PECB-accredited certification delivered by reconn, an AI-first cybersecurity company. Taught by practitioners with 20+ years on both the offensive and defensive side of security, and hands-on ISO 27001 implementation inside live organizations. Self-paced for working professionals, Arabic courseware available, interest-free installments, and live corporate cohorts across the Kingdom.
Prefer to spread it out? SAR 845 per month for 4 months with Tabby or Tamara, arranged over email or WhatsApp. Terms and conditions apply.
ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS), and the most widely certified security management standard in the world. It is what an accredited certification body audits your organization against, and what enterprise customers, regulators and procurement teams ask for by name.
In Saudi Arabia, security obligations arrive through several instruments at once: the NCA Essential Cybersecurity Controls for government entities and critical national infrastructure, the SAMA Cyber Security Framework in financial services, the Personal Data Protection Law administered by SDAIA, the CITC framework for telecom and ICT, and NCA's cloud, data and critical systems controls on top. Both the NCA and SAMA frameworks draw on ISO 27001 among their source standards, so a certified ISMS is not a parallel effort. It is the structure the Saudi control catalogues map onto.
This page covers PECB-accredited certification training from reconn, an AI-first cybersecurity company and PECB Training Partner, across three paths: Lead Auditor (plan and conduct audits of an ISMS), Lead Implementer (design, build and operate an ISMS), and the bundle covering the full ISMS lifecycle. Single certifications are $899 USD all-inclusive and the bundle is $1,699 USD. Every package includes 2 exam attempts per certification, and all three are available self-paced, in Arabic, on interest-free installments via Tamara or Tabby, or as a live corporate cohort.
Certification Paths
Same standard, same exam body, different job to be done. Pick by the role you will hold once the ISMS is live, not by the certificate name.
Plan, conduct and manage independent audits of an information security management system using ISO/IEC 27001 and ISO 19011 methodology. Built for internal audit, assurance, and third-party assessment roles.
Both certifications together. Design and run the ISMS, then audit it independently. Most security and GRC professionals end up needing both sides, and the bundle saves $99 against buying them separately.
Design, build, implement and maintain an information security management system. Covers scope definition, risk assessment and treatment, the Statement of Applicability, and Annex A control design inside your own organization.
Included In Every Package
Not sure which one to take? Take Lead Implementer if you will build or run the ISMS, own the risk assessment, or write the Statement of Applicability. Take Lead Auditor if you assess it, whether internally, for a certification body, or across your suppliers. If both are on your horizon, the bundle is the cheaper route. Ask us on a thirty-minute call if you want a straight answer for your role.
Delivery Formats
Three delivery formats, all carrying the same accredited course and the same PECB exam. The difference is how you study it, how you pay for it, and who you sit it with. The fourth is what happens after the certificate.
Fully online through the official PECB platform. 400+ pages of courseware, recorded lectures, interactive quizzes and case studies, 2 exam vouchers, 31 CPD credits, one free one-hour live session with the trainer, unlimited WhatsApp and email support, and the first year's PECB Annual Maintenance Fee. Arabic courseware is available if you would rather study in Arabic than English. Access opens the same day you buy.
The same $899 course, split into four interest-free monthly payments of approximately SAR 845 through Tabby or Tamara. It is not available at online checkout. Email hello@reconn.io or WhatsApp +971 58 572 6270 with your preferred provider and we will set it up. Course access is granted on confirmation, not after the final payment clears. Terms and conditions apply.
Set up a planTwo live options. Private mentorship runs one-to-one with the lead trainer at $2,499 per certification, Lead Auditor or Lead Implementer, scheduled around your calendar. Corporate cohorts are real-time, instructor-led sessions for a private team, commonly run 7 to 10 PM KSA so daytime operations keep moving, or on whatever schedule suits your people. Best for teams of five or more who want structure and direct trainer interaction. Includes official certification and SAP Ariba compatible invoicing for government and enterprise procurement.
Request a quoteCertification proves competence. Standing up a certifiable ISMS is a separate piece of work. The same team runs ISO 27001 gap assessments, risk assessments, Statement of Applicability development, internal audit and Stage 1 and Stage 2 readiness for clients across Saudi Arabia and the wider Middle East, so training and implementation do not come from two different playbooks.
Talk it throughPayment Options
If paying in one go does not suit your budget or your approval cycle, the course is available on an interest-free installment plan through Tabby or Tamara, the two buy-now-pay-later providers most widely used in the Kingdom.
How To Set It Up
Email hello@reconn.io or WhatsApp +971 58 572 6270. Tell us which certification and language you want, and whether you prefer Tabby or Tamara.
We set the installment plan up with your chosen provider and send you the payment link directly. Approval sits with Tabby or Tamara, not with us.
Course access opens the same day the plan is confirmed. You do not wait until the fourth payment clears to begin studying.
Buying for a team or through a procurement department? Installments are for individual learners. Corporate cohorts are invoiced directly, ZATCA-compliant and SAP Ariba compatible.
Installments are not available at online checkout. The plan is arranged manually, so you must contact us to use it. Email hello@reconn.io or WhatsApp +971 58 572 6270 and we will take it from there. Terms and conditions apply.
