ISO 22301 Lead Implementer: Exam, Experience Grades, Cost and Career Fit

"ISO 22301 Lead Implementer" is a personal certification for people who build a business continuity management system (BCMS), but ISO itself does not certify people and the credential is defined by whichever scheme owner runs the exam. This guide explains what the credential tests, who it suits, the experience grades, the exam and renewal rules, and where it sits next to business continuity and security credentials. It uses PECB's published scheme as the worked example because its course, exam and maintenance rules are public; other training bodies run similar courses with their own rules, so read the scheme pages of the body you choose. It is for business continuity, resilience, GRC and security practitioners deciding whether the course is worth the time. Facts were checked on the scheme owner's pages on 8 November 2026. For the standard itself, see the ISO 22301 Business Continuity Guide.

Key takeaways

• It certifies implementation skill, not the organisation. A Lead Implementer credential says a person can plan, build and run a BCMS against ISO 22301; certifying the organisation is a separate audit by an accredited certification body.
• The exam is only the first grade. In PECB's scheme, passing the exam alone gives "Provisional Implementer"; the full Lead Implementer grade needs five years of experience, two of them in business continuity management, and 300 hours of BCMS project work.
• Seven domains follow the BCMS lifecycle. Principles, initiation, planning, implementation, performance evaluation, continual improvement and preparing for the certification audit.
• Renewal is a three-year cycle. PECB lead grades need 90 CPD hours per three years and an annual maintenance fee of USD 390 per three-year period; missing either leads to suspension.
• Clause 8 is the hard part. Business impact analysis, risk assessment, strategies, plans and the exercise programme are where implementers earn the title, so prepare with real BIA and exercise artefacts, not only the course slides.

Who the certification is for

The Lead Implementer and Lead Auditor courses share the BCMS fundamentals but answer different questions. The table compares them using PECB's published course pages; the distinction is the same for other scheme owners.

• Good fit: a business continuity or IT service continuity owner asked to take the organisation to ISO 22301 certification; a security or GRC lead whose ISO/IEC 27001 programme now has to cover continuity in depth; a consultant who delivers BCMS projects.
• PECB's stated audience: managers and consultants involved in business continuity, people seeking to master BCMS implementation, people responsible for maintaining BCMS conformity, and people with roles related to the BCMS.
• Poor fit: someone who wants hands-on disaster recovery engineering skills (backup architecture, failover design). The course is about the management system around those solutions, not their technical build.
• Already hold the ISO 27001 version? The method (context, scope, leadership, planning, support, operation, evaluation, improvement) is the same Harmonized Structure, so much of the clause 4 to 7 and 9 to 10 material will be familiar. The new content is clause 8: BIA, continuity strategies, plans and exercising. See the ISO 27001 Lead Auditor and Lead Implementer Guide.

Exam format and domains

PECB's ISO 22301 Lead Implementer course runs five days, with the certification exam on day 5. The course page lists seven exam domains. The right-hand column is our mapping to the standard, not PECB content.

How the exam is run

• Exam type: PECB's examination rules describe three types: closed-book multiple choice (usually Foundation and Transition), open-book essay, and open-book multiple choice where a hard copy of the main standard, training materials, personal notes and a dictionary are allowed. PECB states essay exams are gradually moving to open-book multiple choice. The Lead Implementer page refers to PECB's list of exams for the type and languages of each exam, so confirm yours there before booking.
• Delivery: online through the PECB Exams application with a remote invigilator watching by camera (phones and tablets prohibited), or on paper at a training partner's session with a PECB-approved invigilator. Arrive at least 30 minutes early with valid ID.
• Language: candidates sitting a lead exam in a language other than their native one can request an extra 30 minutes on the day.
• Results: online multiple choice shows the grade immediately; paper multiple choice takes two to four weeks; essay results take three to eight weeks.
• Retakes: the first retake is allowed 15 days after the initial exam. The course page states one free retake within 12 months of the initial exam for course participants; later retakes are charged and the number is not limited.
• Duration: PECB's course and rules pages read for this guide do not state the exam length, so check the exam list or your training partner rather than relying on second-hand figures.

Prerequisites and experience

There is no formal entry requirement for the course: PECB asks for a fundamental understanding of business continuity concepts and principles. Experience matters after the exam, because it decides which grade you can apply for. All grades also require signing the PECB Code of Ethics.

