Skip to main content
Contact Us

ISO 27001 Lead Implementer career guide

How to Become an ISO 27001 Lead Implementer in Australia (2026 Guide)

Becoming a PECB Certified ISO/IEC 27001 Lead Implementer takes an open-book exam (you may use a hard copy of the standard, the course materials and your notes from the course) and an application to PECB (the Professional Evaluation and Certification Board), with a course the usual first step. No experience is needed to sit the exam; the credential level you apply for afterwards depends on your experience. Through a PECB partner course there is no separate exam or application fee: the course is A$699 + GST (A$768.90 inc. GST), with the exam voucher, two exam attempts and the certification fee included.

Last reviewed 26 October 2026 by Clinton McKillop, PECB Certified Trainer

Mindset Cyber is a PECB Authorised Titanium Partner, PECB's highest partner level.

What does an ISO 27001 Lead Implementer do?

An ISO 27001 Lead Implementer (sometimes spelt implementor) plans, designs, deploys and manages an information security management system, or ISMS. An ISMS is the set of policies, risk processes, controls and records an organisation uses to protect its information, built to ISO/IEC 27001:2022, the current edition of the standard. PECB's definition: a Lead Implementer designs, implements and maintains an ISMS within an organisation, on staff or as a consultant. The Lead Implementer owns the Statement of Applicability (which controls apply and why) and the risk treatment plan (what will be done about each risk). They also deal with the certification body, the independent auditor that issues ISO 27001 certificates, at the two-stage certification audit: Stage 1 reviews the documentation, Stage 2 checks that the controls work. Organisations are certified against ISO 27001 by a certification body; people hold a PECB credential.

How do you implement ISO 27001?

Scope first: which business units, systems, cloud services and suppliers the ISMS covers, and which customers and regulators it must satisfy. Then the information security policy, agreed with management, and who owns what. Then the risk assessment: a repeatable method, criteria for what is acceptable, a risk register and a treatment plan saying which risks get controls, which are accepted and who signs off.

From the treatment plan comes the Statement of Applicability. It lists each control in Annex A of ISO/IEC 27001:2022, says whether it applies and why, and whether it is implemented; in practice it is the first document a certification auditor asks for.

Then implementation: access control, supplier security, logging, backup, incident response and awareness training. In Australia many of these controls already appear in the Essential Eight or the ISM. The Essential Eight is the Australian Signals Directorate's (ASD's) set of the eight most effective mitigation strategies from its Strategies to Mitigate Cyber Security Incidents; the ISM is ASD's Information Security Manual, a cyber security framework any organisation can use and the one non-corporate Commonwealth entities must apply. Part of the job is mapping what the organisation must do anyway into the ISMS rather than building it twice.

Then measurement: metrics, an internal audit by someone independent of the work audited, and a management review. With enough evidence, you take the organisation to a certification body for Stage 1 (documentation) and Stage 2 (do the controls work). After that come yearly surveillance audits and recertification in year three; our ISO 27001 certification in Australia guide covers that cycle. Then the job is keeping the risk register and Statement of Applicability current as the business changes.

What is the difference between ISO 27001 lead auditor and lead implementer?

A Lead Implementer builds and runs the ISMS; a Lead Auditor assesses it. PECB says Lead Auditors often work for certification bodies or as external auditors, and Lead Implementers within an organisation or as consultants. Both exams are 80 questions, 3 hours and open book, and one person may hold both credentials. See ISO 27001 Lead Auditor vs Lead Implementer and our Lead Auditor guide.

ISO 27001 Lead Implementer prerequisites: what you need before starting

What PECB asks for

PECB's main requirement for the course is a general knowledge of ISMS concepts and ISO/IEC 27001. There is no degree requirement and no minimum experience to enrol or sit the exam; our course page recommends Foundation first but does not require it.

Do you need experience to sit the exam?

No. The experience rules apply when you apply for a credential, not before. One exam serves four levels, from Provisional Implementer with no experience to Senior Lead Implementer; the table below gives the years and project hours for each.

