PECB certification levels: Provisional to Senior Lead, experience and how to apply
Which PECB credential your experience earns after the exam, what counts as experience, and how to apply for, keep, upgrade and verify your certificate.
Last reviewed 3 November 2026 by Clinton McKillop, PECB Certified Trainer
Quick answer
The exam is the same at every level: your experience decides which credential PECB issues when you apply. With no experience you earn Provisional. Implementer or Auditor needs 2 years of work experience, 1 of them in the field, and 200 project or audit hours; Lead needs 5 years, 2 in the field, and 300 hours; Senior Lead needs 10 years, 7 in the field, and 1,000 hours.
What is the difference between Provisional, Lead and Senior Lead?
Experience. One exam leads to every level of a scheme: the ISO/IEC 27001 Lead Implementer exam, for example, leads to PECB Certified ISO/IEC 27001 Provisional Implementer, Implementer, Lead Implementer or Senior Lead Implementer. When you apply, you choose the level your work experience and project or audit hours support, and PECB checks them.
Every level also requires signing the PECB Code of Ethics. Foundation courses are different: they lead to an entry-level certificate, such as PECB Certificate Holder in ISO/IEC 27001 Foundation, which needs no experience and carries no maintenance.
Can I sit the exam with no experience?
Yes. A pass with no experience earns the Provisional credential. PECB's rules say work experience does not apply to Provisional certificates, and neither do references. When you have built the experience, you can upgrade to a higher level (see How do I upgrade to a higher level later?).
How many years of experience do I need, and does it have to be in the field?
For Lead: 5 years of work experience, 2 of them in the field the standard covers, and 300 hours of project or audit activities. The field is information security management for ISO/IEC 27001, AI management for ISO/IEC 42001, quality management for ISO 9001, privacy management for ISO/IEC 27701 and risk management for ISO 31000. The other years are general professional experience.
Hours are project hours on an implementer track and audit hours on an auditor track. These tables copy PECB's candidate handbooks.
ISO/IEC 27001
| Credential | Work experience | Of which in information security management | Project hours |
|---|---|---|---|
| PECB Certified ISO/IEC 27001 Provisional Implementer | None | None | None |
| PECB Certified ISO/IEC 27001 Implementer | 2 years | 1 year | 200 |
| PECB Certified ISO/IEC 27001 Lead Implementer | 5 years | 2 years | 300 |
| PECB Certified ISO/IEC 27001 Senior Lead Implementer | 10 years | 7 years | 1,000 |
| Credential | Work experience | Of which in information security management | Audit hours |
|---|---|---|---|
| PECB Certified ISO/IEC 27001 Provisional Auditor | None | None | None |
| PECB Certified ISO/IEC 27001 Auditor | 2 years | 1 year | 200 |
| PECB Certified ISO/IEC 27001 Lead Auditor | 5 years | 2 years | 300 |
| PECB Certified ISO/IEC 27001 Senior Lead Auditor | 10 years | 7 years | 1,000 |
ISO/IEC 42001
| Credential | Work experience | Of which in AI management | Project hours |
|---|---|---|---|
| PECB Certified ISO/IEC 42001 Provisional Implementer | None | None | None |
| PECB Certified ISO/IEC 42001 Implementer | 2 years | 1 year | 200 |
| PECB Certified ISO/IEC 42001 Lead Implementer | 5 years | 2 years | 300 |
| PECB Certified ISO/IEC 42001 Senior Lead Implementer | 10 years | 7 years | 1,000 |
| Credential | Work experience | Of which in AI management | Audit hours |
|---|---|---|---|
| PECB Certified ISO/IEC 42001 Provisional Auditor | None | None | None |
| PECB Certified ISO/IEC 42001 Auditor | 2 years | 1 year | 200 |
| PECB Certified ISO/IEC 42001 Lead Auditor | 5 years | 2 years | 300 |
| PECB Certified ISO/IEC 42001 Senior Lead Auditor | 10 years | 7 years | 1,000 |
ISO 9001
| Credential | Work experience | Of which in quality management | Project hours |
|---|---|---|---|
| PECB Certified ISO 9001 Provisional Implementer | None | None | None |
| PECB Certified ISO 9001 Implementer | 2 years | 1 year | 200 |
| PECB Certified ISO 9001 Lead Implementer | 5 years | 2 years | 300 |
| PECB Certified ISO 9001 Senior Lead Implementer | 10 years | 7 years | 1,000 |
| Credential | Work experience | Of which in quality management | Audit hours |
|---|---|---|---|
