
Pass the exam, then apply through your PECB account with your work history, a log of at least 300 hours of incident management activities, two professional references, and a signed PECB Code of Ethics. PECB counts activities such as defining the incident management approach, objectives and scope, risk assessment, developing the incident management program, and monitoring and reviewing it.
Same exam, a lower level for now.
There is no prerequisite to sit the exam. With two years of experience (one in incident management) and 200 hours you qualify as Incident Manager, and with less you can hold Provisional Incident Manager. Upgrade to Lead later, once your experience catches up, for a $100 application fee. If you trained with a PECB partner, apply within 12 months of finishing the course.
The credential is written for the people who own the incident process, a smaller group than the people who work the alerts. These are the roles PECB aims the course at and the titles they usually go by:
Owns the information security incident management process: the policy, the plan, the classification scheme, and the reports that go to management after each incident. This is the job the Lead credential is built around.
Runs an incident once it is declared and keeps the response team, IT, legal and communications working from the same plan. PECB names incident response coordinators among the people the course is for.
Builds and leads the incident response team (IRT or CSIRT): its structure, roles, exercises, and its relationships with outside parties. PECB aims the course at people setting up and managing these teams.
Feeds incident data into the risk assessment and the risk assessment back into incident planning. PECB lists risk managers in its audience, and Domain 3 tests risk analysis, evaluation and treatment.
Runs the information security management system that incident management sits inside. PECB aligns this course with ISO/IEC 27001 and ISO/IEC 27005, so it suits people who already manage an ISMS.
Helps clients design or assess their incident management process against the ISO/IEC 27035 series. PECB names managers and consultants among the people the course is written for.
The Lead Incident Manager is one of several credentials that cover incident response. Here's how it lines up against EC-Council's ECIH, ISACA's CISM and CompTIA CySA+, using each issuer's published figures as of October 2026.
| ISO/IEC 27035 LIM | EC-Council ECIH | ISACA CISM | CompTIA CySA+ | |
|---|---|---|---|---|
| Issuer | PECB | EC-Council | ISACA | CompTIA |
| Exam | 80 multiple-choice, 3 hours, open book | 212-89: 100 multiple-choice, 3 hours | 150 multiple-choice, 4 hours | CS0-004: max 85 multiple-choice and performance-based, 165 minutes |
| Passing Score | 70% | 60% to 85%, varies by exam form | 450 out of 800 | 750 on a 100 to 900 scale |
| Exam Cost | Included with partner training, or $1,000 exam plus $500 application fee | $450 voucher without training, plus $100 application fee | $575 member, $760 non-member | $439 retail voucher |
| Experience | None for Provisional. Lead: 5 years (2 in incident management) + 300 hours | 1 year infosec, or official training | 5 years infosec, 3 in security management | About 4 years recommended, none enforced |
| Renewal | 90 CPD hours over 3 years (Lead), $390 fees per cycle | 120 credits over 3 years, $80 annual fee | 120 CPEs over 3 years, annual fee | 60 CEUs over 3 years, annual CE fee |
| Credential Levels | Four, Provisional to Senior Lead | One | One | One |
| Focus | Designing and running the incident management process, 6 domains | Hands-on incident handling, 9 domains | Security management, incident management 1 of 4 domains through Nov 2, 2026 | Security operations, vulnerability management, response, reporting |
| Best For | Incident managers, IRT leads, ISMS owners | Responders, CSIRT staff, Tier 2 analysts | Security managers and governance leads | Generalist SOC analysts |
These credentials overlap but answer different questions. ECIH and CySA+ test the hands-on response work. CISM covers security management, with incidents as one of its four domains under the current outline, while the Lead Incident Manager is about the process that holds the response together. ISACA's new CISM outline takes effect November 3, 2026.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our PECB authorized ISO/IEC 27035 Lead Incident Manager boot camp runs four days, live and instructor-led, in person or online. It uses official PECB courseware in electronic format and includes the PECB exam, the certification application fee, one free retake within 12 months, and PECB's 31 CPD credit attestation. See the rest of our official PECB courses if you are planning a longer path.
How PECB exams work, ISO 27001 credentials, incident reporting rules, and what incident response looks like when the playbook breaks.
How PECB exams, credential tiers, experience logs and professional references fit together, and why passing the exam is only half of getting the credential level you expect. Check the current maintenance policy on pecb.com for CPD hours and fees.
Two PECB credentials built on the same standard for two very different seats. Useful if you are deciding what to pair with incident management work inside an ISMS.
One of the five is what happens in the first 24 hours of an incident: who declares it, and whether anyone has rehearsed the plan. An incident manager should be ready to answer it.
