Most candidates walk into this exam expecting a four-option multiple-choice test where they can look up the answers. Official exam guidance indicates otherwise on both counts. Every question has three options, one correct and two distractors, and half of the 80 questions are written at the evaluation level, so a lookup in the standard will not settle them.
TL;DR
- 80 multiple-choice questions, 3 options each, 70% to pass. That is 56 of 80 correct.
- Open-book. You may use the ISO/IEC 27002 standard, the training course materials and your own notes from the course.
- Half the exam is evaluation-level. Domains 3 and 4 (40 questions) test judgment about whether a described action is right. Domains 1, 2 and 5 (40 questions) test comprehension, application and analysis.
- Cost: a standalone Lead exam is $1,000 and the certification application fee is $500. Training bought from a PECB partner bundles the exam, one free retake, the application fee and the first year of the annual maintenance fee, all to be used within 12 months.
- Passing does not give you the Lead Manager title by itself. Everyone who passes can apply as Provisional Manager; Lead Manager needs 5 years of experience, 2 of them in information security management, and 300 hours of project activities.
Quick Facts
| Item | Value |
|---|---|
| Questions | 80 multiple-choice |
| Options per question | 3 (one correct, two distractors) |
| Passing score | 70% |
| Question types | Stand-alone and scenario-based (five questions per scenario) |
| Cognitive split | 40 comprehension/application/analysis + 40 evaluation |
| Reference materials | ISO/IEC 27002, training course materials, personal course notes |
| Duration | 3 hours |
| Extra time | +30 minutes for Lead exams taken in a non-native language, if requested on exam day |
| Retake wait | 15 days after the first attempt; no limit on retakes |
| Results | Instant for online multiple-choice exams |
| Certification validity | 3 years |
Everything above comes from official exam documentation, official exam rules, and official course materials. The one item to double-check is the duration, because some current pages do not repeat it and the course brochure is the source.
What Changed Between ISO/IEC 27002:2013 and 2022
The handbook lists "knowledge of the differences between ISO/IEC 27002:2013 and ISO/IEC 27002:2022" as a Domain 2 knowledge statement, so the exam expects you to know both editions. The 2013 edition had 114 controls in 14 clauses. The 2022 edition has 93 controls grouped into four themes: organizational, people, physical and technological. The handbook names those four categories in its Domain 2 competencies. Official course materials report that 11 of the 93 controls are new in 2022, so confirm the list against your licensed copy of the standard.
Two practical consequences follow:
- Your mental map has to match the 2022 edition. If you learned the controls under the 14-clause structure, expect to re-learn where things sit.
- Several knowledge statements point at newer topics. The handbook names threat intelligence in Domain 3. It also calls out data masking, data leakage prevention and the secure development life cycle in Domain 4. Those are the places to check the 2022 text first.
Use your own copy of ISO/IEC 27002:2022 as the final reference for control numbers and wording.
How the 80 Questions Are Distributed
Official exam documentation publishes the distribution exactly.
| Domain | Questions | Share of exam | Level |
|---|---|---|---|
| 1. Fundamental principles and concepts of information security, cybersecurity and privacy | 10 | 12.5% | Comprehension, application, analysis |
| 2. ISMS and initiation of ISO/IEC 27002 controls implementation | 10 | 12.5% | Comprehension, application, analysis |
| 3. Implementation and management of organizational and people controls | 20 | 25% | Evaluation |
| 4. Implementation and management of physical and technological controls | 20 | 25% | Evaluation |
| 5. Performance measurement, testing and monitoring of controls | 20 | 25% | Comprehension, application, analysis |
| Total | 80 | 100% | 40 + 40 |
Note the split. Domain 5 is the largest domain that is not evaluation-level, so a candidate who assumes the three 25% domains are all judgment calls has misread the table.
Domain 1: Fundamental principles and concepts
Ten questions. The handbook's competencies cover the ISO/IEC 27000 family of standards, the concepts of information security, cybersecurity and privacy, confidentiality, integrity and availability, the relationship between vulnerabilities and threats, the purpose of the different categories of controls, the definition of information security risk, and privacy components and principles.
This is the vocabulary domain. Questions rely on precise definitions, and with three plausible options a loose understanding of a term is enough to pick the wrong one. The open-book rules help most here, because the definitions are in the standard and in your course notes.
Domain 2: ISMS and initiation of controls implementation
Ten questions. The handbook lists a long run of competencies: the definition of a management system and the main components of an ISMS, the Plan-Do-Check-Act cycle, the structure of ISO/IEC 27002, analyzing an organization's existing security architecture, performing a gap analysis and drafting a gap analysis report, the risk management process, choosing a risk assessment methodology, and running the steps of a risk assessment.
Two points deserve attention. The handbook names the types of risk analysis (qualitative, semi-quantitative and quantitative) and the four risk treatment options (modification, retention, avoidance and sharing), so expect questions that ask you to match a method or option to a described situation. It also covers the criteria for selecting controls and the steps to implement them, which is the bridge to Domains 3 and 4.
