ISO 27001 LI study guide · 2026

The 7 ISO 27001 LI domains, explained

7 domains and 60 official knowledge statements. Planning of an ISMS Implementation Based on ISO/IEC 27001 carries the most weight at 22.5%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 3 See all domains
Questions
80 multiple-choice questions (three options each; standalone and scenario-based)
Time
3 hours, open book
Passing score
70%
Outline
PECB ISO/IEC 27001 Lead Implementer Candidate Handbook v1.5 (multiple-choice exam, 2026; ISO/IEC 27001:2022) (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 18.75%
  2. 2 15%
  3. 3 22.5%
  4. 4 17.5%
  5. 5 12.5%
  6. 6 7.5%
  7. 7 6.25%
  1. 1 Fundamental Principles and Concepts of an Information Security Management System
  2. 2 Information Security Management System Requirements
  3. 3 Planning of an ISMS Implementation Based on ISO/IEC 27001
  4. 4 Implementation of an ISMS Based on ISO/IEC 27001
  5. 5 Monitoring and Measurement of an ISMS Based on ISO/IEC 27001
  6. 6 Continual Improvement of an ISMS Based on ISO/IEC 27001
  7. 7 Preparing for an ISMS Certification Audit

All 7 domains

60 official knowledge statements 62–79 hrs suggested study

  1. Domain 01 18.75%

    Fundamental Principles and Concepts of an Information Security Management System

    The vocabulary an implementer works with every day: compliance obligations, ISO/IEC 27001 terms, information security risk, confidentiality, integrity and availability, impacts, and how controls are classified by type and function.

    Inside this domain

    • Information security laws, regulations, international and industry standards, contracts, market practices, internal policies, best practices, etc., an organization must comply with
    • The main concepts and terminology of ISO/IEC 27001
    • Information security risk and its importance in an ISMS
    • Confidentiality, integrity, and availability of information
    • and 4 more knowledge statements

    Watch for Standard as law

    Knowledge statements
    8
    Questions est.
    ~15
    Study time est.
    9–11 hrs
  2. Domain 02 15%

    Information Security Management System Requirements

    Despite its title, this domain is about controls: security services, architecture frameworks, the 93 Annex A controls and ISO/IEC 27002 guidance, the four control themes, and selecting, implementing and documenting controls.

    Inside this domain

    • Common security services such as access control services, boundary control services, integrity services, cryptographic services, and audit and monitoring services
    • The most common architecture frameworks
    • The 93 Annex A controls of ISO/IEC 27001 and their guidance specified in ISO/IEC 27002
    • The four groups of Annex A controls such as organizational controls, people controls, physical controls, technological controls
    • and 2 more knowledge statements

    Watch for Certify to 27002

    Knowledge statements
    6
    Questions est.
    ~12
    Study time est.
    9–12 hrs
  3. Domain 03 22.5%

    Planning of an ISMS Implementation Based on ISO/IEC 27001

    The largest domain: running the ISMS as a project, understanding the organization and its context, defining scope, writing policy, and carrying out risk assessment, risk treatment and the Statement of Applicability.

    Inside this domain

    • The main project management concepts, terminology, process and best practices
    • The principal approaches and methodology frameworks to implement an ISMS
    • Typical information security and ISMS objectives and how to achieve specific results
    • What typically constitutes an organization's internal and external context
    • and 10 more knowledge statements

    Watch for Controls first

    Knowledge statements
    14
    Questions est.
    ~18
    Study time est.
    14–17 hrs
  4. Domain 04 17.5%

    Implementation of an ISMS Based on ISO/IEC 27001

    Turning the plan into a working ISMS: managing documented information, handling new technologies such as big data, AI and cloud, running awareness and communication, and operating incident management and business continuity.

    Inside this domain

    • The best practices on documented information life cycle management
    • The characteristics and the differences between the different documented information related to an ISMS policy, procedure, guideline, standard, baseline, worksheet, etc.
    • The documents that ensure compliance with ISO/IEC 27001 requirements
    • The three V's of big data: volume, variety, and velocity
    • and 7 more knowledge statements

    Watch for ISMS manual required

    Knowledge statements
    11
    Questions est.
    ~14
    Study time est.
    11–14 hrs
  5. Domain 05 12.5%

    Monitoring and Measurement of an ISMS Based on ISO/IEC 27001

    The Check phase from the implementer's side: monitoring and measuring ISMS effectiveness, setting up an internal audit programme, grading and reporting nonconformities, and running management reviews that lead to decisions.