Optional first step: ISO 27001 Foundation

If management-system standards are new to you, start with the PECB ISO 27001 Foundation eLearning, A$279 + GST (A$306.90 inc. GST). It covers the vocabulary, the structure of the standard and the control themes in about 14 hours.

The 5-step certification process

  1. Complete ISO 27001 Foundation training (optional)

    Take the PECB ISO 27001 Foundation course, A$279 + GST (A$306.90 inc. GST), if ISMS terms, risk assessment and Annex A are new to you; otherwise skip it.

  2. Enrol in the PECB ISO 27001 Lead Implementer eLearning

    Mindset Cyber delivers PECB's own ISO 27001 Lead Implementer course on myPECB at A$699 + GST (A$768.90 inc. GST): 27 sections, over 450 pages of course material, video lessons, quizzes and editable course files. The price includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance and 12 months of access; completion earns 31 CPD credits.

  3. Pass the PECB ISO/IEC 27001 Lead Implementer exam

    The exam is 80 multiple-choice questions, 3 hours, open book, 70% to pass, sat online in the PECB Exams app, in one of PECB's scheduled online exam sessions that you pick in myPECB (the full format is below). A second attempt is included within 12 months of purchase. Mindset Prep is our optional practice-question app.

  4. Apply to PECB for the credential your experience supports

    Passing the exam does not certify you. In myPECB choose Apply for Certification, pick the level your experience supports, log your ISMS project hours and name two professional references. They must be people who worked with you, not subordinates or relatives, and PECB contacts them. The certification fee is already paid. PECB's candidate handbook gives you 12 months from purchase to apply; PECB emails the decision.

  5. Keep the credential current, and upgrade as your hours grow

    PECB certifications are valid for three years. They renew when you report your CPD in myPECB (90 hours per three-year cycle for a Lead Implementer), pay the Annual Maintenance Fee and keep to the PECB Code of Ethics. PECB's Certification Maintenance Policy lists that fee at US$390 per certificate for each three-year cycle, paid year by year in myPECB; the first year is in the course price. Foundation, Provisional and Transition credentials pay no fee (Transition is PECB's credential on what changed between two editions of a standard, such as ISO/IEC 27001:2013 and ISO/IEC 27001:2022). Miss the CPD or the fee and the credential is suspended for up to 12 months while you catch up; if they are still outstanding after that, PECB can revoke it. An upgrade is a new application (US$100; PECB decides whether another exam is needed).

PECB's four Implementer credentials: Provisional to Senior Lead

PECB Certified ISO/IEC 27001 credential Professional experience ISMS project activities
Provisional ImplementerNoneNone
ImplementerTwo years, one of them in information security management200 hours
Lead ImplementerFive years, two of them in information security management300 hours
Senior Lead ImplementerTen years, seven of them in information security management1,000 hours

All four sit the same Lead Implementer exam and sign the PECB Code of Ethics.

PECB's candidate handbook says valid implementation activities include:

  • drafting ISMS implementation plans
  • initiating ISMS implementation projects
  • establishing policies, processes and procedures
  • setting objectives at relevant levels
  • implementing the ISMS
  • managing, monitoring and maintaining the ISMS
  • identifying and acting on continual improvement opportunities.

Keep a dated project log from day one; PECB checks it against the required hours.

The PECB ISO 27001 Lead Implementer exam

Is ISO 27001 lead implementer hard?

Is the ISO 27001 exam difficult? It is a professional exam, not a memory test: 80 multiple-choice questions in 3 hours, each with three options, mixing stand-alone questions with scenario sets of five. Of the 80, 43 measure comprehension, application and analysis, and 37 measure evaluation. PECB places the evaluation questions in three domains: planning an ISMS implementation (18), implementing an ISMS (14) and preparing for the certification audit (5). It is open book. In the online exam you may use a hard copy of ISO/IEC 27001 (or a copy bought through the myPECB store, which opens inside the PECB Exams app), the PECB course materials and your personal notes from the course, either in the app or printed, and a hard-copy dictionary. The pass mark is 70%; PECB publishes no pass rate and neither do we.