Domain 3: Organizational and people controls
Twenty evaluation-level questions. This is where the exam tests your judgment about whether a described organizational action aligns with ISO/IEC 27002 guidance, not whether you can recite a control name. The handbook's competencies include:
- information security policies and the processes for establishing them
- assigning and managing information security roles and responsibilities, including segregation of duties and management responsibilities
- legal, statutory, regulatory and contractual requirements
- information security in project management and when using cloud services
- protecting records, documented operating procedures, and personally identifiable information
- asset management, classification and labelling of information
- access control, identity management and access rights management
- the hiring process: screening, terms and conditions, termination or change of employment
- awareness and training programs
- supplier relationships, supplier agreements and the ICT supply chain
- business impact analysis and business continuity plans
- information security incident management, from planning and preparation through assessment, response and learning
The list shows why a flat read of the control catalogue is a poor way to study this domain. Each topic is a decision an organization has to make, and the questions ask you to judge one.
Domain 4: Physical and technological controls
Twenty more evaluation-level questions. The competencies span physical security perimeters and entry controls, the security of offices, rooms and facilities, protection against physical and environmental threats, clear desk and clear screen, storage media and equipment, and equipment maintenance. On the technological side they cover protection against malware, technical vulnerability management, data anonymization and pseudonymization, symmetric and asymmetric cryptography, application security through the development life cycle, endpoint devices, logging and clock synchronization, authorized access, and network protection.
The knowledge statements go into more detail than the competencies: capacity management and configuration management, data masking and data leakage prevention, the management of privileged access rights and privileged utility programs, risks around unauthorized access to source code, and the recording and review of logs. Governance-minded candidates sometimes underinvest here on the assumption that technical controls belong to engineers. The handbook frames the objective as being able to identify and understand the guidelines, and the questions are judgment calls about those guidelines.
Domain 5: Performance measurement, testing and monitoring
Twenty questions at the comprehension, application and analysis level. The objective is to understand the controls for testing information security and to conduct performance measurement and monitoring. Competencies include testing information security across the software testing life cycle, ensuring the security of outsourced services and outsourced system development, protecting the production environment and test information, protecting information systems during audit testing, performing independent reviews, network monitoring, and continual improvement.
Because this domain is a quarter of the exam, a candidate who studied only how to select and implement controls leaves 20 questions on the table. How you verify that a control works is a separate body of knowledge from how you choose it.
What an Evaluation-Level Question Asks
The handbook describes the question style: candidates "apply various concepts and principles explained during the training course, analyze problems, identify and evaluate alternatives, combine several concepts or ideas". Scenario-based questions give you a case to read and then ask five questions about it. Stand-alone questions do not depend on any context.
Three things follow from that description:
- Open-book does not mean lookup. The standard tells you what a control says. It does not tell you whether the organization in the scenario has applied it correctly. That is a reasoning step you do yourself.
- Three options make elimination harder. With two distractors and one keyed response, there is less room to rule out options by inspection. Practice choosing between two answers that both sound defensible.
- Scenario questions reward reading the questions first. This is a general technique: skim the five questions, then read the scenario with those questions in mind.
What the Exam Costs
Official documentation lists the following prices in US dollars:
| Item | Price |
|---|---|
| Lead exam (standalone, no training required) | $1,000 |
| Certification application fee | $500 |
| Annual maintenance fee | $390 per 3-year cycle |
| Upgrade application fee | $100 |
Official documentation states that candidates may take the exam without attending the training course. That makes a standalone attempt $1,500 once you add the application fee, before any study material, and retakes are charged again.
For candidates who complete a training course delivered by a PECB partner, whether instructor-led, eLearning or self-study, official documentation states that the training fee includes the first exam attempt, one free retake, the certification application fee, and the first year of the annual maintenance fee. That cycle must be completed within 12 months from the course completion date for instructor-led training, or within 12 months from the purchase date for self-study and eLearning formats. If you expect to need a second attempt, the bundle changes the math. Prices for training itself vary by partner and region, so compare them directly with the partner you plan to use.
Exam-Day Rules
You must be present at least 30 minutes before the exam starts, or risk late-arrival restrictions that include receiving no extra time and potentially being barred from sitting. You need a valid identity card, driver's license or passport.
For online exams, the exam runs through the PECB Exams application with remote supervision by an invigilator and an external or integrated camera. Secondary electronic devices such as tablets and phones are not allowed. Official guidance recommends reviewing the exam guide and verifying technical requirements at least 48 hours prior. Paper-based exams are arranged through the PECB partner that provided your training course.
The reference materials allowed for this exam are a copy of ISO/IEC 27002 (through the PECB Exams app and/or printed), the training course materials, and your personal notes from the course. Official exam rules mention a hard-copy dictionary may be available for open-book formats, but the ISO/IEC 27002 handbook does not list one explicitly, so do not rely on it.
Disclosing exam content is a violation of the official code of ethics. The provider enforces compliance, with potential consequences including credential suspension and revocation. That makes unauthorized "dump" material a risk to the credential, not just a poor study method.
