ISO 27001 LI Domain 1: Fundamental Principles and Concepts of an Information Security Management System (18.75%)

Overview

Domain 1 is the conceptual base of the PECB Lead Implementer exam. Its eight knowledge statements cover the laws, regulations, standards, contracts and internal policies an organization must comply with, the core terminology of ISO/IEC 27001, why information security risk drives an ISMS, the confidentiality, integrity and availability properties, the link between threats, vulnerabilities and risk, the impacts that loss of those properties can cause, and two ways of classifying controls.

The current exam is 80 open-book multiple-choice questions, each with three options, and this domain supplies 15 of them. Older material that describes a 12-question essay exam is out of date. The terms come mostly from ISO/IEC 27000 and clauses 3 to 6 of ISO/IEC 27001:2022, while the control classifications echo the attribute scheme in ISO/IEC 27002:2022.

Why it matters on the exam

With 15 questions, this is the second largest domain, and its terms reappear in every scenario on the paper. A candidate who confuses a threat with a vulnerability, or an asset owner with a risk owner, will misread questions in planning, implementation and monitoring too. The domain also frames the implementer's first task: working out which obligations apply before designing anything. Many wrong answers on the exam are technically sensible but ignore a contract clause, a regulation or the organization's own policy. Control classification matters as well, because scenario items ask whether a proposed control prevents, detects or corrects, and whether it is technical, administrative or legal in nature. Note that the exam changed from essays to multiple choice, so precise definitions now count more than long written arguments.

How it's tested

Questions here are short and definitional, or they wrap a definition inside a small scenario. You might be asked to classify an event, label a control, identify which security property was lost, or choose which obligation the organization must respect. The three options are usually close in meaning, so exact ISO/IEC 27000 vocabulary decides the answer.

Name the property

A described incident, such as altered payroll data or a website outage, must be mapped to confidentiality, integrity or availability.
Threat, vulnerability or risk

Three options describe the same situation from different angles, and you must pick the one that matches the term asked for.
Classify the control

A control such as log review, a backup restore or a signed nondisclosure agreement must be labelled by function or by type.

Reasoning it through

A hospital finds that a contractor could read patient files because a shared folder had no permissions set. Asked what the missing permissions represent, reason through the chain: the contractor's curiosity is the threat source, the open folder is the vulnerability, and the chance of patient data disclosure with its impact is the risk. The answer is vulnerability, and the property at stake is confidentiality.

Knowledge statements 8

Official knowledge statements from the PECB outline, in outline order.

1.1 Information security laws, regulations, international and industry standards, contracts, market practices, internal policies, best practices, etc., an organization must comply withIdentifying the obligations an ISMS must address.

What it means: An organization operates under external requirements such as data protection law, sector regulation, contractual security clauses and certification schemes, plus internal ones such as its own policies. ISO/IEC 27001 clause 4.2 asks it to determine the relevant requirements of interested parties and which of these the ISMS will address.
What to understand: Examples include GDPR or similar privacy laws, NIS2 for essential entities, PCI DSS for card data, customer contracts, and industry codes. Annex A control 5.31 requires legal, statutory, regulatory and contractual requirements to be identified, documented and kept up to date. Standards like ISO/IEC 27001 are voluntary unless a contract or regulation makes them mandatory.
How it shows up: Expect a scenario asking which source creates a binding obligation, or what the implementer should identify first when defining requirements.
Common confusion: Treating ISO/IEC 27001 itself as a legal requirement in every country.

1.2 The main concepts and terminology of ISO/IEC 27001Core vocabulary from ISO/IEC 27000 and the standard.

What it means: Key terms include management system, information security, interested party, top management, policy, objective, risk, risk owner, control, documented information, nonconformity, corrective action, continual improvement, conformity and effectiveness. Their definitions live in ISO/IEC 27000, which ISO/IEC 27001 clause 3 references.
What to understand: ISO/IEC 27001:2022 follows the harmonized structure shared by ISO management system standards: clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement. Requirements use 'shall'. Annex A is normative but controls are selected through risk treatment. Conformity means meeting a requirement; effectiveness means achieving planned results.
How it shows up: Definitional items ask which term fits a description, for example the person with accountability and authority to manage a risk.
Common confusion: Using 'asset owner' and 'risk owner' as if they were the same role.

