ISO 27001 certification for individuals is a personal qualification, not a company certificate. The two main ones are Lead Implementer, for people who build an information security management system, and Lead Auditor, for people who audit one. Published course prices in Ireland run from about €1,900 online to €4,000 for classroom courses, as of October 2026. ERS IT Solutions does not run these courses. We explain them here because clients often ask whether to train someone in-house.
Is ISO 27001 certification for a company or a person?
Both exist, and they are often confused. An organisation is certified to ISO/IEC 27001 by an accredited certification body such as NSAI, after audits of its information security management system (ISMS). A person earns a training credential, such as "Certified ISO/IEC 27001 Lead Implementer", from a personnel certification body after a course and an exam.
A person's credential does not certify their employer. Equally, your company can be certified without anyone on staff holding a lead implementer or lead auditor qualification, although it helps to have someone who understands the standard. For company certification, see our ISO 27001 certification guide.
What does an ISO 27001 Lead Implementer do?
A lead implementer plans and runs the project to build an ISMS: setting the scope, running the risk assessment, writing the Statement of Applicability, choosing Annex A controls, preparing policies, training staff and getting the organisation ready for its certification audits. It suits IT managers, compliance leads, information security officers and consultants.
The course covers the clauses of ISO/IEC 27001:2022, the 93 Annex A controls, the Plan, Do, Check, Act cycle and how to prepare for Stage 1 and Stage 2 audits.
What does an ISO 27001 Lead Auditor do?
A lead auditor plans and leads audits of an ISMS against the standard. That might be internal audits for their own employer, supplier audits, or, for those working at a certification body, the external certification audits themselves. The course covers audit principles, planning, gathering evidence, writing nonconformities and running an audit team, based on ISO 19011 and ISO/IEC 17021-1 guidance.
If your aim is to run your company's yearly internal audit, a lead auditor or internal auditor course is the closer fit. If your aim is to get your company certified, lead implementer is usually the better choice.
How much does ISO 27001 Lead Implementer certification cost?
Prices are set by training providers, not by ISO. These are published prices we checked on 28 October 2026. They are typical market examples, not ERS prices.
| Course | Provider | Format and length | Published price |
|---|---|---|---|
| Certified ISO/IEC 27001 Lead Implementer (PECB) | Bilginc, Ireland | Classroom, 4 days | €4,000 |
| ISO/IEC 27001 Lead Auditor | Sprintzeal, Dublin | Live online, 40 hours | From €1,896 |
| ISO/IEC 27001 Lead Implementer | BSI Ireland | 4 days | Price on BSI's booking page |
What changes the price:
- Classroom or online. Live online courses are usually cheaper than classroom.
- Exam included or not. Check whether the exam fee and a resit are part of the price.
- Credential body. PECB, BSI and others issue their own credentials, with different recognition.
- Copy of the standard. Some courses include a loan copy, some expect you to buy it.
- VAT. Some prices are shown before VAT.
Employers sometimes pay for these courses as staff development, and the cost of one person's course is small next to the cost of an ISO 27001 project.
How to become an ISO 27001 certified auditor
Passing the exam is the first step. Full credentials also need experience. Using PECB's published scheme as an example, from its Lead Auditor page:
| PECB credential | Professional experience | Audit experience |
|---|---|---|
| Provisional Auditor | None | None |
| Auditor | Two years, including one in information security management | 200 hours of audit activities |
| Lead Auditor | Five years, including two in information security management | 300 hours of audit activities |
The Lead Implementer scheme is the same shape, with project activities instead of audit activities: 200 hours for Implementer and 300 hours for Lead Implementer. Everyone also signs PECB's code of ethics. Other providers have their own rules, so check the credential you are paying for.
To audit for a certification body, you also need to meet that body's own competence requirements and work under its accreditation. A course on its own does not make you a certification body auditor.
Lead Implementer vs Lead Auditor: which should you choose?
| Your goal | Better choice |
|---|---|
| Get your own company certified | Lead Implementer |
| Run internal audits for your company | Lead Auditor, or a shorter internal auditor course |
| Work as an ISO 27001 consultant | Lead Implementer first, then Lead Auditor |
| Work for a certification body | Lead Auditor plus that body's requirements |
| Audit your suppliers | Lead Auditor |
Many people do both over time. The implementer course teaches how to build the system, and the auditor course teaches how to test it.
Do you need a lead implementer to get ISO 27001?
No. The standard does not require anyone in your organisation to hold a personal credential. What auditors look for is competence: evidence that the people running the ISMS know what they are doing. Training records, including a lead implementer course, are one way to show that.
Many Irish SMEs use a mix: an internal owner who has done a course, an external ISO consultant for the management system work, and their IT provider for the technical controls and evidence. That split often works out cheaper than trying to do it all in-house.
Where ERS fits
ERS does not provide ISO 27001 training or certification, and does not hold ISO 27001 itself. ERS holds Cyber Essentials certification and is a member of Cyber Ireland. Our part in an ISO 27001 project is the technical side your new lead implementer will need help with:
- MFA, admin accounts and access reviews through Microsoft 365 monitoring.
- Device encryption and remote wipe through mobile device management.
- Patching, logging and 24/7 managed detection and response.
- Tested backup and disaster recovery.
- Staff user awareness training, with records auditors accept.
ERS quotes per business after a short call. Contact us or call 01 885 9500.