ISO 22301

What is on the PECB ISO 22301 Lead Implementer exam?

Seven proportional bars for ISO 22301 Lead Implementer: Fundamentals 8, Requirements 7, Planning 18, Implementation 18, Monitoring 12, Improvement 10, Audit prep 7. Implementation, Monitoring and Improvement are gold. Pass mark: 70%.

The PECB ISO 22301 Lead Implementer exam is 80 multiple-choice questions in three hours, open book, with a 70% pass mark: 56 correct answers. Its weight sits in the middle of a business continuity management system's life. Planning and implementation carry 18 questions each, and the 40 questions tested at the evaluation level all come from implementing, monitoring and improving the system.

80Questions
3 hrsTime
70%To pass (56)
OpenBook

Every fact below comes from PECB's own documents: the ISO 22301 Lead Implementer Candidate Handbook, version 1.5, the course page and the List of PECB Exams, all read on 2 October 2026.

How is the ISO 22301 Lead Implementer exam structured?

PECB lists the English exam as three hours, multiple choice, open book, 80 questions. It is the last day of a five-day course. The four teaching days cover starting a business continuity management system (BCMS), the implementation plan, the implementation itself, and then performance evaluation, continual improvement and preparation for the certification audit. You can sit the exam online through the PECB Exams application, with an invigilator watching through your camera, or on paper through the partner that ran your course.

Exam fact

The paper mixes two kinds of question. Stand-alone questions test one idea on its own. Scenario-based questions come in sets of five, all about one short case. Every question has three options, one correct and two distractors, and every question is worth one point.

PECB Candidate Handbook, ISO 22301 Lead Implementer, v1.5

Which domains carry the most questions?

The handbook publishes the count for each of the seven competency domains, so you can plan from the real weights.

Comprehension, application, analysisEvaluation

DomainQuestionsShareTests
1. Fundamental principles and concepts of a BCMS810%Comprehension
2. BCMS requirements78.75%Comprehension
3. Planning a BCMS implementation based on ISO 223011822.5%Comprehension
4. Implementing a BCMS based on ISO 223011822.5%Evaluation
5. Monitoring and measurement of a BCMS1215%Evaluation
6. Continual improvement of a BCMS1012.5%Evaluation
7. Preparation for a BCMS certification audit78.75%Comprehension
Total80100%40 and 40

Want it on one page? Our free ISO 22301 Lead Implementer mind map gives the seven domains with a mnemonic, and the 10-question quiz checks your recall in five minutes.

The split at the bottom is even: 40 questions test comprehension, application and analysis, and 40 test evaluation, judging which option is right for the organization in front of you. Look at where the evaluation questions sit. Planning is tested at the comprehension level, so you need to know what a scope, a policy and a gap analysis are for. Implementation, monitoring and improvement are tested at the evaluation level, so you need to choose between plausible actions. That is a different shape from the ISO 42001 Lead Implementer exam, where planning is the heaviest evaluation domain.

Watch the names

PECB's course page names domain 2 "Initiation of a BCMS implementation" and domain 5 "Evaluation of the performance of a BCMS based on ISO 22301." The handbook, which publishes the counts, calls them "Business continuity management system (BCMS) requirements" and "Monitoring and measurement of a BCMS based on ISO 22301." We follow the handbook. If your course materials use the other names, the counts above still apply in the same order.

What does domain 4 actually test?

Domain 4 is the heaviest domain tested at the evaluation level, and its competencies in the handbook read like a business continuity program from the inside: plan and conduct a business impact analysis (BIA) and present its report; run a risk assessment; choose business continuity strategies and solutions; evaluate the business continuity capabilities of suppliers; write the business continuity plan and procedures; set up incident management; draft an emergency response program; develop a crisis management plan; and define, run and evaluate exercises and tests.

The BIA comes first in that list, and the rest depends on it. If you have never run one, practice on paper before the course. Our worksheet uses the time terms from NIST SP 800-34, the US federal contingency planning guide, which notes that the recovery time objective must normally be shorter than the maximum tolerable downtime.

Business impact analysis worksheet

Business impact analysis (BIA) worksheet

A blank worksheet for practicing a business impact analysis, the first competency in domain 4 of PECB's ISO 22301 Lead Implementer exam ("Ability to plan and conduct a business impact analysis (BIA)", Candidate Handbook, version 1.5, read on 2 October 2026). The columns are our suggestion. The time terms follow NIST Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems; your course and ISO 22301 may name them differently, so use the names your course uses. This worksheet does not reproduce ISO 22301.

