ISO/IEC 27035 Lead Incident Manager

ISO/IEC 27035 Lead Incident Manager training enables you to acquire the necessary expertise to support an organization in implementing an Information Security Incident Management plan based on ISO/IEC 27035. During this training course, you will gain a comprehensive knowledge of a process model for designing and developing an organizational incident management plan. The compatibility of this training course with ISO/IEC 27035 also supports the ISO/IEC 27001 by providing guidance for Information Security Incident Management.

Course description:

After mastering all the necessary concepts of Information Security Incident Management, you can sit for the exam and apply for a “PECB Certified ISO/IEC 27035 Lead Incident Manager” credential. By holding a PECB Lead Incident Manager Certificate, you will be able to demonstrate that you have the practical knowledge and professional capabilities to support and lead a team in managing Information Security Incidents.

Course objectives:

  • Master the concepts, approaches, methods, tools and techniques that enable an effective Information Security Incident Management according to ISO/IEC 27035
  • Acknowledge the correlation between ISO/IEC 27035 and other standards and regulatory frameworks
  • Acquire the expertise to support an organization to effectively implement, manage and maintain an Information Security Incident Response plan
  • Acquire the competence to effectively advise organizations on the best practices of Information Security Incident Management
  • Understand the importance of establishing well-structured procedures and policies for Incident Management processes
  • Develop the expertise to manage an effective Incident Response Team

Audience:

  • Information Security Incident managers
  • IT Managers
  • IT Auditors
  • Managers seeking to establish an Incident Response Team (IRT)
  • Managers seeking to learn more about operating effective IRTs
  • Information Security risk managers
  • IT system administration professionals
  • IT network administration professionals
  • Members of Incident Response Teams
  • Individuals responsible for Information Security within an organization

Prerequisites:

A fundamental understanding of ISO/IEC 27035 and comprehensive knowledge of Information Security.
 

Certification

After successfully completing the exam, you can apply for the credentials shown on the table below. You will receive a certificate once you comply with all the requirements related to the selected credential. For more information about ISO/IEC 27001 certifications and the PECB certification process, please refer to the Certification Rules and Policies.

 

Course outline:

Introduction to Information Security Incident Management concepts as recommended by ISO/IEC 27035

  1. Course objectives and structure
  2. Standards and regulatory frameworks
  3. Information Security Incident Management
  4. ISO/IEC 27035 core processes
  5. Fundamental principles of Information Security
  6. Linkage to business continuity
  7. Legal and ethical issues

 

 

Designing and preparing an Information Security Incident Management plan

  1. Initiating an Information Security IncidentManagement Process
  2. Understanding the organization and clarifying the information security incident management objectives
  3. Plan and prepare
  4. Roles and functions
  5. Policies and procedures

Roles and functions
Policies and procedures

Enacting the Incident Management process and handling Information Security incidents

  1. Communication planning
  2. First implementation steps
  3. Implementation of support items
  4. Detecting and reporting
  5. Assessment and decisions
  6. Responses
  7. Lessons learned
  8. Transition to operations

Monitoring and continual improvement of the Information Security Incident Management plan

  1. Further analysis
  2. Analysis of lessons learned
  3. Corrective actions
  4. Competence and evaluation of incident managers

Certification Exam

  1. Preparation for exam
  2. Exam

The exam is will take place at the end of the course on onsite classroom courses

For Virtual courses we will send out a voucher that gives you access to an online exam. This can be booked and taken home monitored by a proctor via camera. More information about the exam rules will be send fromPECB.

Test details:

  • The exam duration is three (3) hours. Non-native speakers receive an additional half an hour.
  • The exam contains essay type questions. 


As the exam is an Multiple Choice, candidates are authorized to use:

  • A copy of the ISO 27035 Standard
  • Course notes from the Participant Handout;
  • Any personal notes made by the student during the course; and
  • A hard copy dictionary

Examination rules and policies

RECEIVE YOUR EXAM RESULTS

Results will be communicated by email in a period of 6 to 8 weeks, after taking the exam. The results will not include the exact grade of the candidate, only a mention of pass or fail.

Candidates who successfully complete the examination will be able to apply for a certified scheme which is explained in the course description.

In the case of a failure, the results will be accompanied with the list of domains in which the candidate had failed to provide guidance for exams’ retake preparation.

Candidates, who disagree with the exam results, may file a complaint by writing to examination@pecb.com or through PECB ticketing system.