| PECB Certified ISO 9001 Provisional Auditor | None | None | None |
| PECB Certified ISO 9001 Auditor | 2 years | 1 year | 200 |
| PECB Certified ISO 9001 Lead Auditor | 5 years | 2 years | 300 |
| PECB Certified ISO 9001 Senior Lead Auditor | 10 years | 7 years | 1,000 |
ISO/IEC 27701
| Credential | Work experience | Of which in privacy information management | Project hours |
|---|---|---|---|
| PECB Certified ISO/IEC 27701 Provisional Implementer | None | None | None |
| PECB Certified ISO/IEC 27701 Implementer | 2 years | 1 year | 200 |
| PECB Certified ISO/IEC 27701 Lead Implementer | 5 years | 2 years | 300 |
| PECB Certified ISO/IEC 27701 Senior Lead Implementer | 10 years | 7 years | 1,000 |
| Credential | Work experience | Of which in privacy management | Audit hours |
|---|---|---|---|
| PECB Certified ISO/IEC 27701 Provisional Auditor | None | None | None |
| PECB Certified ISO/IEC 27701 Auditor | 2 years | 1 year | 200 |
| PECB Certified ISO/IEC 27701 Lead Auditor | 5 years | 2 years | 300 |
| PECB Certified ISO/IEC 27701 Senior Lead Auditor | 10 years | 7 years | 1,000 |
ISO 31000
| Credential | Work experience | Of which in risk management | Project hours |
|---|---|---|---|
| PECB Certified ISO 31000 Provisional Risk Manager | None | None | None |
| PECB Certified ISO 31000 Risk Manager | 2 years | 1 year | 200 |
PECB's Risk Manager candidate handbook lists these two credentials for this exam. PECB's course page also lists Lead and Senior Lead Risk Manager; if you are aiming for one of those, ask us and we will confirm the route with PECB first.
Scroll a table sideways to see every column.
What counts as project or audit hours, and what evidence does PECB ask for?
Hours you spent on the implementation or audit activities PECB lists for the scheme, backed by your CV, your work history and two professional references. PECB's candidate handbooks say the activities should follow best implementation and management practices, or best audit practices, and list the ones that count. These are PECB's lists, word for word.
Implementer and Risk Manager tracks: project activities
ISO/IEC 27001: implementing an information security management system (ISMS)
- Drafting ISMS implementation plans
- Initiating ISMS implementation projects
- Establishing policies, processes, and procedures
- Setting objectives at relevant levels
- Implementing the ISMS
- Managing, monitoring, and maintaining the ISMS
- Identifying and acting upon continual improvement opportunities
ISO 9001: implementing a quality management system (QMS)
- Drafting QMS implementation plans
- Initiating QMS implementation projects
- Establishing policies, processes, and procedures
- Setting objectives at relevant levels
- Implementing the QMS
- Managing, monitoring, and maintaining the QMS
- Identifying and acting upon continual improvement opportunities
ISO/IEC 42001: implementing an AI management system (AIMS)
- Drafting an AIMS implementation plan
- Managing AIMS implementation projects
- Implementing the AIMS
- Managing documented information
- Implementing corrective actions
- Monitoring the AIMS performance
- Managing an AIMS implementation team
ISO/IEC 27701: implementing a privacy information management system (PIMS)
- Drafting a PIMS plan
- Initiating a PIMS implementation
- Implementing a PIMS
- Monitoring and managing the PIMS implementation
- Performing continual improvement measures
ISO 31000: implementing risk management, for the Risk Manager credential
- Identifying assets, existing measures, risk sources, and potential consequences
- Assessing the likelihood and impact of incidents to determine risk levels
- Evaluating risk levels and identifying appropriate treatment options
- Selecting and implementing risk treatment options and evaluating residual risks
- Developing and maintaining a comprehensive risk treatment plan
Auditor tracks: audit activities
The same nine activities for ISO/IEC 27001, ISO/IEC 42001, ISO 9001 and ISO/IEC 27701:
- Planning an audit
- Managing an audit program
- Drafting audit reports
- Drafting nonconformity reports
- Drafting audit working documents
- Reviewing and managing documented information related to the audit
- Conducting on-site audits
- Following up on nonconformities
- Leading an audit team
PECB's certification rules count pre-audits, gap analyses, internal audits and second-party, third-party or opinion audits as audit experience.