1. The activity

FieldYour answer
Activity or process
Owner
What it delivers, and to whom
When it matters most (month end, peak season, a deadline)

2. Impact over time

Rate each impact if the activity stopped completely: 0 none, 1 minor, 2 significant, 3 severe. Write one line on why.

Time since disruptionFinancialCustomersLegal or regulatoryReputationStaff and safetyWhy
4 hours
1 day
3 days
1 week
2 weeks
1 month

Change the time bands to suit the activity. A payments process may need minutes; a quarterly report may need weeks.

3. The three numbers

Term (NIST SP 800-34)What it meansYour figure
Maximum tolerable downtime (MTD)The total time the business will accept the activity being disrupted, all impacts considered
Recovery time objective (RTO)The longest a resource can stay unavailable before the impact on the activity, and on the MTD, becomes unacceptable
Recovery point objective (RPO)The point in time before the disruption to which data can be recovered; it measures how much data loss the activity can tolerate

Check: NIST notes that the RTO must normally be shorter than the MTD. If yours is not, the recovery plan cannot meet the business need.

4. What the activity depends on

DependencyType (people, site, IT system, data, supplier, partner)Workaround if it failsWorkaround lasts how long

5. Minimum to keep going

FieldYour answer
Lowest level of output the business could accept during a disruption
Staff needed at that level
Systems and data needed at that level
Who must be told, and how fast (customers, regulators, partners)

6. Sign-off

FieldYour answer
Reviewed by the activity owner
Date
Next review

Credential Press is independent of PECB and ISO. This worksheet is a study aid, not a substitute for your organization's BIA method.

What does a 70% pass mark mean in practice?

70% of 80 one-point questions is 56. You can get 24 wrong and still pass, so a scenario set that goes badly costs at most five and does not decide the result.

Watch the clock

180 minutes over 80 questions averages 2 minutes 15 seconds each, and scenario sets eat into that because you read the case before you answer anything. If English is not your first language, ask on the day: PECB allows 30 extra minutes on Lead exams.

What can you take into the exam?

PECB rule

PECB allows three things: a hard copy of the ISO 22301 standard, your training course materials, and the personal notes you took during the course, in the PECB Exams app or printed. Online, phones, tablets and any second device are banned; on paper, you get the paper and a pen. Bring a national ID card, driver's license or passport, and be there 30 minutes early, because late arrivals get no extra time.

PECB Candidate Handbook, ISO 22301 Lead Implementer, v1.5

Our suggestion

Domain 2 covers the requirements in clauses 4 to 10, and the standard is on your desk, so tab those clauses and practice finding them. Our guide to PECB's open-book exam rules shows how to tab the standard and your course notes.

PECB ISO 22301 Lead Implementer exam-day checklist

PECB ISO 22301 Lead Implementer: exam-day checklist

Rules come from PECB's ISO 22301 Lead Implementer Candidate Handbook, version 1.5 (2026), read on 2 October 2026. Suggestions are marked as ours. Check PECB's Exam Rules and Policies page before your exam in case anything has changed.

The week before

  • Book the exam: online through the PECB Exams application, or on paper through the PECB partner that ran your course (PECB rule)
  • Need special arrangements (dyslexia, ADHD, vision impairment, pregnancy, recent surgery)? Apply through the myPECB dashboard before the day (PECB rule)
  • Print or download your course materials and notes so you can reach them quickly in the exam
  • Tab your hard copy of ISO 22301 by clause, 4 to 10 (our suggestion)

What you may use in the exam (open book)

  • A hard copy of the ISO 22301 standard
  • Your training course materials, through the PECB Exams app or printed
  • Any personal notes you took during the training course, through the app or printed

On the day

  • Be there, or logged in, at least 30 minutes before the start. Late arrivals get no extra time and may not be allowed to sit (PECB rule)
  • Bring a valid ID: national ID card, driver's license or passport (PECB rule)
  • Online: no phones, tablets or other second devices; a PECB invigilator watches through your camera (PECB rule)
  • Paper: only the exam paper and a pen; no electronic devices (PECB rule)
  • Sitting in a language that is not your first? Ask on the day for 30 extra minutes, which PECB allows on Lead exams (PECB rule)

Pace

WhatFigure
Questions80, multiple choice, three options each
Time3 hours (180 minutes)
Average per question2 minutes 15 seconds
Pass mark70%, which is 56 correct answers
Scenario setsone scenario, five questions
Heaviest domainsPlanning and implementing a BCMS, 18 questions each

After

  • Online exam: your result arrives straight away. Paper multiple choice: two to four weeks (PECB)
  • If you do not pass, the email lists the domains where you scored poorly (PECB)
  • Disagree with the result? Ask for a re-evaluation within 30 days of receiving it (PECB)

Where does the law come into a business continuity exam?