What the exam covers: the seven domains

The handbook splits the 80 questions across seven domains (topic areas):

  1. Fundamental principles and concepts of an ISMS: 15 questions.
  2. Information security management system requirements: 12.
  3. Planning an ISMS implementation: 18.
  4. Implementing an ISMS: 14.
  5. Monitoring and measurement: 10.
  6. Continual improvement: 6.
  7. Preparing for an ISMS certification audit: 5.

Sitting the exam online from Australia

Online exams run in the PECB Exams application, supervised remotely by a PECB Invigilator through the app and your camera: you need valid ID, cannot use phones, tablets or other secondary devices, and must be present at least 30 minutes before the start. Results for online multiple-choice exams are given as soon as you finish and sent by email. A second attempt is included within 12 months of purchase, with no limit on retakes after that (retake fees apply; PECB's exam rules give no amount). A failed first attempt cannot be re-sat until 15 days after the exam date, so sit the first attempt at least a month before your 12 months end.

How long does it take to become ISO 27001 certified?

For a person, there are three parts. An organisation's certificate is a separate, longer project: see our ISO 27001 certification in Australia guide.

The course: 30 to 40 hours over two to four weeks

PECB structures the course as five days with the exam on day five. The eLearning is self-paced; our estimate (not a PECB figure) is 30 to 40 hours over two to four weeks, and you book the exam within your 12 months of access.

Provisional Implementer: apply once your pass is recorded

You can apply for Provisional Implementer as soon as your pass shows in myPECB. PECB's system sends your two references an online questionnaire, the Certification Department checks the application, and PECB emails the outcome.

Lead Implementer: when the experience is met

The full title waits for five years of professional experience, two of them in information security management, and 300 logged hours of ISMS project activities. Without the years, hold a lower level and upgrade later.

Common roadblocks

  • No project log, so the hours cannot be proven.
  • References who are subordinates or relatives, or who are slow to answer.
  • Missing the handbook's 12-month window from purchase; after that, PECB reopens an application only on a written request, for a fee.

How much does ISO 27001 Lead Implementer certification cost in Australia?

Most of this list is optional. The course price covers the exam and the certification application; the one later cost is PECB's maintenance fee from year two.

  • PECB ISO 27001 Lead Implementer eLearning: A$699 + GST (A$768.90 inc. GST), including the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance and 12 months of access.
  • PECB certification application: included (US$500 if you apply without a partner course).
  • PECB maintenance fee: US$390 per certificate for each three-year cycle, as PECB's Certification Maintenance Policy lists it, paid year by year in myPECB; the first year is in the course price; none for Provisional Implementer, Foundation or Transition.
  • Optional ISO 27001 Foundation: A$279 + GST (A$306.90 inc. GST).
  • Optional exam practice: Mindset Prep, A$99 + GST (A$108.90 inc. GST) for a year when added at the course checkout.
  • Live online weekend: register interest only, at its planned price of A$1,999 + GST (A$2,198.90 inc. GST).
  • The standard: not included. The open-book exam allows a hard copy of ISO/IEC 27001, or a copy bought through the myPECB store, which opens in the PECB Exams app; iso.org and Standards Australia also sell it.

Australian prices attract 10% GST, shown before checkout.

How much is the ISO 27001 lead implementer exam?

Nothing extra through a PECB partner course: PECB's exam rules say the training fee includes the first exam attempt, a second attempt, the certification application fee and the first year of the Annual Maintenance Fee. Without a course, PECB's 2026 handbook prices a Lead exam at US$1,000 and the application at US$500.

How much does it cost to get ISO 27001 certified in Australia?

For an organisation this is a different spend: a certification body's audit fees plus the implementation work, broken down in our ISO 27001 certification cost guide. For an individual, the costs are the ones listed above.

Lead Implementer course price by country

The course, exam and inclusions are the same in every market; only the currency and tax line change.

  • United States: US$485
  • Australia: A$699 + GST (A$768.90 including GST)
  • United Kingdom: £367 + VAT (£440.40 including VAT)
  • Eurozone: €427
  • New Zealand: NZ$863
  • Canada: CA$686
  • India: ₹46,599

Prices for every PECB course we sell are on our PECB course prices page.