Seventy-two hours to report a substantial cyber incident and 24 hours to report a ransomware payment. Why reporting deadlines belong in the incident management plan, not in a scramble afterward.
NIS2 expects documented procedures for detecting, managing and reporting security incidents. What US companies with operations in the EU need to have in place.
When attackers destroy data instead of encrypting it, the response plan you rehearsed for ransomware stops applying. What changes in containment, recovery and communication.
An audit checks whether controls such as incident response plans exist and are documented. A penetration test checks whether they hold up. Why one cannot stand in for the other.
PECB's candidate handbook splits the 80 exam questions across six competency domains. Domains 4 and 5, the response plan and running incidents, carry 45 of them, so that is where extra study time pays off most. Click any domain for what it covers.
The vocabulary of ISO/IEC 27035 and the wider ISO/IEC 27000 family: events versus incidents, vulnerabilities, threats and risk, and the confidentiality, integrity and availability of information. Also the incident management life cycle and how security controls are classified, by type (technical, legal, administrative, managerial) and by function (preventive, detective, corrective). Worth 10 of the 80 questions.
The objectives and key processes of incident management as ISO/IEC 27035 sets them out. The five phases (plan and prepare, detect and report, assess and decide, respond, learn lessons), with extra attention on preparation, detection and analysis. Worth 5 questions.
Defining the scope of incident management, analyzing the internal and external environment and the interested parties, and running a gap analysis. Drafting the incident management policy and working through the risk management process, from identifying information and supporting assets to risk analysis, evaluation and treatment. Worth 10 questions.
Drafting the incident management plan and establishing each of its phases, from plan and prepare through learn lessons. Setting up the incident response team, the incident coordinator's responsibilities, technical and other support, communication with external parties, awareness and training, and the scope of incident exercises. Worth 22 questions.
Building the monitoring capability, including an information security continuous monitoring (ISCM) program, the KPIs that measure it, and the mechanisms that detect incidents. Classifying incidents, assessing events, assigning roles for the response phase, choosing a containment strategy, and conducting forensic analysis. Worth 23 questions, the most of any domain.
The lessons learned phase: extracting lessons, evaluating the incident management team, and finding areas for improvement. Setting performance indicators and how often to monitor them, reviewing risk assessment results, and keeping the process current as the organization changes. Worth 10 questions.
PECB's official course runs four days of training followed by the exam. The badge on each row shows which stage of the incident management process that day concentrates on.
Events, incidents and vulnerabilities, the incident management phases, and how the ISO/IEC 27035 series fits with the rest of the ISO/IEC 27000 family.
Scope, policy and risk assessment, then the incident management plan, the incident response team and the support it needs.
Monitoring and detection, reporting and recording events, assessing them and deciding which ones are incidents, then responding.
Lessons learned, performance indicators, and keeping the plan, the team and the risk assessment current after each incident.
PECB's standard schedule puts the 3-hour exam on day five. Training Camp's four-day boot camp holds it on the final day of the course.
Domains, question counts and weights reflect PECB's ISO/IEC 27035 Lead Incident Manager Candidate Handbook, Version 1.5 (2026). PECB rates 32 of the 80 questions as measuring comprehension, application and analysis, and 48 as measuring evaluation. The agenda reflects PECB's course page.
The questions candidates ask most often when researching the PECB Certified ISO/IEC 27035 Lead Incident Manager certification.
It is PECB's lead-level credential for information security incident management, built on the ISO/IEC 27035 series. It tests whether you can design, set up, run and improve an organization's incident management process, from planning and preparation through detection, assessment, response and lessons learned. The exam is 80 multiple-choice questions in 3 hours, and it is open book.
PECB sets no formal prerequisite to sit the exam, and you can take it without the course. For the course itself, PECB's main requirement is a general knowledge of incident management processes, information security principles and the ISO/IEC 27000 family. Experience decides which credential you receive after you pass. The full Lead Incident Manager needs five years of professional experience, two of them in information security incident management, 300 hours of incident management activities, two professional references and a signed PECB Code of Ethics.
The exam is 80 multiple-choice questions in 3 hours, and you need 70% to pass. Each question has three options, and the exam mixes stand-alone questions with scenario-based sets of five questions per scenario. It is open book, so you can use a copy of ISO/IEC 27035, the training materials and your own notes. You take it online through the PECB Exams app with a remote invigilator or on paper through your training partner, in English, French, Spanish or Portuguese (BR).
