- Duration: 5 days
Course Overview
The PECB Certified ISO/IEC 27035 Lead Incident Manager training course provides participants with the advanced knowledge and practical skills required to establish, implement, manage, and continually improve Information Security Incident Management processes in accordance with ISO/IEC 27035.
Information security incidents can significantly affect organizations of all sizes and sectors. This course equips participants with the knowledge to manage the full incident management lifecycle, including preparation, detection, assessment, reporting, response, recovery, and post-incident analysis. It also addresses risk management, incident response team coordination, organizational policies, and continual improvement.
Aligned with ISO/IEC 27001, ISO/IEC 27005, and other relevant standards in the ISO/IEC 27000 series, the course prepares participants to support organizations in strengthening incident response capabilities and reducing the business impact of information security incidents.
Upon successfully passing the examination, participants may apply for the PECB Certified ISO/IEC 27035 Lead Incident Manager credential, subject to the applicable professional experience and certification requirements.
Learning Objectives
By the end of this training course, participants will be able to:
- Explain the fundamental principles and concepts of Information Security Incident Management.
- Develop and implement effective incident response plans tailored to organizational requirements.
- Establish and select an appropriate Incident Response Team (IRT).
- Conduct risk assessments to identify potential threats and vulnerabilities.
- Apply best practices from international standards to improve incident response effectiveness.
- Manage information security incident detection, assessment, reporting, containment, eradication, and recovery.
- Conduct post-incident analysis and identify lessons learned.
- Monitor, measure, evaluate, and continually improve incident management processes and activities.
Target Audience
This course is suitable for:
- Managers and consultants seeking to enhance their knowledge of Information Security Incident Management.
- Professionals responsible for establishing and managing Incident Response Teams (IRTs).
- IT professionals and information security risk managers.
- Members of Incident Response Teams.
- Incident response coordinators and professionals responsible for incident handling and response.
- Information security professionals seeking to develop their incident management leadership capabilities.
Course Content
Day 1: Introduction to Information Security Incident Management
- Training course objectives and structure.
- Overview of relevant standards and regulatory frameworks.
- Fundamental concepts of incident management.
- Principles of Information Security Incident Management.
- Establishing the organizational context.
- Developing incident management policies and procedures.
Day 2: Designing and Preparing an Information Security Incident Management Plan
- Integrating risk management into incident management.
- Developing an Information Security Incident Management Plan.
- Establishing and organizing the Incident Management Team.
- Defining internal and external relationships.
- Identifying technical resources and other support requirements.
- Information security awareness and training.
Day 3: Detecting and Reporting Information Security Incidents
- Testing incident management capabilities.
- Monitoring information systems and networks.
- Detecting incidents and generating alerts.
- Collecting information and evidence relating to incidents.
- Reporting information security events.
- Assessing information security events to determine their significance.
Day 4: Incident Resolution, Monitoring, and Continual Improvement
- Resolving information security incidents.
- Incident containment, eradication, and recovery.
- Conducting post-incident reviews and documenting lessons learned.
- Monitoring, measurement, analysis, and evaluation.
- Assessing the effectiveness of incident management processes.
- Continual improvement of incident management activities.
- Course review and preparation for certification.
Day 5: Certification Examination
- Final course review.
- Certification examination.
Examination and Certification
The PECB Certified ISO/IEC 27035 Lead Incident Manager examination complies with the requirements of the PECB Examination and Certification Programme (ECP).
The examination covers the following competency domains:
- Domain 1: Fundamental Principles and Concepts of Information Security Incident Management.
- Domain 2: Information Security Incident Management Process Based on ISO/IEC 27035.
- Domain 3: Designing and Developing an Organizational Incident Management Process Based on ISO/IEC 27035.
- Domain 4: Preparing for Information Security Incidents and Implementing an Incident Management Plan.
- Domain 5: Implementing Incident Management Processes and Managing Information Security Incidents.
- Domain 6: Improving Incident Management Processes and Activities.
Examination duration: 3 hours.
After passing the examination, participants may apply for the appropriate PECB certification credential based on their education, professional experience, incident management project experience, and compliance with the certification requirements.
Certification Requirements
Candidates may apply for one of the following credentials, subject to meeting the applicable PECB requirements.
- PECB Certified ISO/IEC 27035 Provisional Incident Manager
- Education: At least secondary education.
- Examination: Successful completion of the PECB Certified ISO/IEC 27035 Lead Incident Manager examination or an equivalent examination.
- Professional experience: No professional experience required.
- Incident management project experience: None required.
- Other requirements: Signing the PECB Code of Ethics.
- PECB Certified ISO/IEC 27035 Incident Manager
- Education: As specified in the applicable PECB certification requirements.
- Examination: Successful completion of the relevant examination or an equivalent examination.
- Professional experience: 2 years, including 1 year in Information Security Incident Management.
- Incident management project experience: 200 hours.
- Other requirements: Signing the PECB Code of Ethics.
- PECB Certified ISO/IEC 27035 Lead Incident Manager
- Education: As specified in the applicable PECB certification requirements.
- Examination: Successful completion of the relevant examination or an equivalent examination.
- Professional experience: 5 years, including 2 years in Information Security Incident Management.
- Incident management project experience: 300 hours.
- Other requirements: Signing the PECB Code of Ethics.
- PECB Certified ISO/IEC 27035 Senior Lead Incident Manager
- Education: As specified in the applicable PECB certification requirements.
- Examination: Successful completion of the relevant examination or an equivalent examination.
- Professional experience: 10 years, including 7 years in Information Security Incident Management.
- Incident management project experience: 1,000 hours.
- Other requirements: Signing the PECB Code of Ethics.
The final credential awarded depends on the candidate’s verified eligibility and compliance with the applicable PECB Certification Rules and Policies.
Course Benefits
- Examination and certification fees are included in the training course fee.
- Participants receive training materials containing over 450 pages of information, practical examples, exercises, and quizzes.
- Participants who attend the training course receive an attestation of completion equivalent to 31 Continuing Professional Development (CPD) credits.
- Candidates who complete the training but fail the examination may retake it once at no additional examination fee within 12 months of the initial examination date, subject to applicable PECB terms and conditions.
- Develop advanced knowledge of incident response planning and implementation.
- Strengthen capabilities in incident response coordination, risk assessment, incident resolution, and continual improvement.
- Gain a structured understanding of ISO/IEC 27035 and its relationship with other information security standards.
Prerequisites
The supplied course information does not specify mandatory prerequisites for attending the training. However, prior knowledge of information security, risk management, IT operations, or incident response may help participants gain greater value from the course.
Certification Body
PECB (Professional Evaluation and Certification Board)
PECB provides professional training, examination, and certification services across information security, risk management, governance, and related professional disciplines.