ISO 27035 LIM

The certification exam is multiple choice. The course itself uses essay-type exercises and multiple-choice quizzes, some scenario-based, and the quiz format closely mirrors the exam so you can practise in the same style. For exam type, available languages, and other administrative details, PECB directs candidates to its List of PECB Exams and Examination Rules and Policies.

The course is delivered over five days. Days one to four cover concepts and ISO/IEC 27035, designing and preparing the incident management plan, detecting and reporting incidents, and monitoring and continual improvement. Day five is the certification exam. Materials run to over 450 pages with practical examples, exercises, and quizzes.

The source states that certification and examination fees are included in the price of the training course. It does not publish a specific course or exam price, so check with your training provider for current pricing in your region and delivery mode, since sessions are offered in classroom and live virtual formats in several languages.

Yes, under a specific condition. Candidates who have completed the training course but failed the exam are eligible to retake the exam once for free within 12 months from the initial date of the exam. The free retake is therefore tied to course attendance, so keep your attestation of course completion.

Four credentials use the same exam. Provisional Incident Manager requires no experience. Incident Manager requires two years, including one year of ISIM work and 200 hours of ISIM activities. Lead Incident Manager requires five years, including two years of ISIM work and 300 hours. Senior Lead Incident Manager requires ten years, including seven years of ISIM work and 1,000 hours. All require signing the PECB Code of Ethics.

The main requirement for participating is general knowledge of incident management processes, information security principles, and the ISO/IEC 27000 family of standards. The course aligns with ISO/IEC 27001, ISO/IEC 27005, and other standards in that series, so familiarity with their vocabulary and structure will make the exercises and scenario questions easier to follow.

For credentials requiring project experience, the incident management project should follow best implementation practices and include defining an incident management approach, determining objectives and scope, performing risk assessment, developing an incident management program, defining risk evaluation and risk acceptance criteria, evaluating risk treatment options, and monitoring and reviewing the program.

Follow the course sequence: fundamentals and ISO/IEC 27035 concepts first, then designing and preparing the incident management plan, then detection and reporting, then monitoring and continual improvement. Work the scenario-based quizzes after each block, because they mirror the exam style and expose gaps in applying the lifecycle rather than just recalling definitions.

Candidates often memorise definitions without being able to apply the lifecycle to a scenario, confuse planning and preparation activities with detection and reporting, or overlook post-incident lessons learned and continual improvement. Others underestimate stakeholder roles and coordination with other organizations. Practising scenario quizzes and knowing the six domains helps avoid these traps.

An attestation of course completion worth 31 CPD (Continuing Professional Development) credits is issued to participants who have attended the training course. The attestation also evidences course completion, which matters if you later need the free retake, since that benefit applies to candidates who completed the training course.