Training, exams and certification
Training, exams and certification
Eighty questions, open book, seventy per cent to pass. Same shape as the Lead Auditor paper and the same two-step credential — but the weighting is tilted somewhere else entirely, and that tilt is the whole difference.
The PECB Certified ISO/IEC 27001 Lead Implementer exam tests whether you can plan, build and run an ISMS, rather than audit one.
| Questions | 80, multiple choice — standalone and scenario-based |
|---|---|
| Pass mark | 70% |
| Materials | Open book — a hard copy of ISO/IEC 27001, the training course materials, and your own notes from the course |
| Question balance | About 54% comprehension, application and analysis; about 46% evaluation |
| Non-native language | 30 additional minutes for Lead-level exams |
| Retakes | No limit on the number of retakes, subject to PECB’s rules on spacing |
| Credential | Passing the exam is one of several requirements. See below |
Seven domains, eighty questions, published weights:
| Planning the ISMS implementation | 18 questions · 22.5% | |
| Fundamental principles and concepts | 15 questions · 18.75% | |
| Implementing the ISMS | 14 questions · 17.5% | |
| ISMS requirements | 12 questions · 15% | |
| Monitoring and measurement | 10 questions · 12.5% | |
| Continual improvement | 6 questions · 7.5% | |
| Preparing for the certification audit | 5 questions · 6.25% |
The largest single domain is planning the implementation — scope, gap analysis, risk assessment, the decisions taken before anything is built. Implementation itself is smaller. Preparing for the certification audit, the thing many candidates assume the course is about, is five questions.
Set against the Lead Auditor paper, where conducting an audit is the heaviest domain, the two exams are mirror images: one is weighted towards judging a system, the other towards deciding what to build.
The exam is one requirement of several. PECB awards four credentials from this paper, separated by professional experience and by hours spent on ISMS project activities.
| Provisional Implementer | No professional experience required |
|---|---|
| Implementer | 2 years, one of them in information security management |
| Lead Implementer | 5 years, two of them in information security management |
| Senior Lead Implementer | 10 years, seven of them in information security management |
Each level also requires a number of hours of ISMS project activities, rising from 200 at the lower levels to 1,000 at the top, and all of them require signing the PECB Code of Ethics.
So the honest answer to “how long until I am a Lead Implementer” is usually five years, not five days. The exam can be passed long before the title is available.
As with the Lead Auditor paper, three things are permitted: the standard in hard copy, the course materials, and any personal notes taken during the course, printed or on the PECB Exams app.
On a paper weighted towards planning decisions, the notes worth having are not definitions. They are the sequences: how a scope is set, what a risk assessment produces, what feeds a Statement of Applicability, what management review needs in front of it. Write those down during the course while the trainer is explaining why, not just what.
Revise the front half of the lifecycle hardest. Principles and planning are forty-one per cent of the paper between them.
Do not over-invest in the certification audit. It is five questions out of eighty.
Index your notes by domain before the exam. Eighty questions, open book, and no time to hunt.
Eighty multiple-choice questions, standalone and scenario-based.
70%.
Yes — the standard in hard copy, the course materials, and your own notes from the course.
Not by itself. That credential also requires five years of professional experience, two of them in information security management, plus logged ISMS project hours.
You can be certified as a Provisional Implementer on the exam alone, and upgrade later.
Same format and pass mark, opposite weighting. Lead Implementer is heaviest on planning an ISMS; Lead Auditor is heaviest on conducting an audit.
Yes. Lead-level exams carry an additional 30 minutes.
Sources. Every figure on this page comes from PECB’s published candidate handbooks and certification pages, checked in September 2026.
GoToCertify will offer preparation for the ISO/IEC 27001 certifications, with the exam voucher alongside it.
Not on sale on GoToCertify yet — we are setting it up. In the meantime the exam facts above are free to use.