PECB eLearning or PECB Self-Study: what each format includes

Two of PECB's delivery formats are self-paced. PECB eLearning is delivered by PECB Certified Trainers in pre-recorded video format, with quizzes and the official course materials on myPECB. PECB Self-Study gives access to the official PECB course materials to study at your own pace; PECB lists the pre-recorded video lessons under eLearning only. PECB describes Self-Study as "suitable for participants with considerable knowledge of the subject who do not require assisted lecturing" (taught lessons). PECB's CPD Policy (June 2026) credits a five-day training course or eLearning with 31 CPD credits and Self-Study of the same five-day course with 16. Mindset Cyber sells this course as PECB eLearning.

ISO 27001 Lead Implementer jobs and career paths

Four roles follow the credential:

  • Information Security Manager: owns the ISMS after certification, its risk register, control owners and surveillance audits.
  • GRC consultant (governance, risk and compliance): takes client organisations through implementation and certification, a direct route to the 300 project hours.
  • ISMS project lead: runs one implementation through to the Stage 2 audit.
  • Security architect: designs the technical controls the Statement of Applicability calls for.

We do not publish salary figures. Check current listings for your city and industry.

Lead Implementer and Lead Auditor combined

Holding both lets you move between building an ISMS and assessing one; the audit side is in our Lead Auditor guide.

Who hires ISO 27001 Lead Implementers in Australia, and why

Organisations building their first ISMS, organisations that hold a certificate and need someone to run it, and consultancies doing the work for clients. In Australia the role works alongside five frameworks and laws:

  • Essential Eight. ASD's eight mitigation strategies, graded at maturity levels Zero to Three. Under Policy 14, Cyber Security Strategies, of the Protective Security Policy Framework (PSPF Release 2026; Policy 10 before November 2024), non-corporate Commonwealth entities have been required to implement all eight strategies to Maturity Level Two since 1 July 2022. It is a set of technical mitigation strategies, while ISO/IEC 27001 sets the requirements for an information security management system. For those entities, the PSPF says ISO/IEC 27001 is useful as a resource but not an alternative pathway for authorising their systems to operate.
  • The ISM. ASD's Information Security Manual is a cyber security framework any organisation can use, and the one non-corporate Commonwealth entities must apply under the PSPF. Its risk management framework draws on the US NIST SP 800-37, not ISO 27001, so where a contract calls for both, the implementer maps one to the other.
  • APRA CPS 234. Prudential Standard CPS 234 Information Security, from the Australian Prudential Regulation Authority (APRA), has applied since 1 July 2019 to all APRA-regulated entities: banks and other authorised deposit-taking institutions, general, life and private health insurers, and superannuation trustees (RSE licensees). It makes the board ultimately responsible for the entity's information security and requires an information security capability that matches the size and extent of the threats to its information assets. The entity must notify APRA as soon as possible, and no later than 72 hours after becoming aware, of an information security incident that materially affected, or could have materially affected, the entity or its customers, or that has been reported to another regulator. It does not name ISO 27001, and APRA's guidance leaves the choice of industry standards to the entity; an ISMS is one way to show that capability.
  • SOCI. Under the Security of Critical Infrastructure Act 2018 (SOCI), the responsible entities for some classes of critical infrastructure asset must adopt, maintain and comply with a critical infrastructure risk management program (CIRMP). Besides minimising material cyber risks, its cyber hazard rules require a process to comply with one of five named frameworks, or an equivalent framework. Two of the five are AS ISO/IEC 27001:2015 (as the Rules name it) and the Essential Eight Maturity Model at maturity level one. Since 10 June 2026, enhanced rules (section 8A) for nine asset classes, including electricity, gas, water, liquid fuel, broadcasting and freight, name five frameworks of their own, among them AS ISO/IEC 27001:2023 (as the Rules name it; Standards Australia publishes it as AS/NZS ISO/IEC 27001:2023) and the Essential Eight at maturity level two; assets already covered have until 10 June 2028 to comply. (Sources: CIRMP Rules, sections 8 and 8A, as compiled on 10 June 2026; Cyber and Infrastructure Security Centre (CISC) guidance of March 2025 and its enhanced CIRMP factsheet of June 2026.)
  • Privacy Act 1988. Australian Privacy Principle 11 (APP 11) requires organisations covered by the Act (annual turnover over A$3 million, plus some smaller ones) to take reasonable steps to protect the personal information they hold. Since 11 December 2024, APP 11.3 has said those steps include technical and organisational measures, and the Office of the Australian Information Commissioner (OAIC) explains this in its APP guidelines (Chapter 11, version 1.3, 3 October 2025). The OAIC points organisations to the ISO/IEC 27000 series, and an ISMS is one way to show those steps.

