Training, exams and certification
Training, exams and certification
Eighty questions in three hours, open book, seventy per cent to pass. Same shape as the Lead Auditor paper and the same two-step credential — but the weighting is tilted somewhere else entirely, and that tilt is the whole difference.
Reviewed by GoToCertify’s accredited trainers
The PECB Certified ISO/IEC 27001 Lead Implementer exam tests whether you can plan, build and run an ISMS, rather than audit one.
| Questions | 80, multiple choice with three options each — standalone and scenario-based |
|---|---|
| Duration | 3 hours |
| Pass mark | 70% |
| Materials | Open book — a hard copy of ISO/IEC 27001, the training course materials, and your own notes from the course |
| Question balance | About 54% comprehension, application and analysis; about 46% evaluation |
| Non-native language | 30 additional minutes for Lead-level exams taken on paper, on request |
| Delivery | Online in the PECB Exams app with a remote invigilator, or on paper at a PECB partner’s site |
| Retakes | One free retake within 12 months for candidates trained by a PECB partner (included in our Exam Bundle); no limit on further retakes, subject to PECB’s rules on spacing |
| Validity | Three years, with CPD and an annual maintenance fee of USD 120 (first year included) |
| Credential | Passing the exam is one of several requirements. See below |
Seven domains, eighty questions, published weights:
| Planning the ISMS implementation | 18 questions · 22.5% | |
| Fundamental principles and concepts | 15 questions · 18.75% | |
| Implementing the ISMS | 14 questions · 17.5% | |
| ISMS requirements | 12 questions · 15% | |
| Monitoring and measurement | 10 questions · 12.5% | |
| Continual improvement | 6 questions · 7.5% | |
| Preparing for the certification audit | 5 questions · 6.25% |
The largest single domain is planning the implementation — scope, gap analysis, risk assessment, the decisions taken before anything is built. Implementation itself is smaller. Preparing for the certification audit, the thing many candidates assume the course is about, is five questions.
Set against the Lead Auditor paper, where conducting an audit is the heaviest domain, the two exams are mirror images: one is weighted towards judging a system, the other towards deciding what to build.
The exam is one requirement of several. PECB awards four credentials from this paper, separated by professional experience and by hours spent on ISMS project activities.
| Provisional Implementer | No professional experience required |
|---|---|
| Implementer | 2 years, one of them in information security management |
| Lead Implementer | 5 years, two of them in information security management |
| Senior Lead Implementer | 10 years, seven of them in information security management |
Each level also requires a number of hours of ISMS project activities, rising from 200 at the lower levels to 1,000 at the top, and all of them require signing the PECB Code of Ethics.
So the honest answer to “how long until I am a Lead Implementer” is usually five years, not five days. The exam can be passed long before the title is available.
As with the Lead Auditor paper, three things are permitted: the standard in hard copy, the course materials, and any personal notes taken during the course, printed or on the PECB Exams app.
On a paper weighted towards planning decisions, the notes worth having are not definitions. They are the sequences: how a scope is set, what a risk assessment produces, what feeds a Statement of Applicability, what management review needs in front of it. Write those down during the course while the trainer is explaining why, not just what.
Revise the front half of the lifecycle hardest. Principles and planning are forty-one per cent of the paper between them.
Do not over-invest in the certification audit. It is five questions out of eighty.
Index your notes by domain before the exam. Eighty questions, open book, and no time to hunt.
Eighty multiple-choice questions, standalone and scenario-based.
70%.
Three hours. Lead-level exams taken on paper allow 30 extra minutes, on request, for candidates sitting in a language other than their own.
Yes — the standard in hard copy, the course materials, and your own notes from the course.
Not by itself. That credential also requires five years of professional experience, two of them in information security management, plus logged ISMS project hours.
You can be certified as a Provisional Implementer on the exam alone, and upgrade later.
Same format and pass mark, opposite weighting. Lead Implementer is heaviest on planning an ISMS; Lead Auditor is heaviest on conducting an audit.
Yes. Lead-level exams carry an additional 30 minutes.
Sources. Every figure on this page comes from PECB’s published candidate handbooks and certification pages, checked in September 2026.
The PECB Exam Bundle is on sale here: exam voucher, Learning Resource Kit and a retake, €670 excl. VAT.
See the Exam Bundle
BITIL.COM is an Authorized Reseller and Silver Partner of PECB.
