Information Security

ISO/IEC 27001 is the usual entry point — it is the certifiable management system standard and the one customers and tenders ask about by name. The others in this category extend it: ISO/IEC 27002 for control implementation guidance, ISO/IEC 27005 for risk methodology, ISO/IEC 27035 for incident management, and ISO/IEC 27400 for security and privacy in IoT.

Lead Implementer teaches you to build, run and improve a management system inside an organization. Lead Auditor teaches you to assess someone else’s against the standard, whether as an internal auditor, a consultant, or on behalf of a certification body. Neither is a prerequisite for the other, and many security professionals eventually hold both.

Two approaches are available here. ISO/IEC 27005 provides the international methodology for identifying, analysing, evaluating and treating information security risk. EBIOS Risk Manager teaches the French ANSSI method, which is widely used across Europe and takes a scenario-driven approach. Both suit anyone who owns the risk assessment process.

Yes. ISA/IEC 62443 addresses security for industrial automation and control systems, where safety and availability constraints make conventional IT security approaches unsuitable. It is the relevant path for manufacturing, utilities and critical infrastructure rather than the general-purpose ISMS standards.

Foundation levels assume no prior experience. The Lead designations and the Chief Information Security Officer credential assume working familiarity with security governance, risk and operations, and PECB’s certification criteria require documented professional experience for the senior designations. See our certification pathways page for the requirements by level.