PECB ISO 28000 LI study guide
PECB ISO 28000 LI · Work through your exam, one topic at a time.
The PECB Certified ISO 28000 Lead Implementer credential is a professional certification for people who establish, implement, maintain, and continually improve a security management system (SeMS) based on ISO 28000. The associated five-day training course is aimed at individuals responsible for maintaining and improving the security environment in which organizations operate, professionals seeking in-depth knowledge of ISO 28000 requirements, those responsible for maintaining conformity to those requirements, expert advisors mastering SeMS implementation, members of an SeMS implementation team, people pursuing a career in security management, security management consultants, and management representatives mastering the SeMS implementation process. The PECB ISO 28000 LI study guide has 7 sections and about 2,259 words.
01Fundamental principles and concepts of an SeMS
Domain 1 tests whether you can describe a security management system (SeMS) as a management system for supply-chain security, not as a guard-force contract. ISO 28000:2022 is the requirements standard; it follows the harmonized structure in clauses 4–10 and the Plan–Do–Check–Act cycle.
353 words, about 2 min02Initiation of an SeMS implementation
Initiation is the pre-project phase: obtaining mandate, defining the SeMS boundary and building the implementation case. ISO 28000 clause 4 (context, interested parties, scope) and clause 5 (leadership) are central.
305 words, about 2 min03Planning of an SeMS implementation based on ISO 28000
Planning covers ISO 28000 clause 6: actions to address risks and opportunities, and security objectives. The exam tests whether you can move from context and baseline to a defensible risk treatment plan and measurable objectives, rather than a list of wished-for controls.
332 words, about 2 min04Implementation of an SeMS based on ISO 28000
Implementation puts clause 7 support and clause 8 operation into practice. The exam tests whether you can turn plans into controlled processes, competent people, controlled information and evidence that the SeMS operates, not just exists.
304 words, about 2 min05Evaluation of the performance of an SeMS based on ISO 28000
Evaluation covers ISO 28000 clause 9: monitoring, measurement, analysis and evaluation; internal audit; and management review. The exam tests whether you can show the SeMS is performing and whether its results feed decisions.
311 words, about 2 min06Continual improvement of an SeMS based on ISO 28000
Continual improvement covers ISO 28000 clause 10: improvement and nonconformity/corrective action. The exam tests whether you can distinguish correction from corrective action and whether improvement is driven by data, incidents and risk changes.
311 words, about 2 min07Preparation for an SeMS certification audit
This domain tests the certification process and readiness, not new SeMS requirements. Know the roles of the certification body, the client and the auditor; the difference between Stage 1 and Stage 2; and how nonconformities are handled.
343 words, about 2 min