EXAM RETAKE POLICY

There is no limit on the number of times a candidate may retake an exam. However, there are some limitations in terms of allowed time-frame in between exam retakes, such as:

  • Students, who have completed the full training but failed the written exam, are eligible to retake the exam once for free within a 12 month period from the initial date of the exam.
  • If a candidate does not pass the exam on the second attempt, he/she must wait 3 months (from the initial date of the exam) for the next attempt (2nd retake). Retake fee applies.
  • If a candidate does not pass the exam on the third attempt, he/she must wait 6 months (from the initial date of the exam) for the next attempt (3rd retake). Retake fee applies.

After the fourth attempt, a waiting period of 12 months from the last session date is required, in order for candidate to sit again for the same exam. Regular fee applies.

For the candidates that fail the exam in the 2nd retake, PECB recommends to attend an official training in order to be better prepared for the exam.

To arrange exam retakes (date, time, place, costs), the candidate needs to contact Glasspaper.

Introduction to Information Security Incident Management concepts as recommended by ISO/IEC 27035

  1. Course objectives and structure
  2. Standards and regulatory frameworks
  3. Information Security Incident Management
  4. ISO/IEC 27035 core processes
  5. Fundamental principles of Information Security
  6. Linkage to business continuity
  7. Legal and ethical issues

 

 

Designing and preparing an Information Security Incident Management plan

  1. Initiating an Information Security IncidentManagement Process
  2. Understanding the organization and clarifying the information security incident management objectives
  3. Plan and prepare
  4. Roles and functions
  5. Policies and procedures

Roles and functions
Policies and procedures

Enacting the Incident Management process and handling Information Security incidents

  1. Communication planning
  2. First implementation steps
  3. Implementation of support items
  4. Detecting and reporting
  5. Assessment and decisions
  6. Responses
  7. Lessons learned
  8. Transition to operations

Monitoring and continual improvement of the Information Security Incident Management plan

  1. Further analysis
  2. Analysis of lessons learned
  3. Corrective actions
  4. Competence and evaluation of incident managers

Certification Exam

  1. Preparation for exam
  2. Exam

The exam is will take place at the end of the course on onsite classroom courses

For Virtual courses we will send out a voucher that gives you access to an online exam. This can be booked and taken home monitored by a proctor via camera. More information about the exam rules will be send fromPECB.

Test details:

  • The exam duration is three (3) hours. Non-native speakers receive an additional half an hour.
  • The exam contains essay type questions. 


As the exam is an Multiple Choice, candidates are authorized to use:

  • A copy of the ISO 27035 Standard
  • Course notes from the Participant Handout;
  • Any personal notes made by the student during the course; and
  • A hard copy dictionary

Examination rules and policies

RECEIVE YOUR EXAM RESULTS

Results will be communicated by email in a period of 6 to 8 weeks, after taking the exam. The results will not include the exact grade of the candidate, only a mention of pass or fail.

Candidates who successfully complete the examination will be able to apply for a certified scheme which is explained in the course description.

In the case of a failure, the results will be accompanied with the list of domains in which the candidate had failed to provide guidance for exams’ retake preparation.

Candidates, who disagree with the exam results, may file a complaint by writing to examination@pecb.com or through PECB ticketing system.

EXAM RETAKE POLICY

There is no limit on the number of times a candidate may retake an exam. However, there are some limitations in terms of allowed time-frame in between exam retakes, such as:

  • Students, who have completed the full training but failed the written exam, are eligible to retake the exam once for free within a 12 month period from the initial date of the exam.
  • If a candidate does not pass the exam on the second attempt, he/she must wait 3 months (from the initial date of the exam) for the next attempt (2nd retake). Retake fee applies.
  • If a candidate does not pass the exam on the third attempt, he/she must wait 6 months (from the initial date of the exam) for the next attempt (3rd retake). Retake fee applies.

After the fourth attempt, a waiting period of 12 months from the last session date is required, in order for candidate to sit again for the same exam. Regular fee applies.

For the candidates that fail the exam in the 2nd retake, PECB recommends to attend an official training in order to be better prepared for the exam.

To arrange exam retakes (date, time, place, costs), the candidate needs to contact Glasspaper.

Other relevant courses

PECB Certified Lead Cybersecurity Manager
5. May
5 days
Classroom Virtual
ISO/IEC 27001 Lead Implementer
27. January
5 days
Classroom Virtual Guaranteed to run
ISO/IEC 27005 Lead Risk Manager
5 days
Classroom Virtual
ISO/IEC 27001 Lead Auditor
27. January
5 days
Classroom Virtual