Is the PECB ISO 27001 Lead Implementer recognised in Australia?

PECB describes its credentials as internationally recognised. IAS and UKAS both accredit PECB under ISO/IEC 17024 for the ISO/IEC 27001 Lead Implementer credential, any employer can check a certificate on PECB's Certificate Verification page, and the course and exam are taken online from Australia.

  • Accreditation. PECB holds accreditation under ISO/IEC 17024, the standard for bodies that certify people. IAS (the International Accreditation Service) and UKAS (the United Kingdom Accreditation Service) both list the PECB Certified ISO/IEC 27001 Lead Implementer in their scopes; PECB's COFRAC accreditation covers a different credential. The Lead Implementer handbook says the certification scheme is written to comply with that standard.
  • Verification. Any employer can check a PECB certificate on PECB's Certificate Verification page; every valid certificate also links to a digital badge.
  • Mindset Cyber and PECB. Mindset Cyber is a PECB Authorised Titanium Partner, PECB's highest partner level, and founder Clinton McKillop is a PECB Certified Trainer.

Frequently asked questions

Is the PECB ISO 27001 Lead Implementer exam hard?

It is a professional exam, not a memory test: 80 multiple-choice questions, 3 hours, open book, 70% to pass. A second attempt is included in the course price; PECB publishes no pass rate.

How much does the ISO 27001 certification exam cost?

Through a PECB partner course there is no separate exam fee: the voucher and two attempts are in the A$699 + GST (A$768.90 inc. GST) course price. Without a course, PECB prices a Lead exam at US$1,000 and the certification application at US$500.

How much does it cost to get PECB certified?

Through Mindset Cyber, A$699 + GST (A$768.90 inc. GST) for the Lead Implementer eLearning, with the exam voucher, two attempts, the certification application fee and the first year of maintenance included. PECB's Certification Maintenance Policy lists the Annual Maintenance Fee at US$390 per certificate for each three-year cycle, paid year by year in myPECB; the first year is included in the course price.

Is ISO 27001 hard to get?

For a person, the entry bar is low: no degree or experience is needed to study or sit, and the exam is open book with a 70% pass mark. The work is the study hours and, for the full Lead Implementer title, five years of experience and 300 project hours. For an organisation, it is a working ISMS with evidence behind it, then a two-stage audit.

Is the ISO 27001 exam difficult?

It tests application more than recall. The 80 questions cover seven domains (topic areas): ISMS principles (15 questions), ISMS requirements (12), planning (18), implementing (14), monitoring and measurement (10), continual improvement (6) and audit preparation (5). Of the 80, 43 measure comprehension, application and analysis; the other 37, in the planning, implementing and audit-preparation domains, measure evaluation.

Is 27001 a lead implementer?

No. ISO/IEC 27001 is the standard, and organisations are certified against it. Lead Implementer is a credential for the person who builds and runs the ISMS; PECB's is the one this guide covers.

How much does it cost to get ISO 27001 certified?

Also asked as "How much does ISO cert cost?" and "How much does it cost to get ISO certified in Australia?". For a professional, the PECB ISO 27001 Lead Implementer eLearning price covers the exam and the certification application. For an organisation, the cost is the certification body's audit fees plus the implementation work; our ISO 27001 certification cost guide breaks it down.

How to get ISO 27001 certification in Australia?