1.3 Information security risk and its importance in an ISMSWhy the ISMS is built around risk.

What it means: Risk is the effect of uncertainty on objectives, and in information security it is usually expressed as a combination of the consequences of an event and its likelihood. The ISMS is risk-based: controls are chosen because assessed risks require them, not because a list exists.
What to understand: Clause 6.1 requires actions to address risks and opportunities, clause 6.1.2 a repeatable risk assessment process with criteria, and clause 6.1.3 risk treatment. Clause 8.2 and 8.3 require assessments and treatment to be performed at planned intervals or when significant changes occur. ISO/IEC 27005:2022 and ISO 31000 give guidance but are not mandatory.
How it shows up: Questions ask what justifies selecting a control, and the answer traces back to risk assessment results and treatment decisions.
Common confusion: Believing every Annex A control must be implemented regardless of risk.

1.4 Confidentiality, integrity, and availability of informationThe three properties information security preserves.

What it means: Confidentiality means information is not made available or disclosed to unauthorized individuals, entities or processes. Integrity means accuracy and completeness. Availability means being accessible and usable on demand by an authorized entity.
What to understand: Other properties such as authenticity, accountability, non-repudiation and reliability can also be involved, and ISO/IEC 27002:2022 lists confidentiality, integrity and availability as control attribute values. A single event can affect more than one property, for example ransomware hits availability and may also hit confidentiality if data is exfiltrated.
How it shows up: Short scenarios describe an incident and ask which property was compromised.
Common confusion: Labelling unauthorized modification as a confidentiality breach.

1.5 Information security vulnerabilities, threats, and risksHow the three concepts relate.

What it means: A threat is a potential cause of an unwanted incident. A vulnerability is a weakness of an asset or control that a threat can exploit. Risk arises when a threat can exploit a vulnerability and cause consequences, judged by likelihood and impact.
What to understand: Threats can be deliberate, accidental or environmental; vulnerabilities can be technical, organizational, physical or human. Removing a vulnerability or reducing exposure lowers likelihood, while backups or insurance can reduce or share consequences. Annex A control 5.7 threat intelligence and 8.8 management of technical vulnerabilities apply these ideas directly.
How it shows up: Three options describe the same case as threat, weakness and consequence; select the one matching the question's term.
Common confusion: Calling an unpatched server a threat instead of a vulnerability.

1.6 The potential impacts that can affect confidentiality, integrity, or availability of informationConsequences of losing a security property.

What it means: Impact is what happens to the organization or interested parties when a property is lost: financial loss, regulatory penalties, legal action, operational disruption, safety effects, loss of customer trust or reputational damage.
What to understand: Impact assessment is part of risk analysis and should use the consequence scales set in the risk criteria under clause 6.1.2. Impact can be direct, such as downtime costs, or indirect, such as lost future contracts. Business impact analysis for continuity uses similar thinking with time-based effects.
How it shows up: Questions ask which consequence best describes a given loss, or which impact category a regulator's fine falls under.
Common confusion: Confusing the impact of an event with its likelihood when rating risk.

1.7 The difference between security control types such as technical, legal, administrative, and managerial controlsClassifying controls by nature.

What it means: Technical controls are implemented through technology, such as firewalls, encryption and access control systems. Administrative controls are policies, procedures and training. Managerial controls cover governance, oversight and risk decisions. Legal controls are contracts, nondisclosure agreements and legal clauses.
What to understand: The PECB course uses these type labels, while ISO/IEC 27002:2022 groups controls into organizational, people, physical and technological themes. A control can fit more than one label, and the question usually signals which classification is intended. Physical controls such as locks and guards may also appear as a separate category.
How it shows up: Expect an item listing a control, such as a confidentiality clause in an employment contract, and asking which type it is.
Common confusion: Calling a written access control policy a technical control because it concerns IT access.

1.8 The difference between security controls classified by their function such as preventive, corrective, and detective controlsClassifying controls by when they act.

What it means: Preventive controls stop an incident from occurring, such as multi-factor authentication. Detective controls identify an incident while or after it happens, such as log monitoring or intrusion detection. Corrective controls limit damage and restore normal operation, such as restoring from backup or patching after an exploit.
What to understand: ISO/IEC 27002:2022 uses preventive, detective and corrective as the control type attribute. Some frameworks add deterrent, compensating and recovery categories. A layered design combines functions so that if prevention fails, detection and correction still work. One control can have several functions.
How it shows up: Questions describe a control and ask its primary function, or which function is missing from a design.
Common confusion: Labelling a backup as preventive when its value lies in correcting after data loss.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Interested party

Person or organization that can affect, be affected by, or perceive itself affected by a decision.

Remember
Clause 4.2 asks for their relevant requirements.

