ISO 27001 Track
A path through ISO/IEC 27001:2022 that follows the order of the two common professional certificates: Lead Implementer (building an information security management system, or ISMS) and Lead Auditor (auditing one). Parts 1–3 are shared, Part 4 is for implementers and Part 5 is for auditors.
Getting certified
Last verified2026-10
ISO writes the standard, but it does not certify individuals. Personal certificates come from private certification bodies and training schemes. Do not confuse them with the organisational ISO 27001 certificate a company gets.
Proves you can design, build and run an ISMS. The most common one is PECB Certified ISO/IEC 27001 Lead Implementer. PECB is a certification body accredited under ISO/IEC 17024.
Proves you can plan and lead an audit against the standard, following ISO 19011 audit principles. Two schemes are common: PECB ISO/IEC 27001 Lead Auditor, and CQI and IRCA certified ISO/IEC 27001 Lead Auditor courses, which training firms such as BSI and SGS run.
Usually a five-day course run by a training partner, with the exam at the end. The PECB lead exams last three hours. The partner sets the price, and it normally includes the exam.
PECB awards the full Lead grade only with professional experience, roughly five years in total with two in information security, plus logged implementation or audit hours. With less experience you get a lower grade of the same credential. A passed CQI/IRCA course gives a certificate of achievement. Registering as an IRCA auditor is a separate step that needs logged audit experience.
PECB credentials need continuing professional development and an annual maintenance fee. Training providers state that a CQI/IRCA course certificate is valid for five years towards IRCA registration.
Security engineers and GRC (governance, risk and compliance) leads building a programme should pick Lead Implementer. Anyone heading for internal audit, consulting or a certification body should pick Lead Auditor. Many people take both, implementer first.
TipCourse content, exam formats and fees change, and differ between training partners. Check the current exam rules on the certification body's own site before you book. Make sure the course covers the 2022 edition.
Part 1 — What the standard is
- What ISO 27001 is and why it matters — sales, regulators, engineering evidence
- The two halves — clauses 4–10 versus Annex A
- The family of standards — 27000, 27002, 27005, 27017/18, 27701
- What changed in 2022 — 93 controls, 4 themes, 11 new controls, climate amendment
- ISO 27001 vs SOC 2, NIST CSF and NIS2
Part 2 — Risk at the centre
- The core loop — scope, assess, treat, Statement of Applicability
- Risk management fundamentals — likelihood, impact, the four treatment options
- Threat modelling — a concrete way to find risks for a product in scope
- Mandatory documented information
Part 3 — The Annex A controls in practice
- Policy stack and governance — policies, roles, asset security (themes 5 and 6)
- Identity and access — 5.15–5.18 access control, 8.5 secure authentication
- Cryptography — 8.24 use of cryptography
- Vulnerability management — 8.8 management of technical vulnerabilities
- Logging and monitoring — 8.15 logging, 8.16 monitoring activities
- Supply chain and dependencies — 5.19–5.22 suppliers, 8.28 secure coding
- Cloud security concepts — 5.23 information security for cloud services
- Business continuity and DR — 5.29–5.30, 8.13 backup
Part 4 — Implement and operate (Lead Implementer)
- Defenders' use of the ISMS — the risk register drives the backlog, incidents feed back
- Change, configuration and patch management — 8.9, 8.32
- Incident response and tabletop exercises — 5.24–5.28 incident management
- NIS2 and CRA & DORA — map Article 21 and DORA requirements onto your ISMS
Part 5 — Audit (Lead Auditor)
- The certification audit cycle — Stage 1, Stage 2, surveillance, recertification
- Nonconformities — major, minor, opportunity for improvement
- Evidence requests — sampling access reviews, vulnerability SLAs, incidents
- Certified does not mean secure — scope, paper controls, suppliers
- Interview Q&A — say every answer out loud