This five-day course teaches you to design, deploy and improve an information security incident management process based on the ISO/IEC 27035 series. You work through the whole cycle, from preparing the response team to lessons learned, drawing on good practice from other standards as well. The Lead Incident Manager exam takes place on the final day.
The essentials
Publisher : PECB
Certification : PECB Certified ISO/IEC 27035 Lead Incident Manager
Duration : 5 days, exam included on day 5 (31 CPD credits)
Level : Advanced
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : 80 multiple-choice questions · 3 h · open book · 70% to pass
Exam voucher : Official PECB offer: exam and certification fees are included, plus one free exam retake within 12 months if you do not pass the first time.
Explain the fundamental principles of security incident management.
Develop an incident management plan tailored to the organization.
Set up and organize an incident response team.
Assess risks to identify threats and vulnerabilities.
Detect, report and assess incidents, then contain, eradicate and recover.
Carry out post-incident analysis and turn it into improvements.
Program
Day 1 – Concepts and ISO/IEC 27035
Standards and reference frameworks
Fundamental concepts
Organizational context
Incident management policies
Day 2 – Designing and preparing the plan
Risk management
Incident management plan
Team structure and relationships
Awareness and training
Day 3 – Detection and reporting
Testing the capability
System monitoring
Detection and reporting
Event assessment
Day 4 – Responding and improving
Incident resolution
Containment, eradication and recovery
Lessons learned
Monitoring and continual improvement
Day 5 – Certification exam
Three-hour PECB exam
Prerequisites
General knowledge of incident management processes, information security principles and the ISO/IEC 27000 family, as PECB requires.
Target audience
Information security managers and consultants
Professionals setting up an incident response team
IT professionals and risk managers
Incident response team members and coordinators
The exam
The three-hour exam takes place on day five, online with remote proctoring via the PECB Exams app or on paper through a partner. According to the 2026 candidate handbook it has 80 multiple-choice questions over six domains, dominated by preparing the response plan (22 questions) and implementing the processes (23). It is open book and you need 70%. Depending on your experience, you then hold Provisional Incident Manager, Incident Manager, Lead Incident Manager (five years including two in incident management, 300 hours) or Senior Lead Incident Manager. Certification is valid for three years, with CPD and an annual fee.
Preparation tips
Over half the questions concern the response plan and putting it into practice: know every phase and its outputs.
Practise classifying what you see: event, incident or major incident.
Index your course materials by lifecycle phase to handle scenario questions faster.
Frequently asked questions (FAQ)
Can an organization be certified against ISO 27035?
No, it is a guidance standard. The Lead Incident Manager certification is for individuals and attests to their competence.
Is the course technical?
It focuses on organizing and steering the response, not on forensics or tooling. Technical profiles gain the governance framework they often lack.
How does it relate to ISO 27001?
ISO/IEC 27035 details the incident management that the ISO/IEC 27001 and 27002 controls ask you to put in place.
What title do I get without experience?
Provisional Incident Manager. Higher levels require documented professional experience and hours of incident management activity; Lead Incident Manager, for example, asks for five years and 300 hours.
Can I take the course online or in Casablanca?
Both. We run it as a live online class, in person in Casablanca, or on-site at your organization, taught in French or English depending on the group. For on-site sessions we can adapt examples and case studies to your sector and schedule the exam with you.