PECB's candidate handbook lists six competency domains: Fundamental principles and concepts of information security incident management (10 questions, 12.5%), Information security incident management process based on ISO/IEC 27035 (5 questions, 6.25%), Designing and developing an organizational incident management process (10 questions, 12.5%), Preparing and executing the incident response plan (22 questions, 27.5%), Implementing incident management processes and managing incidents (23 questions, 28.75%), and Improving the incident management processes and activities (10 questions, 12.5%). Domains 4 and 5 carry 45 of the 80 questions.
If you train with a PECB partner, the training fee covers the first exam attempt, one free retake, the certification application fee and the first year of the annual maintenance fee, as long as you complete that cycle within 12 months of the course. Without training, PECB's candidate handbook lists the Lead exam at $1,000 and the certification application fee for this credential at $500, as of October 2026.
One exam leads to four credentials, and your experience decides which one you get. Provisional Incident Manager needs no experience. Incident Manager needs two years of experience, one in information security incident management, and 200 hours of incident management activities. Lead Incident Manager needs five years, two in incident management, and 300 hours. Senior Lead Incident Manager needs ten years, seven in incident management, and 1,000 hours. You can upgrade later through your PECB account for a $100 application fee.
PECB certifications are valid for three years. To keep yours active you submit CPD hours, pay the annual maintenance fees and follow the PECB Code of Ethics. PECB's CPD table sets 90 hours over the three-year cycle for Lead Manager credentials, 60 for Manager and 180 for Senior Lead Manager, and its maintenance policy lists the fee at $390 per three-year cycle. Provisional credentials need no maintenance. Miss the CPD hours or the fee and the certification is suspended for up to 12 months, then revoked if you do not fix it.
PECB describes the course and exam as based on the ISO/IEC 27035 series and does not name edition years. Its ISO/IEC 27035 page describes parts 1 and 2, and the sample questions in the candidate handbook cite ISO/IEC 27035-1 and ISO/IEC 27035-2. The current ISO editions are ISO/IEC 27035-1:2023 (principles and process), ISO/IEC 27035-2:2023 (guidelines to plan and prepare for incident response) and ISO/IEC 27035-3:2020 (ICT incident response operations).
PECB is accredited as a personnel certification body under ISO/IEC 17024 by IAS, UKAS and COFRAC, and its candidate handbook says this scheme is specified in compliance with ISO/IEC 17024. As of October 2026, though, the ISO/IEC 27035 Lead Incident Manager does not appear on the accreditation scopes PECB links to, which list schemes such as ISO/IEC 27001 Lead Implementer and Lead Auditor. If an employer or contract asks for an accredited credential, check the current scope documents before you rely on this one.
ECIH from EC-Council is a hands-on incident handling credential. Exam 212-89 is 100 multiple-choice questions in 3 hours across nine domains that walk through malware, email, network, web application, cloud, insider threat and endpoint incidents. The PECB Lead Incident Manager sits at the management level. Its 80-question, open-book exam asks how you design, staff, run and improve the incident management process around the ISO/IEC 27035 series. ECIH is the closer match for whoever works the incident hands-on, and the Lead Incident Manager suits the person who owns the plan they work from.
CISM from ISACA is a broad security management credential. Under the outline in effect through November 2, 2026, incident management is one of its four domains, alongside governance, risk management and the security program. The exam is 150 questions in 4 hours, and CISM requires five years of experience, three of them in security management. ISACA's new outline takes effect November 3, 2026. The Lead Incident Manager goes deep on incident management alone and ties it to an international standard. CISM suits someone running the whole security program, while the Lead Incident Manager is the more specific choice when the incident process is your actual job.
PECB aims the course at incident response team members, incident response coordinators, people setting up and managing incident response teams, IT professionals and information security risk managers, and managers or consultants who want deeper incident management knowledge. In practice that covers titles like incident manager, incident response coordinator, CSIRT lead, information security risk manager, ISMS manager and security consultant.
It depends on your background. People who already run or sit on an incident response team know the work and mostly need to learn how ISO/IEC 27035 names and orders it. Newer candidates should spend most of their time on domains 4 and 5, which carry 45 of the 80 questions. Because the exam is open book, practice finding things quickly in the standard and in your course materials. Training Camp's boot camp covers the material in four days, with the exam on the final day.
It is if your job is building or running an incident management process, especially in an organization that runs or is building an ISO/IEC 27001 ISMS. You get a credential tied to an international standard and a scenario-based exam, and the four levels let the title grow as your experience does. It is less useful if you want hands-on technical response skills, where ECIH or CySA+ fit better, or if an employer needs an accredited credential, since this scheme is not on PECB's published accreditation scopes.
Tell us where you are, whether that's weighing the credential, working out funding, or training a whole incident response team, and we'll help you map out the right path.