What should be done FIRST when starting an ISMS implementation?
Domain 3
Answer: B · whyLeadership commitment and scope come before risk assessment and controls.
Accredited personnel-certification bodies, e.g. PECB (and other training providers) · ISO Management Systems - Implementation
ISO/IEC 27001 Lead Implementer
ISMS managers, consultants, security and GRC professionals who build or run an ISO/IEC 27001 ISMS and prepare organisations for certification.
Overview
- Prerequisites
- Training course then exam. Example (PECB): 'Lead Implementer' credential needs 5 years' professional experience incl. 2 years in information security management, plus 300 hours of ISMS project activity; lower grades exist (Implementer: 2 years / 200 hours).
- Maintenance
- PECB certificates are valid for 3 years. Lead Auditor and Lead Implementer holders must report 90 CPD hours over each 3-year cycle (they can be spread unevenly across years) and pay annual maintenance fees (US$390 per 3-year cycle for these certification levels; the first year is included in the application). IRCA and other bodies have their own CPD rules - check official site.
- Outline in effect
- Current standard: ISO/IEC 27001:2022 incl. Amd 1:2024
PECB LI exam duration not confirmed in the documents checked - check official site.
Exam facts
- Questions
- 80 (PECB multiple-choice version)
- Duration
- check official site
- Question types
- Multiple choice with 3 options; stand-alone and scenario-based
- Passing score
- 70% (PECB)
- Format
- Linear, open-book (PECB)
- Delivery
- Check PECB Examination Rules and Policies
Cost
- Notes
- PECB exam/certification fees are bundled with the training price set by each partner - check official site.
Domains
PECB competency domains; no per-domain percentages published.
- 1. Fundamental principles and concepts of an ISMS
- 2. Information security management system requirements
- 3. Planning of an ISMS implementation based on ISO/IEC 27001
- 4. Implementation of an ISMS based on ISO/IEC 27001
- 5. Monitoring and measurement of an ISMS
- 6. Continual improvement of an ISMS
- 7. Preparing for an ISMS certification audit
Upcoming changes
No announced changes as of 19 Oct 2026.
Study plan
- Week 1
Clauses 4-6
- Context, interested parties (incl. climate amendment), scope, leadership, policy, roles.
- Risk assessment and treatment method (ISO/IEC 27005:2022 helps).
- Week 2
Annex A + 27002
- Control themes and attributes; build a sample SoA for a fictional company.
- Week 3
Clauses 7-8
- Resources, competence, awareness, communication, documented information; operational planning and change control.
- Week 4
Clauses 9-10
- Metrics (ISO/IEC 27004), internal audit, management review, nonconformity and corrective action, continual improvement.
- Week 5
Operating the ISMS and certification readiness
- Set up the internal audit programme and the first management review; define 5-8 ISMS metrics.
- Learn the certification path (stage 1 / stage 2, surveillance, recertification) and how to prepare evidence.
- Week 6
Implementation project management
- Gap analysis against clauses 4-10 and Annex A; build a phased project plan with owners, budget and milestones.
- Write a draft ISMS scope statement, information security policy and risk methodology for a fictional company.
- Week 7
Course week
- Attend the course; keep a one-page implementation roadmap (gap analysis - scope - risk - SoA - controls - audit - review - certification).
- Week 8
Exam practice
- Scenario questions; practise justifying exclusions and choosing the right clause.
Exam tips
- Tab your printed standard; questions often hinge on which clause applies.
- Think in PDCA order: plan before you implement, measure before you improve.
- Top management commitment (clause 5) is the usual 'first step' answer.
Common pitfalls
- Starting with tools instead of scope and risk assessment.
- Treating the SoA as a copy of Annex A without justification.
- Forgetting documented information requirements for evidence.
Resources & official links
Official
Also widely used
- ISO/IEC 27003 ISMS implementation guidance (a revision is under development at ISO)
- ISO/IEC 27002:2022
- ISO/IEC 27005:2022 risk management guidance
- ISO/IEC 27004 monitoring and measurement
Sources
- PECB ISO/IEC 27001 Lead Implementer candidate handbook
- PECB Certification Maintenance Policy (2026)
- ISO/IEC 27001:2022
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Clause 4.2 requires the organisation to determine:
Domain 2
Answer: A · why4.2 covers interested parties and their requirements (which, after Amd 1:2024, can include climate-related ones).
Risk acceptance criteria must be defined in:
Domain 3
Answer: A · why6.1.2 a) requires criteria for risk acceptance and for performing assessments.
Who must approve the risk treatment plan and accept residual risks?
Domain 4
Answer: B · why6.1.3 f) requires risk owners' approval of the treatment plan and acceptance of residual risk.
Which is an example of documented information that the standard requires to be retained?
Domain 4
Answer: A · whyClause 7.2 requires retained documented information as evidence of competence.
Measuring whether phishing click rates fall after training supports which clause?
Domain 5
Answer: A · why9.1 requires determining what to monitor and measure and evaluating effectiveness.
When a nonconformity is found, the organisation must react, evaluate the need for action to eliminate causes, implement action and:
Domain 6
Answer: B · whyClause 10.2 requires reviewing the effectiveness of corrective actions.
Which input is required for management review?
Domain 5
Answer: A · whyClause 9.3.2 lists required inputs including previous actions and performance feedback.
Annex A controls are:
Domain 2
Answer: B · whyControls are determined through risk treatment and compared with Annex A.
Before inviting a certification body for Stage 1, the organisation should normally have completed:
Domain 7
Answer: A · whyCertification bodies expect the ISMS to be operating, including internal audit and management review.