In domain 1. Its first knowledge statement is the business continuity "laws, regulations, international and industry standards, contracts, market practices, internal policies, etc., an organization must comply with." The handbook names no particular law. It asks you to know the kinds of obligation a BCMS has to answer to.

A UK example shows the kind of duty it means. Section 2 of the Civil Contingencies Act 2004 requires the bodies it lists to maintain plans so that "if an emergency occurs the person or body is able to continue to perform his or its functions." The government's Emergency Preparedness guidance gives business continuity management a chapter of its own. Certification belongs to organizations: the University of Surrey announced in 2018 that it had been certified to ISO 22301 for all areas of service provision. A Lead Implementer credential certifies you, the person who can build such a system.

How should you split your revision?

Start from the weights. Planning (18) and implementation (18) are 36 questions, 45% of the paper. Give planning the hours its count earns, and spend them on knowing each planning output and why it comes in that order: the context, the scope, top management's role, the policy, objectives, resources, competence, the communication plan, documented information and the gap analysis. Give implementation the same hours, spent mostly on practice questions, because it is tested at the evaluation level.

Monitoring and measurement (12) and continual improvement (10) are the other two evaluation domains: 22 questions on internal audit, nonconformities, management review, root causes and corrective action. Domain 1 (8), domain 2 (7) and audit preparation (7) close the paper. For audit preparation, know the difference between stage 1 and stage 2 audits, surveillance and recertification, and a certification recommendation and the certification decision.

Our ISO 22301 study plan turns those counts into hours. The ISO 22301 exam study guide maps every chapter to one of the same seven domains and is written for the 80-question multiple-choice format. For practice, the 212 ISO 22301 practice questions come with full rationales, weighted to the published counts.

What happens after you pass?

The exam opens the door; your experience decides which credential you get. PECB issues four implementer credentials from the same exam:

CredentialProfessional experienceBCMS project activities
Provisional ImplementerNoneNone
Implementer2 years, 1 in business continuity management200 hours
Lead Implementer5 years, 2 in business continuity management300 hours
Senior Lead Implementer10 years, 7 in business continuity management1,000 hours

Each one also requires you to sign the PECB Code of Ethics. PECB's course page gives examples of the project activities that count: drafting a BCMS plan, initiating, implementing, monitoring and managing a BCMS implementation, and continually improving a BCMS.

What if you do not pass?

Online, the result is instant; on paper it takes two to four weeks. If you fail, the email names the domains where you scored poorly, and you can ask for a re-evaluation within 30 days. There is no limit on retakes, though PECB sets minimum gaps between attempts, and the course page says candidates who completed the course but failed can retake once for free within 12 months of the first attempt. Our guide to PECB results and retakes has the detail.

What should you do this week?

Print the checklist, work one BIA on the worksheet, and sit one timed set of questions before day five so the pace is not a surprise. Credential Press is independent of PECB and ISO. Nothing here comes from inside the exam, and PECB's handbook is clear that disclosing exam content breaks its Code of Ethics.

Frequently asked questions

How many questions are on the PECB ISO 22301 Lead Implementer exam?

80 multiple-choice questions in three hours. Each question has three options and one correct answer, and some come in sets of five that share a scenario.

What is the pass mark for the ISO 22301 Lead Implementer exam?

70%. Each question is worth one point, so you need 56 of the 80 right and can miss 24.

Is the PECB ISO 22301 exam open book?

Yes. PECB allows a hard copy of the ISO 22301 standard, your training course materials and the notes you took during the course, either in the PECB Exams app or printed.

Which domains carry the most questions?

Planning a BCMS implementation and implementing a BCMS, with 18 questions each. Together they are 36 of the 80, 45% of the paper. Implementation is tested at the evaluation level; planning is not.

Do I need business continuity experience to sit the exam?

No. PECB's Provisional Implementer credential needs the exam and no experience. The Lead Implementer credential needs five years of professional experience, two of them in business continuity management, and 300 hours of BCMS project activities.

What happens if I fail?

The results email lists the domains where you scored poorly, and you can ask for a re-evaluation within 30 days. PECB's course page says candidates who completed the course but failed can retake once for free within 12 months of the first attempt.

Which books prepare you for this exam?

Cover of ISO 22301 Lead Implementer Exam Guide

ISO 22301 Lead Implementer Exam Guide

A study companion for the PECB Certified ISO 22301 Lead Implementer examination. 13 chapters, 345 pages.

Cover of ISO 22301 Lead Implementer Practice Questions

ISO 22301 Lead Implementer Practice Questions

Practice questions with full rationales, weighted to the published domains. 228 pages.