In your application you add each job with its dates, and PECB checks your project or audit log for the hours. PECB asks for two professional references who have worked with you and can confirm your experience; they cannot be someone you supervise or a relative. PECB contacts them with an online questionnaire.
Keep a dated record of your project or audit hours from your first one, with the people who can confirm them, so the application is quick when you are ready.
How do I apply after passing?
In myPECB: start the application from the certificate icon for your course, choose your level, add your experience and references, and submit. The application has three tabs: Select Certificate, Work & Experience, and Review & Declarations. The certification fee is included in every PECB course price we sell, so you do not pay PECB's application fee yourself.
PECB asks you to apply within 12 months of purchase for eLearning and Self-Study courses, the same window as your two exam attempts. See what every PECB course price includes and the PECB exam guide.
Who issues the certificate, and how long does it take?
PECB's Certification Department reviews your application and issues the certificate. PECB contacts your references first, then emails you its decision. Once you are approved, you download your certificate from myPECB and claim your digital badge through Credly.
PECB does not publish how long the review takes. It cannot finish before your references answer PECB's questionnaire, so tell them to expect it.
How long is the certificate valid, and how does the AMF work?
Three years. To keep it, you log CPD hours and pay PECB's Annual Maintenance Fee (AMF) during each three-year cycle. PECB's Certification Maintenance Policy asks for 60 CPD hours per cycle at Implementer, Auditor or Risk Manager level, 90 at Lead level and 180 at Senior Lead level, with no minimum in any one year.
The AMF is USD 390 per certificate for each three-year cycle, and the first year of it is included in the price of every course on this page. From year two you pay it to PECB directly, and PECB gives a 10% discount if you pay three years in advance. Foundation, Provisional and Transition certificates carry no maintenance fee. If you miss the CPD or the AMF, PECB suspends the certificate for 12 months while you catch up.
How do I upgrade to a higher level later?
Apply in myPECB once you have the experience: open your certificate and click Upgrade. PECB charges an application fee of USD 100 for an upgrade, and says "An evaluation will be done to determine if an exam is required" first.
How can an employer verify my PECB certificate?
On PECB's certificate verification page, with your last name and certificate number. It shows the certificate, its issue date, the date it is valid until and its status. Your Credly digital badge is a second way to share it.
Related guides
- How to become an ISO 27001 Lead Implementer
- How to become an ISO 27001 Lead Auditor
- How to become an ISO 42001 Lead Implementer
- How to become an ISO 42001 Lead Auditor
- ISO 27001 Lead Auditor vs Lead Implementer
Courses on this page: ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor, ISO/IEC 42001 Lead Implementer, ISO/IEC 42001 Lead Auditor, ISO 9001 Lead Implementer, ISO 9001 Lead Auditor, ISO/IEC 27701 Lead Implementer, ISO/IEC 27701 Lead Auditor and ISO 31000 Risk Manager. Each one is linked from its table above.
Sources
- PECB, Certification Rules and Policies
- PECB, Certification Maintenance Policy
- PECB, Certificate Verification
- PECB help centre, "How do I apply for a PECB Certificate after passing my Exam?"
- PECB help centre, "How do I pay my Annual Maintenance Fee (AMF)?"
- PECB help centre, "How do I download my PECB Certificate and claim my Digital Badge?"
- PECB candidate handbooks (one per exam, linked from the List of PECB Exams)
All read 3 November 2026. Mindset Cyber is a PECB Authorised Titanium Partner, PECB's highest partner level.
Find your PECB course
Each course page shows its price, its exam and the credentials it leads to.