What's Covered
Both courses run four days of instruction building toward the official exam on day five, PECB's standard structure, taught against ISO/IEC 27001:2022. Self-paced means you set the calendar, not that the syllabus shrinks.
Design, build and operate the ISMS.
Plan, conduct and lead audits of the ISMS.
PECB grades both credentials by experience as well as exam performance. Everyone sits the same exam; the title awarded (Provisional, standard, Lead or Senior Lead) depends on the professional and audit or project experience you submit alongside it, per PECB's certification policies.
The Saudi Context
Saudi Arabia regulates information security through several binding instruments rather than one act. Each sits at a different level of governance, and an ISMS is what ties them together.
The National Cybersecurity Authority's ECC is mandatory for government entities and for organizations that own, operate or host critical national infrastructure. It draws on ISO 27001 among its source standards, which is why a certified ISMS carries so much of the evidentiary load in an ECC assessment.
Mandatory for banks, insurers, finance companies, credit bureaus and financial market infrastructure supervised by the Saudi Central Bank. Built on ISO 27001, NIST and PCI DSS, and assessed against a maturity model. If you are regulated by SAMA, ISO 27001 is effectively the substrate.
A binding data protection statute administered by SDAIA, governing how personal data is collected, processed, transferred and secured. Its security safeguard obligations land squarely inside Annex A: access control, cryptography, logging, supplier management and incident response.
The CITC Cybersecurity Regulatory Framework for telecom and ICT, NDMO data governance standards, and NCA's cloud, data and critical systems controls each add obligations on top. An ISMS gives you one control set to answer several regulators instead of several parallel compliance efforts.
ISO 27001 does not replace any of these. It gives you the management system that makes them demonstrable: a defined scope, a risk assessment and treatment plan, a Statement of Applicability, monitored controls, internal audit and management review. That is what a certification body, a regulator and a procurement team all ask to see, and because NCA ECC and the SAMA framework both derive from ISO 27001, much of the underlying control work is shared rather than duplicated.
Trainer Comparison
ISO 27001 is the most commoditized certification in security training, which means most of the market delivers the PECB curriculum without ever having stood up an ISMS or sat on the other side of a Stage 2 audit. The team teaching your course here is the team implementing and auditing these systems for clients, this week.
| Dimension | reconn | Typical training provider |
|---|---|---|
| Practitioner status | Active ISMS builder. Designs, implements and audits ISO 27001 systems for clients in production. | Teaches the standard from slides. Rarely implements a full ISMS end to end. |
| Implementation track record | Personally designed and deployed information security management systems across banking, healthcare, government and technology. | Theoretical grounding, with case studies drawn from the training material. |
| Annex A depth | Technological controls taught from hands-on offensive and defensive work, so you learn how controls fail before you learn how to word them. | Covers Annex A clause by clause. Limited practical attack and defense experience behind it. |
| Exam scenarios | Taught from implementation problems met in live organizations, so scenario questions map to contexts you will recognize. | Uses PECB sample scenarios, which may not reflect real implementation complexity. |
| Trainer access | Direct email and WhatsApp access to the founder and lead trainer. No support queue, no coordinators. | Support routed through coordinators, with trainer access limited to scheduled office hours. |
| Saudi regulatory context | Maps ISO 27001 clauses and Annex A controls to NCA ECC, SAMA CSF, PDPL, CITC CRF and NDMO in depth. | Generic governance framing. Saudi-specific coverage varies by provider. |
| Language | Arabic courseware available alongside English, French, German, Spanish and Brazilian Portuguese. | Commonly English only, with Arabic offered as a paid custom cohort if at all. |
| ZATCA and procurement | ZATCA-registered non-resident VAT provider, with SAP Ariba compatible invoicing for government procurement. | No direct Saudi procurement integration. Manual invoice handling and waivers. |
| Credentials | PECB Certified Trainer, CAIP (Certified AI Implementer Professional), ISO/IEC 42001 Senior Lead Implementer. Verifiable on the PECB registry and Credly. | PECB trainer status held. Depth beyond the syllabus varies widely. |
The exam and the credential are identical whoever trains you. What changes is whether you leave the course able to build the thing, or only able to describe it.
Who Delivers This
reconn is an AI-first cybersecurity company based in Dubai, UAE, founded and led by Shenoy Sandeep, and officially recognized as a PECB Training Partner. Every session is delivered by people with hardcore cybersecurity backgrounds on both the offensive and defensive side, and hands-on experience implementing ISO 27001, ISO 27701, ISO 22301 and ISO 42001 inside live organizations.
Before founding reconn, Shenoy led the Middle East, Turkey and Africa region for Cyble, a YC-backed threat intelligence platform that scaled through Series B, building the regional distribution and go-to-market function from zero and supporting 25+ technology vendors across MEA. That means both sides of the table are familiar: the vendor selling security assurance, and the buyer being asked to prove it.
The same team that delivers your training implements ISO 27001 ISMS for clients across Saudi Arabia and the wider Middle East, and runs offensive security engagements against the controls those systems rely on. What you learn reflects what actually gets built and what actually breaks, not only what the standard says on paper.
