The ISO 27000 family in one page
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). Around it sits a family of related standards that go deeper into specific areas: risk (ISO 27005), application security (ISO 27034), incident management (ISO 27035), cybersecurity (ISO 27032) and cloud security (ISO 27017 and 27018). This guide explains each WiseLearner course in the family, who it is for and how they fit together.
The ISO 27001 security certifications compared
| Course | Standard | What you learn | Best for |
|---|---|---|---|
| ISO 27001 Lead Implementer | ISO/IEC 27001:2022 | Plan, implement, monitor and improve an ISMS using ISO 27002 controls | Security managers, consultants, ISMS owners |
| ISO 27001 Lead Auditor | ISO/IEC 27001:2022 | Plan, conduct, report and follow up ISMS audits and lead audit teams | Internal and external auditors, consultants |
| ISO 27005 Risk Manager | ISO/IEC 27005 | Identify, assess, treat and report information security risk | Risk managers, ISMS teams, security analysts |
| ISO 27034 Lead Implementer | ISO/IEC 27034 | Build an application security framework and controls | AppSec leads, architects, development managers |
| ISO 27034 Lead Auditor | ISO/IEC 27034 | Audit application security against ISO 27034 | Auditors, AppSec assurance teams |
| ISO 27035 Lead Incident Manager | ISO/IEC 27035 | Design, run and improve an incident management process | Incident response leads, SOC managers |
| Certified Lead Cybersecurity Manager | ISO/IEC 27032 and NIST CSF | Initiate and run a cybersecurity programme and governance | Cybersecurity managers and programme leads |
| Lead Cloud Security Manager | ISO/IEC 27017 and 27018 | Plan and manage a cloud security programme and cloud-specific controls | Cloud security and IT managers |
Exam formats
| Course | Exam |
|---|---|
| ISO 27001 LI and LA, ISO 27005, ISO 27034 LI and LA, ISO 27035 | 50 multiple-choice questions, 90 minutes, online, 66% to pass |
| Certified Lead Cybersecurity Manager | 3 hours, descriptive, paper-based, 70% to pass |
| Lead Cloud Security Manager | 3 hours, descriptive and multiple-choice, online, 70% to pass |
The ISO 27001 Lead Implementer and Lead Auditor courses are 4 days of instructor-led training with the certification exam included, and come with a free ISO 27032 Cybersecurity Manager Foundation course.
Lead Implementer or Lead Auditor?
Both start from the same standard, but they build different skills.
- Lead Implementer is for people who build the ISMS: scoping, risk assessment, Statement of Applicability, policies, controls and certification readiness.
- Lead Auditor is for people who check it: audit principles, planning, evidence collection, findings and reports, following ISO 19011.
Consultants often take both. Internal ISMS owners usually start with Lead Implementer, and auditors with Lead Auditor.
Suggested paths
| Your goal | Path |
|---|---|
| Build and certify an ISMS | ISO 27001 Lead Implementer, then ISO 27005 Risk Manager |
| Become an ISMS auditor | ISO 27001 Lead Auditor, then ISO 27001 Lead Implementer |
| Secure software development | ISO 27034 Lead Implementer, then ISO 27034 Lead Auditor |
| Run incident response | ISO 27035 Lead Incident Manager |
| Lead a cybersecurity programme | Certified Lead Cybersecurity Manager, then CISO training |
| Secure cloud services | Lead Cloud Security Manager, then CCSP |
| Extend into AI governance | ISO 42001 Lead Implementer |
Moving into AI? Read ISO 42001 vs ISO 27001. Comparing individual certifications? See CISSP vs CISM vs CISA vs CCSP.
Frequently asked questions
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 sets the certifiable requirements for an ISMS. ISO 27002 gives detailed guidance on the security controls. The Lead Implementer course covers both.
Do I need ISO 27001 before ISO 27005?
No formal prerequisite is required for the ISO 27005 Risk Manager course, but it is most useful alongside ISO 27001, because ISO 27005 supports the ISMS risk process.
What is ISO 27034?
ISO/IEC 27034 is the standard for application security. It defines how to build and verify security into applications across their life cycle.
What does ISO 27035 cover?
ISO/IEC 27035 covers information security incident management: preparing, detecting, responding to and learning from incidents.
What is the ISO 27001 Lead Auditor exam format?
50 multiple-choice questions in 90 minutes, taken online. The pass mark is 66% (33 out of 50).
Is ISO 27001 training available online?
Yes. WiseLearner runs live, instructor-led online batches for all ISO 27000 family courses, plus corporate batches for security teams.
Build your information security career
Choose the ISO 27000 course that fits your goal, or call +91 99084 55513 for advice and the next batch dates.