For yourself, five online steps: optional Foundation, the eLearning, the exam, the myPECB application, then CPD and the maintenance fee. For your organisation, build the ISMS, audit it internally, then book Stage 1 and Stage 2 audits with a certification body.

What is ISO 27001 certification?

The certificate an organisation receives when a certification body audits its ISMS against ISO/IEC 27001:2022 and finds that it meets the standard. "What is ISO 27001 certification in Australia?" has the same answer: the standard and the audit are the same here as anywhere.

Is ISO 27001 still relevant?

Yes. ISO/IEC 27001:2022 is the current edition (Standards Australia publishes it as AS/NZS ISO/IEC 27001:2023), the PECB exam covers its 93 Annex A controls, and Australia's critical-infrastructure rules name AS ISO/IEC 27001 as an accepted framework (the 2015 edition in the baseline rules, the 2023 edition in the enhanced rules for nine asset classes). So to "Is ISO 27001 outdated?", the answer is no.

How long does ISO 27001 certification last?

A PECB credential is valid for three years and renews if you have logged your CPD (90 hours for a Lead Implementer) and paid the maintenance fee; no new exam is needed. An organisation's ISO 27001 certificate also runs for three years, with a surveillance audit each year and a recertification audit before it expires.

Is ISO 27001 mandatory in Australia?

No law makes it compulsory for every business. The critical-infrastructure rules under the Security of Critical Infrastructure Act 2018 list AS ISO/IEC 27001:2015 among the frameworks a responsible entity (the organisation responsible for a critical infrastructure asset) may comply with, and since 10 June 2026 list AS ISO/IEC 27001:2023 among the frameworks for nine asset classes such as electricity, gas and water. The Australian Prudential Regulation Authority's CPS 234 and the Privacy Act require security outcomes that an ISMS can show.

Is ISO 27001 certification worth it?

For an Information Security Manager, GRC consultant, ISMS project lead or security architect, it is one way to show an employer you can build and run an ISMS, with a certificate any employer can verify; the cost is one course plus PECB's maintenance fee from year two. For an organisation, it earns its keep when customers, regulators or contracts expect it.

Can I get ISO certification for free?

Not the PECB credential: the exam and application are paid, either inside a partner course price or directly to PECB (US$1,000 for a Lead exam, US$500 to apply). An organisation pays its certification body's audit fees, and the standard itself is bought from Standards Australia or iso.org.

How much does an ISO 27001 course cost?

ISO 27001 Foundation A$279 + GST (A$306.90 inc. GST); ISO 27001 Lead Implementer eLearning A$699 + GST (A$768.90 inc. GST); each includes the PECB exam voucher and two exam attempts.

What is the average salary for an ISO 27001 auditor?

We do not publish salary figures. Check current listings for your city and industry.

Is there an ISO 27001 Lead Auditor certification available in Australia?

Yes. The PECB Certified ISO/IEC 27001 Lead Auditor is taken the same way, online from Australia; our Lead Auditor guide covers its steps.

Do you need ISO 27001 Foundation before Lead Implementer?

No. PECB's main requirement is a general knowledge of ISMS concepts and ISO/IEC 27001; Foundation is not required. Foundation, at A$279 + GST (A$306.90 inc. GST), suits people new to management-system standards.

Can you do the ISO 27001 Lead Implementer exam online?

Yes. The course runs on myPECB, the exam is taken in the PECB Exams app under remote supervision, and the application is made in myPECB. Nothing requires attendance in person.

What are the ISO 27001 Lead Implementer requirements?

For the full Lead Implementer credential: a pass in the PECB ISO/IEC 27001 Lead Implementer exam, five years of professional experience, two of them in information security management, and 300 hours of ISMS project activities. You also need two professional references and must sign the PECB Code of Ethics. With less experience, apply for a lower level and upgrade later.

Is the PECB ISO 27001 Lead Implementer worth it?

Your call. The course price covers PECB's exam, a second attempt, the certification application and the first year of maintenance; the exam-only route is US$1,000 plus US$500. The course materials are allowed in the open-book exam, and eLearning earns 31 CPD credits.