Credentials
For Learning & Development Teams
Government agencies and enterprises across the Kingdom appoint reconn as their ISO 27001 training partner for one reason: the team actually implements the standard it teaches.
The curriculum is carried by real ISO 27001 work in banking, healthcare and government. When your team hits a scoping, risk or Statement of Applicability question in your own ISMS, it is usually a question the trainer has already solved somewhere else.
Questions go to Shenoy Sandeep, founder and PECB Certified Trainer, over email and WhatsApp. No support queue, no coordinator, no "someone will get back to you." That access continues after the course ends.
NCA ECC, SAMA CSF, PDPL, CITC and NDMO are mapped explicitly against ISO 27001 clauses and Annex A controls. Your team does not need a separate compliance layer bolted on afterward.
ZATCA-registered non-resident VAT provider. Invoices generate as compliant documents and SAP Ariba is supported, so procurement ticks the box instead of raising a manual waiver. Your team enrolls, certifies and starts implementing while other providers are still negotiating paperwork.
Open a Channel
We establish what belongs inside your ISMS scope, where your exposure sits across Saudi Arabia's regulatory framework (NCA ECC, SAMA CSF, PDPL, CITC, NDMO), and whether ISO 27001 certification is genuinely worth pursuing for your organization right now. If the honest answer is "not yet", you will hear that.
You speak to the person who would do the work.
Questions
ISO/IEC 27001 itself is a voluntary international standard. What is mandatory is the underlying security obligation: NCA Essential Cybersecurity Controls for government entities and critical national infrastructure, the SAMA Cyber Security Framework for regulated financial institutions, the Personal Data Protection Law for anyone processing personal data, and the CITC framework for telecom and ICT. ISO 27001 is the management system most Saudi organizations use to satisfy and evidence those obligations under one auditable structure, and it is what enterprise customers and procurement teams ask for by name.
Both Saudi frameworks draw on ISO/IEC 27001 among their source standards, so the underlying control work overlaps heavily. A certified ISMS gives you the scope definition, risk assessment, Statement of Applicability, internal audit and management review that NCA and SAMA assessors both expect to see. You still map to the Saudi control catalogues explicitly, but you are mapping an existing system rather than building three parallel compliance programs. That mapping is taught in the course.
Four to six weeks to earn your personal PECB certification with consistent study alongside a full-time job, or roughly five days taken intensively. Organizational certification is a different timeline: certifying your ISMS through an accredited certification body typically runs 6 to 12 months from gap assessment through Stage 1 and Stage 2 audits, depending on the scope, the number of sites and systems, and how much of your control environment already exists.
Approximately SAR 3,375 for a single certification and SAR 6,375 for the bundle at current USD/SAR rates. The exact SAR amount is calculated at checkout based on your location and payment method. All invoices are ZATCA-compliant and include the relevant Saudi VAT treatment.
Yes. Arabic courseware is available for Lead Auditor, Lead Implementer and the bundle, alongside English, French, German, Spanish and Brazilian Portuguese. You select your language at checkout, and not every language is offered on every delivery format, so if Arabic is essential for your team check with us first and we will confirm before you buy. Arabic-language live corporate cohorts can also be arranged.
Yes. An interest-free installment plan is available at approximately SAR 845 per month for 4 months through Tabby or Tamara. It is not offered at online checkout, so to set it up email hello@reconn.io or WhatsApp +971 58 572 6270 with your contact details and preferred provider. Course access is granted on confirmation, not after the last payment clears. Terms and conditions apply.
Two exam vouchers are included in the course price, both to be used within 12 months of enrollment. If you do not pass on the first attempt, the second costs nothing extra, and you get unlimited email and WhatsApp support in between to work out where the gaps are. The bundle includes four vouchers in total, two per certification.
Yes. The exam is fully online and proctored, taken from home, the office, or anywhere with a reliable connection. No test center visit is required. You schedule the slot yourself through the official PECB Exam Portal.
Yes. reconn is ZATCA-registered as a non-resident VAT provider for Saudi Arabia. All invoices comply with ZATCA requirements, and SAP Ariba is supported for Saudi government agencies and enterprise procurement teams.
Lead Implementer if you will build or run the ISMS inside your organization, own the risk assessment, or write the Statement of Applicability. Lead Auditor if you sit in internal audit or assurance, work for a certification body, or assess information security across your suppliers. If both are in your future, the bundle costs less than buying the two separately.
Yes. Live instructor-led online cohorts run for private corporate teams, commonly 7 to 10 PM KSA so daytime operations are not disrupted, or on a custom schedule. One-to-one private mentorship is also available at $2,499 per certification, Lead Auditor or Lead Implementer. Cohort pricing is quoted per group based on size, and invoicing works through SAP Ariba where you need it. Request a quote.
ISO/IEC 27001:2022, the current edition, with Annex A restructured into 93 controls across four themes: organizational, people, physical and technological. The transition period from the 2013 edition closed in October 2025, so all new and recertified ISMS audits are conducted against the 2022 edition. If your organization is still carrying 2013-era documentation, that gap is one of the things worth raising on a consultation call.
