Information Security Management Systems
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system. It is the most widely recognised security certification in the world, and the one most often written into enterprise contracts, tender requirements and supplier assurance questionnaires.
Why ISO/IEC 27001 is worth holding
- Named directly in enterprise procurement and vendor due-diligence questionnaires
- Maps cleanly onto SOC 2, NIS 2, DORA and GDPR control expectations
- The single most requested credential on information security job listings
- Certification paths
- 4
- From
- $695
Certification path
You do not need all of these. Most people take one — the level that matches what they are actually being asked to do.
Foundation
A two-day grounding in ISO/IEC 27001 — the vocabulary, the structure of the standard and how information security management systems actually work in practice.
Transition
Two days mapping what changed in the current edition of ISO/IEC 27001, and what your existing ISMS has to do about it before the next surveillance audit.
Lead Implementer
Five days on leading an ISO/IEC 27001 implementation end to end — from gap assessment and scope through risk assessment, control selection and the Statement of Applicability, to the certification audit itself.
Lead Auditor
Five days on auditing information security management systems against ISO/IEC 27001, using the ISO 19011 and ISO/IEC 17021-1 principles that certification bodies audit by.
Compare the levels
| Level | Length | CPD | Exam | Best for | From |
|---|---|---|---|---|---|
| Foundation | 2 days | 14 | 1h · Multiple choice | Professionals joining the ISMS implementation or audit team | $795 |
| Transition | 2 days | 14 | 1h · Multiple choice | ISMS managers and owners maintaining an existing certification | $695 |
| Lead Implementer | 5 days | 31 | 3h · Essay-type | Project managers and consultants leading the ISMS implementation | $1,495 |
| Lead Auditor | 5 days | 31 | 3h · Essay-type | Auditors seeking to lead certification audits of a management system | $1,495 |
PECB is a global certification body that provides training and certification against ISO standards. Its personnel certification schemes are accredited to ISO/IEC 17024, the international standard for bodies certifying people — which is what makes a PECB credential recognised by employers, auditors and certification bodies worldwide rather than being a private certificate of attendance.
No. Foundation is not a formal prerequisite for Lead Implementer or Lead Auditor. It exists for people who are new to the standard and want the vocabulary and clause structure before the deeper course. If you already work with the standard day to day, go straight to the Lead course — we will tell you plainly on the pre-enrolment call which is right for you.
The official PECB participant materials and case studies, the certification exam voucher, one free retake if you do not pass first time, your first-year certification application fee, the CPD credits, twelve months of KATE app access, and a 1:1 call before you enrol. There are no separate exam fees added later.
Lead Implementer is for building the management system: scope, risk assessment, control selection, documentation and getting the organisation ready for its certification audit. Lead Auditor is for assessing one: audit planning, evidence gathering, findings, nonconformity reports and audit programme management. Implementers build, auditors verify. Consultants often hold both.
Foundation exams are one hour and multiple choice. Lead-level exams are three hours, essay-type and open book — you may bring the standard and your own notes. Exams can be sat online with remote proctoring or on paper at the end of a classroom session. Results are typically issued within four to six weeks, and your certification is then issued once your application is approved.
One retake is included in every price on this site, at no additional cost. PECB allows retakes without repeating the training, and we will run a focused review session with you first to work out what went wrong.