Is there an ISO 27001 Lead Implementer practice exam?

PECB's eLearning includes quizzes, which PECB says are structured like the certification exam. Mindset Prep, our optional exam-practice app, adds practice questions for this exam on the web, iOS and Android: A$99 + GST (A$108.90 inc. GST) for a year when added at the course checkout, or a subscription at mindsetprep.com.au.

Next steps

Enrol when you are ready, or try practice questions first.

Official PECB eLearning

PECB ISO 27001 Lead Implementer eLearning

A$699 + GST (A$768.90 inc. GST)

Australian prices attract 10% GST, shown before checkout.

PECB's own eLearning on myPECB. Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance and 12 months of access. 31 CPD credits.

View course →

Mindset Prep practice questions

A$99 + GST (A$108.90 inc. GST) with the course

Australian prices attract 10% GST, shown before checkout.

For a year when added at the course checkout, or a subscription at mindsetprep.com.au. Practice questions for this exam on the web, iOS and Android.

Start practice →
Download Mindset Prep on the App Store Get Mindset Prep on Google Play

Related reading: How to become an ISO 27001 Lead Auditor in Australia · ISO 27001 certification cost in Australia · ISO 27001 explained

Sources

Every source was read on 25 October 2026.

  • PECB, ISO/IEC 27001 Lead Implementer course page (modified 24 August 2026): https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27001/iso-iec-27001-lead-implementer
  • PECB, Candidate Handbook ISO/IEC 27001 Lead Implementer (multiple-choice), version 1.5, 2026: https://pecb.com/pdf/candidate-handbooks/pecb-candidate-handbook-iso-27001-lead-implementer-mc.pdf
  • PECB, Exam Rules and Policies (modified 17 June 2026): https://pecb.com/en/exam-rules-and-policies
  • PECB, List of PECB Exams (ISO/IEC 27001 Lead Implementer row dated 2 April 2026): https://help.pecb.com/list-of-pecb-exams/
  • PECB, Certification Maintenance Policy (page modified 10 September 2026): https://pecb.com/en/certification-maintenance-policy
  • PECB, Certification Maintenance Policy, 2026 PDF: https://pecb.com/pdf/candidate-handbooks/PECB_Certification_Maintenance_Policy_EN_-_2026.pdf
  • PECB, Continuing Professional Development Policy, June 2026: https://pecb.com/pdf/brochures/cpd-policy.pdf
  • PECB, Training Course Delivery Formats (modified 25 June 2026): https://pecb.com/en/pecb-training-course-delivery-formats
  • PECB, ISO/IEC 27001 Lead Implementer eLearning brochure, 30 April 2026: https://pecb.com/pdf/brochures/iso-iec-27001-lead-implementer-elearning.pdf
  • PECB, ISO/IEC 27001 Transition course page (modified 23 September 2026): https://pecb.com/en/education-and-certification-for-individuals/iso-iec-27001/iso-iec-27001-transition
  • PECB help centre, "How do I apply for a PECB Certificate after passing my Exam?": https://help.pecb.com/mypecb-member/certification/how-do-i-apply-for-a-pecb-certificate-after-passing-my-exam/
  • PECB help centre, "How do I schedule a PECB Online Exam after attending a Training?": https://help.pecb.com/mypecb-member/examination/how-do-i-schedule-a-pecb-online-exam-after-attending-a-training/
  • PECB help centre, "Can I access the Standard during the exam?": https://help.pecb.com/mypecb-member/pecb-exams-application/can-i-access-the-standard-during-the-exam/
  • PECB help centre, "How do I pay my Annual Maintenance Fee (AMF)?": https://help.pecb.com/mypecb-member/certification/how-do-i-pay-my-annual-maintenance-fee-amf/
  • PECB, "ISO/IEC 27001 Certification Levels: Lead Auditor vs. Lead Implementer" (page dated 03/10/2024 as displayed; metadata modified 14 July 2025): https://pecb.com/en/article/iso-iec-27001-certification-levels-lead-auditor-vs-lead-implementer
  • PECB, Accreditations and Affiliations (modified 19 October 2026): https://pecb.com/en/about/accreditations-and-affiliations