Tested as
Context and compliance questions.

Trap
Listing only customers and forgetting regulators or staff.
Risk owner

Person or entity with the accountability and authority to manage a risk.

Remember
Approves the risk treatment plan and accepts residual risk.

Tested as
Terminology and treatment questions.

Trap
Assuming the IT manager owns every risk.
Threat

Potential cause of an unwanted incident.

Remember
Exploits a vulnerability; may be deliberate, accidental or environmental.

Tested as
Threat versus vulnerability items.

Trap
Naming a weakness as a threat.
Vulnerability

Weakness of an asset or control that can be exploited.

Remember
Reducing it lowers likelihood of the risk.

Tested as
Classification scenarios.

Trap
Mixing it up with the attacker.
Integrity

Property of accuracy and completeness.

Remember
Unauthorized change, even without disclosure, is an integrity failure.

Tested as
Property mapping questions.

Trap
Calling altered records a confidentiality breach.
Availability

Accessible and usable on demand by an authorized entity.

Remember
Outages, deletion and ransomware lockouts affect it.

Tested as
Incident and continuity items.

Trap
Forgetting that availability applies to authorized users only.
Detective control

Identifies an incident during or after its occurrence.

Remember
Logs, alerts and reviews are typical examples.

Tested as
Control function questions.

Trap
Thinking detection alone reduces impact.
Corrective control

Limits damage and restores after an incident.

Remember
Backups restored, systems rebuilt, patches applied post-event.

Tested as
Function classification.

Trap
Confusing it with ISMS corrective action under clause 10.2.
Legal control

Protection created through contracts and legal instruments.

Remember
NDAs and supplier security clauses are examples.

Tested as
Control type questions.

Trap
Calling them administrative because they are documents.
Harmonized structure

Common clause layout of ISO management system standards.

Remember
Clauses 4 to 10 in ISO/IEC 27001:2022.

Tested as
Navigating the open-book standard.

Trap
Looking for requirements in clauses 0 to 3.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Threat vs. vulnerability vs. risk

Concept	Meaning	Key difference	Common trap
Threat	Potential cause of an unwanted incident, such as a phishing campaign	Source of harm	Describing a missing patch as a threat
Vulnerability	Weakness that a threat can exploit, such as no email filtering	Condition inside the organization	Treating it as the outcome
Risk	Effect of uncertainty on objectives, rated by likelihood and consequence	Combines threat, weakness and impact	Rating risk on impact alone

Preventive vs. detective vs. corrective controls

Concept	Meaning	Key difference	Common trap
Preventive	Stops the event, for example blocking USB storage	Acts before the incident	Relying on it alone
Detective	Finds the event, for example SIEM alerts	Acts during or after	Expecting it to limit damage by itself
Corrective	Restores and limits damage, for example restoring from backup	Acts after the event	Labelling backups as preventive

Technical vs. administrative vs. legal controls

Concept	Meaning	Key difference	Common trap
Technical	Enforced by technology such as encryption	Works automatically	Including written IT policies
Administrative	Policies, procedures and awareness	Relies on people following rules	Confusing them with managerial oversight
Legal	Contracts, NDAs and legal clauses	Enforced through legal remedies	Grouping them with procedures

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Standard as law

What candidates pick
ISO/IEC 27001 is a legal obligation for the organization.

Why it looks right
Certification is often demanded by customers.

Why it's wrong
The standard is voluntary; it becomes binding only through a contract, a regulation or a management decision.

Clue to watch for The scenario names a customer contract or a regulator as the source.
Attacker as vulnerability

What candidates pick
The disgruntled employee is the vulnerability.

Why it looks right
The employee is the problem in the story.

Why it's wrong
The employee is a threat source; the weakness they exploit, such as excessive access rights, is the vulnerability.

Clue to watch for The question asks which element is a weakness.
Backup as prevention

What candidates pick
Classify daily backups as a preventive control.

Why it looks right
Backups are set up in advance.

Why it's wrong
Backups do not stop data loss; their value comes from restoring afterwards, which is a corrective function.

Clue to watch for Control's benefit appears only after an incident.
Any control from Annex A

What candidates pick
Implement all Annex A controls to be safe.

Why it looks right
Full coverage feels thorough.

Why it's wrong
Controls are determined by risk treatment and justified in the Statement of Applicability; unnecessary controls waste resources.

Clue to watch for The scenario mentions risk assessment results or budget limits.
Impact equals risk

What candidates pick
Rank risks by consequence only.

