Training, exams and certification
Training, exams and certification
Eighty questions in three hours, open book, seventy per cent to pass. Six domains, and the heaviest is risk assessment — but treatment and assessment methodologies together weigh more.
Reviewed by GoToCertify’s accredited trainers
The PECB Certified ISO/IEC 27005 Lead Risk Manager exam tests whether you can lead information security risk management based on ISO/IEC 27005 across the whole cycle: programme, assessment, treatment, communication, monitoring and the choice of method.
| Questions | 80, multiple choice with three options each — standalone and scenario-based |
|---|---|
| Duration | 3 hours |
| Pass mark | 70% — 56 of 80 |
| Materials | Open book — a hard copy of ISO/IEC 27005, the training course materials and your own notes from the course |
| Delivery | Online in the PECB Exams app with a remote invigilator, or on paper at a PECB partner’s site |
| Retakes | One free retake within 12 months for candidates trained by a PECB partner (included in our Exam Bundle) |
| Non-native language | 30 additional minutes for Lead-level exams taken on paper, on request |
| Typical course | Five days, with the exam on the fifth |
| Validity | Three years, with CPD and an annual maintenance fee |
| Credential | Passing the exam is one of several requirements. See below |
Six domains, eighty questions, weights from PECB’s ISO/IEC 27005:2022 certification scheme:
| Information security risk assessment | 20 questions · 25% | |
| Information security risk treatment | 15 questions · 18.75% | |
| Information security risk assessment methodologies | 15 questions · 18.75% | |
| Fundamental principles and concepts of information security risk management | 13 questions · 16.25% | |
| Information security risk communication, monitoring and improvement | 10 questions · 12.5% | |
| Implementation of an information security risk management program | 7 questions · 8.75% |
Risk assessment is a quarter of the paper. Treatment and methodologies add thirty more questions: together the three domains make up sixty-two per cent, and that is where the pass is won.
Compared with Risk Manager, the Lead paper splits the process into assessment, treatment and communication-monitoring, and gives the assessment methodologies almost one question in five.
The exam is one requirement of several. PECB awards three credentials from this paper, separated by professional experience:
| Provisional Risk Manager | No experience required |
|---|---|
| Lead Risk Manager | 5 years, 2 in information security risk management · 300 hours of risk management activity |
| Senior Lead Risk Manager | 10 years, 7 in information security risk management · 1,000 hours of risk management activity |
Treat assessment and treatment as one chain. Criteria set in the context drive the evaluation, the evaluation drives the treatment options, and the treatment plan drives the residual risk that someone must accept.
Know the methodologies by purpose and output. Fifteen questions are about choosing and comparing assessment methods, not about any single one.
Budget just over two minutes a question. Three hours for eighty questions leaves room to check the standard on scenario questions, not on every one.
Eighty multiple-choice questions, with three options each, standalone and scenario-based.
70 per cent, which is 56 of 80.
Three hours. Lead-level exams taken on paper allow 30 extra minutes, on request, for candidates sitting in a language other than their own.
Yes: a hard copy of ISO/IEC 27005, the course materials and your own notes from the course.
No. The Lead Risk Manager exam can be taken directly; the experience you have decides which credential you receive.
Sources. Every figure on this page comes from PECB’s published certification scheme for ISO/IEC 27005:2022, candidate handbooks, brochures and certification pages, checked in October 2026.
The PECB Exam Bundle is on sale here: exam voucher, Learning Resource Kit and a retake, €870 excl. VAT. Not sure yet? Try 10 free practice questions first.
See the Exam Bundle
BITIL.COM is an Authorized Reseller and Silver Partner of PECB.
