Know exactly where you stand
before investing months in
ISO 27001 LA preparation.

The exam is challenging mainly because it tests auditing, not security engineering. Most competency domains cover audit principles, preparing, conducting and closing audits, and managing an audit program. Security professionals who know controls well but have not practiced audit methodology, evidence gathering and nonconformity grading often find these questions harder than expected.

The exam is three hours long and uses multiple-choice questions, both stand-alone and scenario-based. It is open book: you can use the ISO/IEC 27001 standard, your course materials and notes. It can be taken online or at the end of a training course, depending on the provider.

PECB requires 70% to pass. You receive a pass or fail result. Open-book access does not make it easy: looking up every answer will run you out of time, so use the materials only to confirm details. Know where key clauses and Annex A themes are before exam day, and practice timed scenario questions so you can pace the three hours.

Not by itself. PECB awards the credential level based on experience. The Lead Auditor credential requires five years of professional experience, including two in information security, and 300 hours of audit activity. Candidates with less experience are awarded Provisional Auditor or Auditor and can upgrade as they gain experience.

The 2022 revision reorganized Annex A into 93 controls in four themes, merged many older controls and added new ones, such as threat intelligence and cloud services security. Clause wording was also refined. Materials and audit checklists based on the 2013 version reference controls that no longer exist.

You can retake it, but waiting periods increase with each attempt. Candidates who took the course through a PECB partner usually get one free retake within a year. After that, retake fees apply. Use your weak areas to focus review, often audit methodology or the 2022 Annex A structure.