  • PECB, Certificate Verification: https://pecb.com/en/certificate-verification
  • PECB, Digital Badges: https://pecb.com/en/about/pecb-digital-badges
  • PECB, The Value of PECB Certification: https://pecb.com/en/about/values-of-pecb-certification
  • PECB partner directory, Mindset Cyber record: https://pecb.com/en/partners?companyName=Mindset+Cyber&modal=188350
  • PECB trainer directory, Clinton McKillop record: https://pecb.com/en/trainers?search=Mckillop
  • Australian Signals Directorate, Essential Eight explained (published 1 February 2017, last reviewed 27 November 2023): https://www.cyber.gov.au/publication/essential-eight-explained
  • Australian Signals Directorate, Essential Eight maturity model (published 30 June 2017, last reviewed 27 November 2023): https://www.cyber.gov.au/publication/essential-eight-maturity-model
  • Australian Signals Directorate, The Commonwealth Cyber Security Posture in 2025 (12 February 2026): https://www.cyber.gov.au/publication/the-commonwealth-cyber-security-posture-in-2025
  • Australian Signals Directorate, Information Security Manual, September 2026 release (published 7 September 2026): https://www.cyber.gov.au/ism/2026-09
  • Department of Home Affairs, Protective Security Policy Framework Release 2026 (1 July 2026), Requirement 0085 and sections 14.2 and 14.3: https://www.protectivesecurity.gov.au/publications-library/pspf-annual-release-2026
  • Department of Home Affairs, PSPF Assessment Report 2024-25 (11 February 2026): https://www.protectivesecurity.gov.au/system/files/2026-02/pspf-assessment-report-2024-25.pdf
  • APRA, Prudential Standard CPS 234 Information Security (in force 1 July 2019; F2018L01745): https://www.apra.gov.au/standards/cps-234
  • APRA, Prudential Practice Guide CPG 234 Information Security (June 2019): https://www.apra.gov.au/practice-guides/cpg-234
  • Security of Critical Infrastructure Act 2018, sections 30AC and 30AD: https://www.legislation.gov.au/C2018A00029/latest/text
  • Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, Compilation No. 2 (10 June 2026), sections 4A, 8 and 8A: https://www.legislation.gov.au/F2023L00112/latest/text
  • Cyber and Infrastructure Security Centre, Guidance for the Critical Infrastructure Risk Management Program, March 2025: https://www.cisc.gov.au/resources-subsite/Documents/guidance-for-the-critical-infrastructure-risk-management-program.pdf
  • Cyber and Infrastructure Security Centre, Enhanced CIRMP Implementation Factsheet, June 2026: https://www.cisc.gov.au/resources-subsite/Documents/enhanced-cirmp-implementation-factsheet.pdf
  • Privacy Act 1988, section 6D and Schedule 1, APP 11: https://www.legislation.gov.au/C2004A03712/latest/text
  • OAIC, Rights and responsibilities: https://www.oaic.gov.au/privacy/privacy-legislation/the-privacy-act/rights-and-responsibilities
  • OAIC, Australian Privacy Principles guidelines, Chapter 11: APP 11 Security of personal information, version 1.3 (3 October 2025): https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information
  • OAIC, Australian Privacy Principles guidelines, summary of version changes: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/summary-of-version-changes-to-app-guidelines
  • OAIC, Guide to securing personal information: https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/guide-to-securing-personal-information
  • Standards Australia, AS/NZS ISO/IEC 27001:2023: https://store.standards.org.au/product/as-nzs-iso-iec-27001-2023
  • Mindset Cyber, PECB ISO 27001 Lead Implementer course page (27 sections, study-time estimate, inclusions): https://mindsetcyber.com.au/professional-development/pecb-iso-27001-lead-implementer/
  • Mindset Cyber, PECB ISO 27001 Foundation course page (about 14 hours of self-paced eLearning): https://mindsetcyber.com.au/professional-development/pecb-iso-27001-foundation/