# What ISO 27001 Lead Implementer certification means for your project > An ISO 27001 Lead Implementer builds your ISMS; a Lead Auditor checks it. Hire the wrong role and your certification project stalls. Source: https://fmcybersecurity.com/en/insights/compliance/what-iso-27001-lead-implementer-means-for-your-project/ Locale: English Other locale: https://fmcybersecurity.com/insights/compliance/iso-27001-lead-implementer/ ## Metadata - Date: 2026-06-03 - Author: fredrik-standahl - Topic: compliance - Format: article You are about to spend real money getting ISO 27001 certified, and the first decision is who runs the project. Pick the wrong kind of specialist and you pay for months of effort that does not move you toward a certificate. The title on the CV matters here, because two ISO 27001 credentials sound almost identical and do opposite jobs. Across compliance projects this year I keep seeing the same mix-up at the hiring stage. A firm wants to get certified, so it brings in an auditor, then wonders why nobody is building anything. The person they needed was a Lead Implementer. This article explains the difference so you spend your budget on the right role. ![Lead Implementer, FM CyberSecurity](../../../assets/news/what-iso-27001-lead-implementer-means-for-your-project-inline.png) ## What an ISO 27001 Lead Implementer does An ISO 27001 Lead Implementer is the person who builds your information security management system, the ISMS for short. The ISMS is the set of policies, roles, and routines that decide how your company protects its data and proves it does so. The certification body PECB defines the Lead Implementer role as one that "design[s], implement[s], and maintain[s]" that system, [in its breakdown of the two credentials](https://pecb.com/en/article/iso-iec-27001-certification-levels-lead-auditor-vs-lead-implementer). In plain terms, this is the builder. A Lead Implementer runs the risk assessment, writes the policies, sets up the controls, and gets your staff using them. They are hands-on inside your company for the length of the project. When the external auditor finally arrives, the Lead Implementer is the reason there is a working system to inspect. This is the role you hire for a certification project. If your goal is a certificate you do not yet have, you need someone to build the thing first. For most firms that is several months of structured work, and it is the bulk of the cost. ## How a Lead Implementer differs from a Lead Auditor A Lead Auditor checks an ISMS for compliance; a Lead Implementer builds it. PECB puts the auditor's job as one that "assess[s] and audit[s] an organization's ISMS to ensure it complies with ISO/IEC 27001 requirements." The auditor is the inspector, not the builder, and the two roles are deliberately kept separate. That separation is the whole point of certification. The auditor stays independent so the certificate means something to your buyers. A good auditor plans the audit, reviews your documents, tests whether your controls work in practice, and writes up what falls short. They do not write your policies for you, because then they would be auditing their own work. So the practical rule is simple. Bring in a Lead Implementer to get ready for certification. The Lead Auditor shows up at the end, employed by an accredited certification body, to decide whether you pass. If you hire an auditor to run your project, you have hired someone trained to find gaps, not to close them. ## Why the senior tier carries weight The Lead Implementer credential has tiers, and the senior tier signals depth, not just a passed exam. PECB sets four levels for this credential. Provisional Implementer needs no experience. Plain Lead Implementer requires five years of professional experience. The top level, Senior Lead Implementer, [requires at least ten years of work experience](https://pecb.com/pdf/brochures/introducing-new-pecb-certification-schemes.pdf), with most of that in information security and a large block of real ISMS project hours behind it. That experience floor is what you are paying for when you hire at the senior level. ISO 27001 projects rarely go to plan. Scope shifts, a control does not fit how your business runs, the timeline collides with your sales cycle. Someone who has run many of these knows which problems to solve now and which can wait, which is the difference between a project that lands and one that drifts. For a concrete example, my own ISO 27001 designation is the Senior Lead Implementer tier, so it sits behind that ten-year experience requirement. I also hold the CISSP and a NIS2 Senior Lead Implementer designation. I name these because they are the kind of evidence to ask any candidate for: not just which credential, but which tier, and what it took to reach it. ## The decision you have to make The one call to make before you spend a krone is whether you are hiring someone to build your ISMS or to audit it. Those are different people with different credentials, and confusing them is the most common way an ISO 27001 budget gets wasted. For the project itself, you want a Lead Implementer. The auditor comes later and works for someone else. When you screen a [certification consultant](/en/services/iso27001/), ask three things. Which tier of the Lead Implementer credential do they hold, how many full certification projects have they taken to a passed audit, and can they name the certification body behind their designation. The answers tell you whether you are hiring a builder with a track record or a fresh exam pass. If the board has already said yes to certification and you want the ground-level plan, our [ISO 27001 checklist for Norwegian SMBs](/en/insights/compliance/iso-27001-checklist-for-norwegian-smbs/) walks through what to do first and what can wait. And if you are still weighing whether to certify at all, start with [what ISO 27001 is and why tenders require it](/en/insights/compliance/what-iso-27001-is-and-why-tenders-require-it/). ## Next step See FM CyberSecurity's credentials and partner certifications at [our partners page](/en/#partners). Or book a 30-minute board-level conversation with [our compliance practice](/en/services/iso27001/) on who should run your certification project. ## FAQ ### What is an ISO 27001 Lead Implementer? An ISO 27001 Lead Implementer is the specialist who builds your information security management system, the ISMS. They run the risk assessment, write the policies, set up the controls, and get your staff using them. This is the role you hire to get ready for certification, because someone has to build the system before an auditor can check it. ### What is the difference between a Lead Implementer and a Lead Auditor? A Lead Implementer builds and maintains your ISMS; a Lead Auditor checks it for compliance with ISO 27001. The two roles are kept separate on purpose, so the auditor stays independent and the certificate carries weight. For a certification project you hire a Lead Implementer. The Lead Auditor arrives at the end, working for the certification body, to decide whether you pass. ### Which role do I hire to get ISO 27001 certified? You hire a Lead Implementer. Getting certified means building a working ISMS first, and that is the implementer's job. The Lead Auditor is not someone you hire for the project at all; they are assigned by an accredited certification body to assess what you built. Hiring an auditor to run your project means hiring someone trained to find gaps, not to close them. ### What does the senior tier of Lead Implementer mean? The PECB Lead Implementer credential has four tiers. The Senior Lead Implementer is the top one, requiring at least ten years of work experience, most of it in information security, plus a large block of real project hours. The tier signals depth and a track record, not just a passed exam, which matters when a certification project runs into the usual surprises. ### What should I ask an ISO 27001 certification consultant? Ask which tier of the Lead Implementer credential they hold, how many full certification projects they have taken to a passed audit, and which certification body issued their designation. The answers separate a builder with a track record from a fresh exam pass. Tier and project count tell you more than the credential name alone. --- For the full documentation index, see https://fmcybersecurity.com/llms.txt For the complete corpus as a single document, see https://fmcybersecurity.com/llms-full.txt