Retakes and Results
Online multiple-choice exams return results instantly. Paper-based multiple-choice results take two to four weeks. Official results notification includes a breakdown of your performance by domain, which helps focus any retake preparation.
There is no limit on retakes. The first retake can be taken 15 days after the date of the first exam. If you disagree with the evaluation, you can request a re-evaluation within 30 days of receiving your result, and then file an appeal through the PECB ticketing system within 30 days of the re-evaluation decision. Appeals after 30 days are not processed.
Which Credential You Can Claim After Passing
All candidates who pass are entitled to apply for a credential, but the title depends on the experience you can document.
| Credential | Professional experience | Information security management experience | Project activities |
|---|---|---|---|
| Provisional Manager | None | None | None |
| Manager | 2 years | 1 year | 200 hours |
| Lead Manager | 5 years | 2 years | 300 hours |
| Senior Lead Manager | 10 years | 7 years | 1,000 hours |
Every credential also requires signing the official code of ethics. The project activities must include drafting an ISMS implementation plan, managing an information security implementation project, implementing information security processes, selecting information security controls, and implementing and evaluating those controls. Each application needs two professional references, who cannot be people under your supervision or relatives.
You apply for the certificate within 12 months of course completion (instructor-led) or of the purchase date (self-study and eLearning). Passing without the experience still earns the Provisional Manager credential, and you can upgrade later through your PECB dashboard (View Certificate, then Upgrade).
One discrepancy worth knowing: an older official brochure listed only one year of information security management experience for Lead Manager. Current documentation specifies two years. The current candidate handbook is the document to follow.
Keeping the Credential Active
PECB certifications are valid for three years. To maintain them you must submit continuing professional development hours and pay the annual maintenance fee. The Lead Manager credential needs 90 CPD hours over the three-year cycle, the Manager credential needs 60, and Foundation, Provisional and Transition credentials need none. The maintenance fee is $390 per three-year cycle for all other certifications.
If you do not submit CPD hours and pay the fee, the certification enters a 12-month suspension during which you can fix the gap. If the outstanding items are not addressed within those 12 months, the certification can be revoked. While suspended you may not promote the certification.
How to Prepare
For practice, CertCompanion has 203 reviewed questions for this exam, each with an explanation. Start free at /exams/pecb-certified-iso-iec-27002-lead-manager. Use them to rehearse the evaluation-style judgment calls in Domains 3 and 4, and to check the measurement and monitoring topics in Domain 5. These official resources provide supporting material:
- The Candidate Handbook (free PDF from PECB). It contains the competency domains, the question distribution and sample exam questions with the same three-option structure as the real exam.
- The training course materials. The course material totals more than 450 pages with practical examples, exercises, and quizzes, and the course earns 31 CPD credits. The quizzes follow the structure of the certification exam.
- Your own copy of ISO/IEC 27002:2022. It is an allowed reference in the exam, so learn how to navigate it quickly.
Other PECB exams are on the PECB hub.
A good test of readiness is whether you can explain, for each handbook competency, why a described action does or does not match the standard's guidance.
Frequently Asked Questions
How many questions are on the exam and what is the pass mark? Eighty multiple-choice questions, with a passing score of 70%. Official exam documentation does not describe unscored items for this exam.
How many answer options does each question have? Three. One is the keyed response and two are distractors.
Is the exam open-book? Yes. Official documentation allows the ISO/IEC 27002 standard, the training course materials and your personal notes from the course.
How long must I wait to retake after a fail? You must wait 15 days after the date of the first exam for the first retake. There is no limit on the number of retakes. Candidates who bought a PECB partner course get one free retake, which must be used within the 12-month cycle.
When do I get my results? Instantly for online multiple-choice exams. Paper-based multiple-choice results take two to four weeks.
Do I need work experience to sit the exam? No. Candidates may take the exam without attending the course, and the Provisional Manager credential has no experience requirement. Work experience matters when you apply for Manager, Lead Manager or Senior Lead Manager.
What is the difference between this and the ISO/IEC 27001 Lead Implementer exam? ISO/IEC 27002 is the guidance on information security controls, and this exam is centered on selecting, implementing and managing them. ISO/IEC 27001 specifies the requirements for an ISMS. The two PECB exams are separate schemes with their own candidate handbooks, so read the handbook for the one you plan to take.
How much does the Lead exam cost? $1,000 for the exam plus a $500 certification application fee when taken standalone. A PECB partner course bundles the first attempt, one free retake, the application fee and the first year of the maintenance fee.
The exam rewards one thing: being able to judge how ISO/IEC 27002:2022 applies to a described situation. Learn the five domains from the handbook, get fast at navigating the standard, and practise scenario questions until the three-option format stops feeling like a trap. Then check the credential tier you can claim before you pay for the application.
Start with 30 free practice questions at CertCompanion and find out where your ISO 27002 control judgment stands.
Checked against official PECB ISO27002LM exam documentation and current candidate reports. Last verified 2026-11-01.