PECB ISO 18788 Lead Auditor study guide
PECB ISO 18788 Lead Auditor · Work through your exam, one topic at a time.
The PECB Certified ISO 18788 Lead Auditor credential is aimed at professionals who audit Security Operations Management Systems (SOMS) against ISO 18788. PECB positions the training for auditors who want to perform and lead SOMS certification audits, for managers and consultants who need to master the audit process, for staff responsible for maintaining conformance with SOMS requirements, for technical experts preparing to take part in a SOMS audit, and for expert advisors in security operations management. The PECB ISO 18788 Lead Auditor study guide has 7 sections and about 2,458 words.
01Fundamental principles and concepts of a Security Operations Management System (SOMS)
The exam tests whether you can explain what a Security Operations Management System is, the principles it rests on, and how those principles appear in audit evidence rather than in slogans. A SOMS is the set of interrelated policies, processes, resources and responsibilities used to direct and control security operations.
385 words, about 2 min02Security Operations Management Systems (SOMS)
This domain tests clause-by-clause understanding of ISO 18788:2015 and how requirements interlock. You must know what each clause demands, what evidence is expected, and where auditors commonly misread the standard.
372 words, about 2 min03Fundamental audit concepts and principles
The exam tests ISO 19011:2018 audit principles and vocabulary, and whether you can distinguish an audit from an inspection, a finding, a conclusion and a certification decision. An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria to determine the extent to which criteria are fulfilled.
367 words, about 2 min04Preparation of an ISO 18788 audit
This domain tests how to prepare a risk-based ISO 18788 audit: objectives, scope, criteria, document review, audit plan, sampling and logistics, including stage 1 for certification. Preparation starts with the audit objectives, scope and criteria, agreed with the client and auditee.
343 words, about 2 min05Conducting an ISO 18788 audit
The exam tests fieldwork: opening meeting, interviews, observation, sampling, evidence recording, finding writing and the closing meeting. The opening meeting confirms objectives, scope, criteria, plan, communication, confidentiality, safety rules and site access.
327 words, about 2 min06Closing an ISO 18788 audit
This domain tests what happens after fieldwork: the audit report, nonconformity grading, corrective-action follow-up, record retention and the boundary between auditor and certification decision. The audit report should state objectives, scope, criteria, dates, team, sites sampled, findings, conclusions and any limitations.
341 words, about 2 min07Managing an ISO 18788 audit programme
This domain tests the audit programme: how audits are planned, resourced, sequenced and improved over time, rather than how one audit is run. An audit programme is a set of planned audits and related activities for a defined period, with objectives, extent, frequency, methods, resources and competent auditors.
323 words, about 2 min