How to become a certified ISO 27001 Lead Implementer in Australia
By Harry Sidhu — ISO 27001 Lead Implementer · Director and Principal Consultant, Aegentra · Published 7 July 2026 · Updated 13 September 2026
People searching this mean one of two different things — certifying their company, or certifying themselves. This guide covers the second: earning the individual PECB Lead Implementer credential, the exact experience and ISMS project hours each tier needs, the exam, the cost, and the jobs it opens in Australia.
To pursue an ISO 27001 implementation credential, prepare for the PECB examination and apply for the tier supported by your experience. Aegentra Academy offers Self-Study from A$829 + GST and PECB eLearning from A$849 + GST. Private one-to-one online training is available by enquiry, combining four teaching days, PECB eLearning and a separate one-hour implementation-consultant session. The quotation confirms the schedule, trainer authorisation, examination arrangements and booking terms before payment.
Certifying your company vs certifying yourself
These are two different things. Certifying your company means building an Information Security Management System (ISMS) and passing a Stage 1 and Stage 2 audit by a JAS-ANZ-accredited body — the outcome is an organisational certificate (covered in our ISO 27001 certification guide). Certifying yourself means earning an individual professional credential — PECB Certified ISO 27001 Lead Implementer — that proves you personally can plan and run an ISMS. This guide is about certifying yourself.
What an ISO 27001 Lead Implementer does
A Lead Implementer builds and runs the ISMS — defining scope, running the risk assessment, producing the Statement of Applicability, implementing the Annex A controls, writing policies, training staff, and steering the organisation through internal audit and management review up to the certification audit. It is the person who gets an organisation audit-ready, not the person who audits it (that is the Lead Auditor).
The step-by-step pathway
- Consider optional Foundation preparation. ISO 27001 Foundation is not a formal prerequisite.
- Take the Lead Implementer course. Study how to plan, implement and operate an ISMS.
- Pass the PECB examination. Passing the examination allows you to apply for the PECB credential tier supported by your verified experience. PECB reviews the application and makes the final credential decision.
- Log your experience and project hours. PECB publishes separate experience and project-hour requirements for each tier.
- Submit your credential application. Choose the tier supported by your experience, provide the required application information and references, and sign the PECB Code of Ethics. PECB validates the evidence and makes the final credential decision.
The PECB examination and credential application are separate steps
Passing the examination allows you to apply for the PECB credential tier supported by your verified experience. PECB reviews the application and makes the final credential decision. The course prepares you for the PECB ISO/IEC 27001 Lead Implementer examination; passing is not itself a credential award.
The same examination supports the Provisional Implementer, Implementer, Lead Implementer and Senior Lead Implementer pathways. The difference between these tiers is the experience and project activity the applicant can verify, not a different examination. Applicants must also satisfy PECB’s current certification requirements and sign the PECB Code of Ethics.
Read the current PECB ISO/IEC 27001 Lead Implementer candidate handbook.
Credential tiers and the experience each requires
All four tiers use the same PECB examination. What separates them is the experience and hours of hands-on ISMS work the applicant can evidence.
| Credential tier | Total experience | In information security | ISMS project hours |
|---|---|---|---|
| Provisional Implementer | None | — | 0 |
| Implementer | 2 years | 1 year | 200 |
| Lead Implementer | 5 years | 2 years | 300 |
| Senior Lead Implementer | 10 years | 7 years | 1,000 |
Requirements are set by PECB — see the current ISO/IEC 27001 Lead Implementer candidate handbook. Every tier also requires signing the PECB Code of Ethics.
What does ISO 27001 Lead Implementer training cost?
Self-Study is A$829 + GST and PECB eLearning is A$849 + GST. Both include the official examination package and one free retake under PECB’s applicable conditions. Contact Aegentra Academy for a quotation for the private one-to-one package. Supported currency choices and the final payable amount are shown before payment for the self-paced options.
Compare the ISO 27001 Lead Implementer course options and inclusions.
The ISMS experience that counts
Project-activity hours mean hands-on ISMS work: running a risk assessment, drafting the Statement of Applicability, implementing and documenting Annex A controls, writing policies, preparing evidence, conducting an internal audit, and supporting a certification audit. If you work in GRC, compliance, or IT security, you are already banking these hours — you just need to log them.
Roles and career pathways in Australia
The Lead Implementer credential may support progression into risk, governance, implementation, audit and consulting roles, including GRC or security analyst, ISO 27001 consultant or Lead Implementer, compliance or risk manager, Information Security Manager and vCISO or Head of Security roles. Actual eligibility, remuneration and engagement requirements depend on experience, sector, location and employer or client requirements.
Why demand is rising in Australia
ISO 27001 is now the default security qualifier in Australian procurement. More than 70,000 organisations worldwide hold the standard (ISO Survey), and Australian demand is driven by the ASD Essential Eight, APRA CPS 234, the SOCI Act, and enterprise and government procurement that asks suppliers for an ISO 27001 certified ISMS. Every one of those creates demand for people who can build the ISMS — exactly what the Lead Implementer credential proves.
Frequently asked questions
What is the difference between certifying my company and certifying myself?
They are two separate things. Certifying your company means building an Information Security Management System (ISMS) and passing a Stage 1 and Stage 2 audit by a JAS-ANZ-accredited certification body — the outcome is an organisational ISO 27001 certificate. Certifying yourself means applying for an individual PECB credential that shows the professional tier PECB has approved for you.
Do I automatically receive the Provisional Implementer credential after passing the examination?
No. Passing the examination allows you to apply for the PECB credential tier supported by your verified experience. PECB reviews the application and makes the final credential decision. The Provisional Implementer tier does not require professional or project experience, but the certification application and PECB Code of Ethics requirements still apply.
How many hours of experience do I need?
It depends on the tier. Implementer needs 200 hours of ISMS project activity; Lead Implementer needs 300 hours; Senior Lead Implementer needs 1,000 hours. “Project activities” means hands-on ISMS work — risk assessment, drafting the Statement of Applicability, implementing Annex A controls, running an internal audit, and supporting a certification audit.
Do I need the Foundation course first?
No. Foundation is optional preparation and is not a formal prerequisite for the Lead Implementer course.
How much does the ISO 27001 Lead Implementer course cost?
Self-Study is A$829 + GST and PECB eLearning is A$849 + GST. Both include the official examination package and one free retake under PECB’s applicable conditions. Contact Aegentra Academy for a quotation for the private one-to-one package. Supported currency choices and the final payable amount are shown before payment for the self-paced options.
Is the PECB credential internationally recognised?
Accreditation varies by credential. PECB publishes personnel-certification accreditation under applicable ISO/IEC 17024 scopes and ANAB certificate-program accreditation under ANSI/ASTM E2659-24 for specified programs. Verify the applicable published PECB scope.
Choose how you want to learn
Study independently with PECB Self-Study, add recorded instruction with PECB eLearning, or enquire about private one-to-one training. Review the current prices, inclusions and booking conditions before you enrol.
Compare self-paced options or Enquire about one-to-one training.