• What counts as project hours: plan your evidence early. Work that maps cleanly to the standard is easiest to evidence: running a BIA workshop, writing a continuity strategy, drafting and testing a plan, running an exercise and its post-exercise report, preparing management review inputs.
• Keep a log: record the activity, the clause it relates to, hours, dates and a referee who can confirm it. Reconstructing five years of work at application time is where many candidates stall.
• Security people moving into continuity: incident response and disaster recovery work only counts towards the "business continuity management" years if it was part of continuity planning. Be honest in the application; the referee will be asked.

Preparation plan

The course is intensive, and four days of teaching on a standard with a heavy clause 8 is a lot. A practical plan for a working practitioner:

1. Weeks 1 to 2, read the standard properly. Buy ISO 22301 and read it alongside ISO 22313 (guidance) and ISO/TS 22317 (BIA guidance). Note every "shall" in clause 8. The live ISO 22301 Business Continuity Guide summarises the edition status: the 2019 edition with Amendment 1:2024 (climate action) is the text to certify against while a revision is in development.
2. Weeks 2 to 3, build one real artefact. Run or rework a BIA for one service using the Business Impact Analysis Template, setting MTPD, RTO and RPO and listing dependencies (people, sites, suppliers, applications, identity services).
3. Week 3, map a framework you know. If you hold ISO 27001 credentials, map its clauses 4 to 10 against ISO 22301 and highlight what is new. If you know the BCI Good Practice Guidelines, map its six Professional Practices (PP1 establishing a BCMS to PP6 validation) to ISO 22301 clauses.
4. Week 4, the course. Days 1 to 4 cover initiation, planning, implementation, then evaluation and audit preparation. Do the quizzes at the end of each day and mark weak domains.
5. Exam day. If your exam is open book, bring a tabbed, annotated hard copy of the standard and your notes; open book rewards knowing where things are, not memorising them.
6. After the exam. Apply for the highest grade your logged experience supports, not the provisional grade by default, and set up the CPD record for the three-year cycle at once.

• Practise scenario questions: lead exams test applied judgement. Practise with situations such as "the BIA shows a two-hour MTPD for payments but the recovery solution restores in eight hours: what should the implementer do?"
• Include cyber scenarios: ransomware and loss of identity services are realistic invocation scenarios that test every part of clause 8. Run at least one exercise with the Tabletop Exercise Guide before the course so the exercise programme domain is concrete.

Cost, renewal and continuing education

• Budget beyond the course: the standards themselves (ISO 22301, ISO 22313) are bought separately from ISO or a national standards body, and are worth owning because you will keep using them.
• CPD that pays twice: exercises you run, internal audits you support, conference sessions on resilience and courses on related standards (ISO/IEC 27001, ISO 22313) typically count. Check the scheme's CPD policy for what is accepted and keep evidence.
• Prices change: treat any figure here as a snapshot and confirm on the scheme owner's maintenance page before you budget.

Where it fits on the career path

• Typical progression: continuity coordinator, business continuity manager, head of resilience or operational resilience lead. In financial services, operational resilience rules such as DORA have made continuity a regulated discipline; see the DORA Guide.
• For security leaders: CISOs increasingly own cyber resilience, and boards ask how long the organisation can operate without a critical system. The credential gives a shared method with the continuity team. See the Cyber Resilience Guide.
• Where identity fits: BIAs often miss identity providers, privileged access tooling, certificate authorities and the service accounts and API keys that integrations depend on. If the identity platform is down or compromised, most recovery plans cannot start. Implementers with an identity background add real value by putting these on the dependency list and by planning break-glass access. See the Break-Glass Emergency Access Guide.

How the work maps to frameworks

Practitioner checklist

• Decide whether you need implementer, auditor or both, based on the work you will actually do in the next two years.
• Read the chosen scheme owner's course, exam rules and maintenance pages, and confirm exam type, language and duration before booking.
• Buy and read ISO 22301, ISO 22313 and ISO/TS 22317 before the course, focusing on clause 8.
• Produce at least one real BIA, one plan and one exercise report as preparation and as evidence for your experience log.
• Start a BCMS project-hours log now: activity, clause, hours, dates, referee.
• Apply for the highest grade your logged experience supports; avoid staying on the provisional grade.
• Set up CPD tracking for the three-year cycle and diarise the maintenance fee.
• Add identity providers, privileged access tooling and machine credentials to every BIA dependency list you build.

Standards and references

• PECB: ISO 22301 Lead Implementer
• PECB: ISO 22301 Lead Auditor
• PECB: Examination Rules and Policies
• PECB: Certification Maintenance
• PECB: Certification Rules and Policies
• The BCI: Good Practice Guidelines
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: ISO 22301 Business Continuity Guide · ISO 27001 Lead Auditor and Lead Implementer Guide · Business Continuity and Disaster Recovery Guide · Cybersecurity Certifications Guide