    Inside this domain

    • The best practices and techniques used to monitor and evaluate the effectiveness of an ISMS
    • The concepts related to measurement and evaluation
    • The main concepts and components related to the implementation and operation of an ISMS internal audit program
    • The difference between a major and a minor nonconformity
    • and 2 more knowledge statements

    Watch for Activity metric

    Knowledge statements
    6
    Questions est.
    ~10
    Study time est.
    8–10 hrs
  6. Domain 06 7.5%

    Continual Improvement of an ISMS Based on ISO/IEC 27001

    The Act phase: finding root causes of nonconformities, treating them through correction and corrective action, building action plans, and keeping the ISMS improving as internal and external factors change.

    Inside this domain

    • The main processes, tools, and techniques used to identify the root causes of nonconformities
    • The treatment of nonconformities process
    • The main processes, tools, and techniques used to develop corrective action plans
    • The main concepts related to continual improvement
    • and 2 more knowledge statements

    Watch for Fix and close

    Knowledge statements
    6
    Questions est.
    ~6
    Study time est.
    6–8 hrs
  7. Domain 07 6.25%

    Preparing for an ISMS Certification Audit

    Getting the organization ready for its certification body: evidence-based auditing, audit types, Stage 1 and Stage 2 requirements, document review criteria, follow-up, surveillance, recertification and post-audit action plans.

    Inside this domain

    • The evidence-based approach to an audit
    • The types of audit and their differences
    • The differences between Stage 1 and Stage 2 audits
    • The Stage 1 audit requirements, steps, and activities
    • and 5 more knowledge statements

    Watch for Certificate at closing

    Knowledge statements
    9
    Questions est.
    ~5
    Study time est.
    5–7 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 62–79 hrs of study.

  1. 3 Planning of an ISMS Implementation Based on ISO/IEC 27001 22.5% · 14–17 hrs
  2. 1 Fundamental Principles and Concepts of an Information Security Management System 18.75% · 9–11 hrs
  3. 4 Implementation of an ISMS Based on ISO/IEC 27001 17.5% · 11–14 hrs
  4. 2 Information Security Management System Requirements 15% · 9–12 hrs
  5. 5 Monitoring and Measurement of an ISMS Based on ISO/IEC 27001 12.5% · 8–10 hrs
  6. 6 Continual Improvement of an ISMS Based on ISO/IEC 27001 7.5% · 6–8 hrs
  7. 7 Preparing for an ISMS Certification Audit 6.25% · 5–7 hrs

Try one

Practice questionDomain 3: Planning of an ISMS Implementation Based on ISO/IEC 27001

An insurer has completed its risk assessment. For a high risk involving a legacy claims portal, management decides to shut the portal down and move all claims to a new, already secured platform. The implementer is asked to record the treatment option in the risk treatment plan. Which option applies?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Standard as law

    Clue The scenario names a customer contract or a regulator as the source.

  • Domain 2

    Certify to 27002

    Clue Options mention certifying a guidance document.

  • Domain 3

    Controls first

    Clue Question asks what to do next after context and scope.

  • Domain 4

    ISMS manual required

    Clue Question asks which document is mandatory.

  • Domain 5

    Activity metric

    Clue Question asks about effectiveness of a control.

  • Domain 6

    Fix and close

    Clue The same issue has occurred before.

  • Domain 7

    Certificate at closing

    Clue Option names the lead auditor as granting certification.

Other Cybersecurity certifications

Study guides for exams that overlap with ISO 27001 LI.

Practise what you read

ISO 27001 LI domains: common questions

How many domains are in the ISO 27001 LI exam?

ISO 27001 LI has 7 domains with 60 official knowledge statements between them: Fundamental Principles and Concepts of an Information Security Management System, Information Security Management System Requirements, Planning of an ISMS Implementation Based on ISO/IEC 27001, Implementation of an ISMS Based on ISO/IEC 27001, Monitoring and Measurement of an ISMS Based on ISO/IEC 27001, Continual Improvement of an ISMS Based on ISO/IEC 27001 and Preparing for an ISMS Certification Audit.

Which ISO 27001 LI domain carries the most weight?

Planning of an ISMS Implementation Based on ISO/IEC 27001 is the heaviest at 22.5%, followed by Fundamental Principles and Concepts of an Information Security Management System (18.75%). The lightest is Preparing for an ISMS Certification Audit (6.25%). Weights come from PECB's official outline.

What is the ISO 27001 LI exam format?

Questions: 80 multiple-choice questions (three options each; standalone and scenario-based). Time allowed: 3 hours, open book. Passing score: 70%.

How long should I study for ISO 27001 LI?

Our planning estimate is 62–79 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Planning of an ISMS Implementation Based on ISO/IEC 27001, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows PECB ISO/IEC 27001 Lead Implementer Candidate Handbook v1.5 (multiple-choice exam, 2026; ISO/IEC 27001:2022) (current), published by PECB. It was last reviewed in October 2026.

Domain names, weights and knowledge statements come from PECB's official outline (PECB ISO/IEC 27001 Lead Implementer Candidate Handbook v1.5 (multiple-choice exam, 2026; ISO/IEC 27001:2022) (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.