Skip to main content

ISO/IEC 27001 Information SecurityProfessionalI27K-LI

Certified ISO/IEC 27001 Lead Implementer

Demonstrates the competence to plan, implement, operate and continually improve an information security management system based on ISO/IEC 27001:2022 in any organisation.

Exam
2 h
Questions
60
Pass mark
70%
Valid for
3 years

About this certification

Holders can lead an ISMS implementation from scoping and gap analysis through risk assessment, risk treatment and the Statement of Applicability. They select and implement Annex A controls using ISO/IEC 27002:2022 guidance, establish documented information, metrics, internal audit and management review, and prepare an organisation for independent certification audit.

Who it is for: Information security managers, consultants, project managers and compliance leads responsible for ISMS implementation.

Syllabus

What you'll be assessed on — 6 modules. The percentage is each module's share of the exam.
  1. 01Initiating the ISMS15% of the exam
    • Analyse the organisation’s context, interested parties and requirements to define ISMS scope
    • Apply gap analysis to establish an implementation plan with leadership commitment
  2. 02Leadership, Policy and Objectives10% of the exam
    • Design an information security policy and measurable objectives
    • Apply roles, responsibilities and authorities for the ISMS
  3. 03Risk Assessment and Treatment25% of the exam
    • Design a risk assessment methodology consistent with ISO/IEC 27005 guidance
    • Apply risk treatment options and produce a risk treatment plan
    • Produce a Statement of Applicability justifying inclusions and exclusions
  4. 04Implementing Annex A Controls20% of the exam
    • Apply ISO/IEC 27002:2022 guidance to implement organisational, people, physical and technological controls
    • Evaluate control attributes to prioritise implementation
  5. 05Support and Operation15% of the exam
    • Design documented information, competence and awareness arrangements
    • Apply operational planning and change control within the ISMS
  6. 06Performance Evaluation and Improvement15% of the exam
    • Design monitoring and measurement of ISMS effectiveness
    • Apply internal audit, management review and corrective action processes

Competencies assessed

  • ISMS Planning — Scopes and plans an ISMS aligned to organisational context.
  • Risk Management — Designs and operates information security risk assessment and treatment.
  • Control Implementation — Implements Annex A controls proportionate to risk.
  • Documentation — Establishes controlled documented information.
  • Performance Evaluation — Measures and reviews ISMS effectiveness.
  • Continual Improvement — Drives corrective action and continual improvement.

Exam blueprint

Closed-book, timed examination with single-choice, multiple-response and scenario-based questions.
Questions per module60 questions · 2 h · pass 70%
  • Initiating the ISMS9
  • Leadership, Policy and Objectives6
  • Risk Assessment and Treatment15
  • Implementing Annex A Controls12
  • Support and Operation9
  • Performance Evaluation and Improvement9
Question types
Scenario-based 20% · Single choice 60% · Multiple response 20%
Delivery
Online (remote proctored), Test centre, On-site (corporate)
Retakes
Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

Your path to certification

  1. 1

    Register

    Create a free account and start the programme.

  2. 2

    Practice

    Online practice test, 8 questions.

  3. 3

    Training

    Optional

    Online course or classroom — or skip it.

  4. 4

    Certification

    Independent exam and certification decision.

  • Practice test8 questions · 20 min · 70% to pass · free with the programme
  • ISO/IEC 27001 Lead Implementer — online course28 h self-paced€699
  • ISO/IEC 27001 Lead Implementer — classroom courseLumen Cyber Institute (Demo), Dublin · 21 hDemo organisation€895
    • 27 Nov 2026 – 29 Nov 2026 · Lumen Cyber Institute (Demo), Dublin
    • 25 Dec 2026 – 27 Dec 2026 · Lumen Cyber Institute (Demo), Dublin

Training is optional and does not by itself confer certification. Find a training partner

Eligibility & prerequisites

Required

  • Minimum 3 years' professional experience, including at least 2 years in information security
  • Experience contributing to management system implementation activities
  • Agreement to abide by the AQSCERT Code of Professional Conduct

Recommended

  • I27K-F or equivalent knowledge
  • Experience in information security, IT or risk management

More information

Certification process
  1. 1. Application — Create an account and apply for this certification.
  2. 2. Eligibility review — AQSCERT checks the formal eligibility requirements.
  3. 3. Assessment — Sit the 2 h examination online or at a test centre.
  4. 4. Independent decision — A decision maker not involved in your training or assessment reviews all evidence.
  5. 5. Issuance — A digitally signed certificate with QR verification, valid for 3 years.
  6. 6. Recertification — Before expiry, evidence 60 hours of CPD or re-sit the examination.
  7. Certificates may be suspended, withdrawn or revoked in line with the Certification Scheme. Status is always shown on the public verification page.
Scheme & accreditation
Certification scheme
Information & Technology Certification Scheme
Scheme code
AQS-SCH-25
Scheme version
v1.0 (effective 1 Jan 2026)

Accreditation: AQSCERT is accredited by DA, an IAF MLA signatory, to ISO/IEC 17024. Our programmes are developed by leading experts from industry.

Ready to start I27K-LI?

Practise online, add optional training, then sit the independent exam.

Related ISO/IEC 27001 Information Security certifications

  • Foundation

    I27K-F

    Certified ISO/IEC 27001 Foundation

    Validates foundational knowledge of information security management systems based on ISO/IEC 27001:2022, including its requirements, risk-based approach and Annex A control themes.

    Exam duration
    1 h
    Questions
    40 questions

    Exam fee from

    €225

  • Professional

    I27K-LA

    Certified ISO/IEC 27001 Lead Auditor

    Demonstrates the competence to plan, lead and report audits of information security management systems against ISO/IEC 27001:2022 using ISO 19011 audit guidance.

    Exam duration
    2 h
    Questions
    60 questions

    Exam fee from

    €460

Certified ISO/IEC 27001 Lead Implementer (I27K-LI) · AQSCERT