Why it looks right
Severe consequences look most urgent.

Why it's wrong
Risk level combines likelihood and consequence according to the organization's defined risk criteria.

Clue to watch for Options mention likelihood scales or criteria.

Answer framework

For a concept question, translate the scenario into ISO/IEC 27000 terms before reading the options.

Identify what was harmed or could be harmed, and name the security property involved: confidentiality, integrity or availability.
Separate the threat source from the weakness it exploits and from the resulting consequence, writing each one down in a few words so the three do not blur together.
Check which obligation applies by asking whether it comes from law, regulation, contract or internal policy.
If a control is described, decide when it acts and how it is enforced, then match the classification the question asks for.
Choose the option that uses the exact standard term, and reject options that are technically sensible but use the wrong concept.

Practice question

An online retailer discovers that an attacker changed bank account numbers in its supplier payment file, causing payments to go to the wrong accounts. No customer data was exposed. Which information security property was primarily compromised?

Confidentiality, because an unauthorized party accessed the payment file Availability, because suppliers did not receive their payments Integrity, because the payment data was altered without authorization Non-repudiation, because the attacker cannot be identified

Show the answer

Answer C. Integrity covers accuracy and completeness, and the core harm here is unauthorized modification of payment details. Some access occurred, but the scenario stresses that nothing was disclosed, so confidentiality is not the primary property. Late supplier payments are a consequence of the altered data rather than a loss of system availability, and non-repudiation concerns proof of actions, not the change itself.

Want more like this? The ISO 27001 LI practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with ISO/IEC 27000 clause 3 and build a glossary of about forty terms, writing each definition in your own words with one example from a familiar organization. Pay special attention to pairs that look alike: threat and vulnerability, risk owner and asset owner, conformity and effectiveness, correction and corrective action.

Next, read ISO/IEC 27001:2022 clauses 4.1, 4.2 and 6.1 together with Annex A control 5.31, and list the obligations a mid-sized company might face: privacy law, sector rules, card scheme requirements, customer contracts and its own policies. Mark which are mandatory and why.

Then practice classification. Take twenty controls, from door badges and encryption to NDAs and log reviews, and label each by type and by function. Afterwards, take ten short incident stories and name the property lost, the threat, the vulnerability and the likely impact. Because the exam is open book, tab the definitions section and the clause headings in your printed standard so you can confirm a term quickly. Finish with timed sets of fifteen questions to match this domain's share.

FAQ

How much of the exam does Domain 1, Fundamental Principles and Concepts of an Information Security Management System, cover?

The PECB handbook allots 15 of the 80 questions to this domain, which works out to 18.75% of the exam and makes it the second largest domain after planning.

Is the Lead Implementer exam still an essay exam?

No. The current PECB candidate handbook describes 80 multiple-choice questions with three options each, standalone and scenario-based, open book, with 70% needed to pass. Older guides describing 12 essay questions are outdated.

Which edition of ISO/IEC 27001 should I study?

Study ISO/IEC 27001:2022 with Amendment 1:2024. The handbook refers to the 93 Annex A controls, which exist only in the 2022 edition, and the 2013 transition period has ended.

Do I need to memorize the ISO/IEC 27000 definitions word for word?

Not word for word, since the exam is open book, but you need to recognize each term quickly. Looking up every definition during a three-hour exam is too slow.

Are control types and control functions the same thing?

No. Type describes how a control is enforced, such as technical, administrative or legal. Function describes when it acts: preventing, detecting or correcting. One control has both a type and a function.

What reference is used for these concepts besides ISO/IEC 27001?

ISO/IEC 27000 for vocabulary, ISO/IEC 27002 for control guidance and attributes, and ISO/IEC 27005 or ISO 31000 for risk concepts are useful companions, though the exam centres on ISO/IEC 27001 requirements.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

ISO 27001 LI Domain 1: Fundamental Principles and Concepts of an Information Security Management System

Overview

How it's tested

Name the property

Threat, vulnerability or risk

Classify the control

Knowledge statements 8

High-yield concepts

Interested party

Risk owner

Threat

Vulnerability

Integrity

Availability

Detective control

Corrective control

Legal control

Harmonized structure

Side by side

Threat vs. vulnerability vs. risk

Preventive vs. detective vs. corrective controls

Technical vs. administrative vs. legal controls

Exam traps

Standard as law

Attacker as vulnerability

Backup as prevention

Any control from Annex A

Impact equals risk

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cybersecurity certifications

Test your Domain 1 knowledge

Keep going