ISO 27001 Certificate Without an External Audit: What You Get

Yes. An ISO 27001 certificate without an external audit exists, and it rests on your own self-assessment. It suits some purposes well and others not at all. Because nobody else checks your answers, preparation decides whether the result reflects how your business actually works.

What "without an external audit" really means

Two different things go by the name ISO 27001 certificate.

The classic route starts with a certification body that sends auditors to your company. They go through your documents, interview your staff and check your controls, then issue the certificate. It takes months, and surveillance audits follow at regular intervals.

The second route is a self-assessment. You work through a structured assessment of your information security practice against the requirements of ISO 27001:2022. If you pass, a certificate is issued. No auditor visits you.

Zertify offers the second kind. G6 Agency AG issues the certificates under licence from SICE (Swiss Institute of Certification and Education), and SICE reviews every assessment before a certificate goes out. Anyone can verify a certificate publicly on zertify.ch.

What ISO 27001:2022 asks of a company

ISO 27001 is the international standard for an information security management system, shortened to ISMS. It prescribes no products or tools. It asks you to run information security as a managed process.

The standard follows the high level structure shared by most ISO management system standards:

• Clause 4, Context of the organization: understand your business, your interested parties and the scope of your ISMS.
• Clause 5, Leadership: management commits to the topic, sets an information security policy and assigns roles.
• Clause 6, Planning: assess information security risks, decide how to treat them and set objectives.
• Clause 7, Support: provide resources, competence, awareness, communication and documented information.
• Clause 8, Operation: carry out the risk assessment and risk treatment you planned.
• Clause 9, Performance evaluation: monitor, run internal audits and hold management reviews.
• Clause 10, Improvement: correct problems and keep improving.

Annex A of the 2022 edition lists 93 controls in four themes: organizational, people, physical and technological. You compare them with your own risks and record in a Statement of Applicability which ones apply.

Skipping the external audit changes none of this. The standard stays the same; only the party that checks your work differs.

What a self-assessment certificate proves

The certificate states that your company went through a structured review against ISO 27001:2022 and passed it on the basis of your own answers. That counts in four situations.

• You have to review properly. Many small businesses have never written down who is responsible for security, which assets matter or what happens after an incident. The assessment makes you do it.
• Customers get a clear signal. A client who sends you a security questionnaire sees that you have worked through a recognised standard.
• You get a baseline. Gaps show up early, so you can close them before a larger customer or a regulator asks.
• It takes far less time. No audit scheduling, no on-site visit, no waiting for an auditor's calendar.

What it does not prove is that an independent party tested your controls on site. Say so plainly, to yourself and to your customers.

When you need an on-site audit instead

In some cases a self-assessment certificate is the wrong tool. Go the classic route, with an on-site audit by a certification body, when:

• a tender document requires an on-site audit by a certification body;
• a customer contract demands a certificate from a certification body after an on-site audit;
• a regulator or supervisory authority expects independent certification;
• you work in a sector where buyers routinely ask for an on-site audit, such as large public procurement or finance;
• you handle data where independent assurance is part of your duty to the client.

Read the requirement word by word. A phrase such as "audited on site by a certification body" rules out a self-assessment certificate. Ask the customer early and you avoid a failed bid.

If none of these applies, the self-assessment route is a sensible first step. Our guide to ISO certification without an audit compares it across standards.

Who uses this route

Mostly small and medium businesses, agencies and start-ups. Typical cases:

• a software start-up that wants to show structured security practice to its first customers;
• an agency that handles client data and keeps answering the same security questionnaire;
• a small consultancy that wants to organise its own practice before it grows;
• a company that plans to take the classic route with an on-site audit later and wants a head start.

For that last company, the self-assessment is preparation. Scope, risks and policies carry over to the on-site audit.

Checklist: prepare before you start the assessment

Have the basics ready before you open the assessment.

• Define the scope: which locations, teams, systems and services your ISMS covers.
• Name who is responsible for information security in your company.
• Write a short information security policy approved by management.
• List your key information assets: customer data, source code, devices, cloud services, suppliers.
• Identify the main risks to those assets and note how you handle each one.
• Review the Annex A controls and record which apply and which do not, with a reason.
• Check access control: who has access to what, and how access is removed when people leave.
• Check backups, patching and malware protection, and how you know they work.
• Define how staff report incidents and what happens next.
• Review key suppliers and cloud providers for security.
• Plan awareness: how staff learn about security rules.
• Schedule an internal review and a management review.

Perfect answers are not required, honest ones are. Where you find a gap, note it and plan the fix.

How Zertify fits in

You answer the questions online, and the assessment checks your answers against the requirements of ISO 27001:2022 Information Security Management.

1. Open the assessment and answer the questions about your organisation.
2. Pass the assessment.
3. Pay the fee for the first year. The current fee is on the pricing page.
4. Receive your certificate from G6 Agency AG within 4 hours.

The certificate is valid for three years and is confirmed each year by a short online re-audit. It runs as a yearly subscription: the first year at the full price, every following year at a lower yearly fee. You can cancel at any time for the end of the year.

What it documents is a completed self-assessment against the standard, nothing beyond that. As a quick signal to customers and a base for further work, it does the job.

Be honest in the assessment

Nobody audits your company on site, so the quality of the outcome is up to you. Four habits help.

Answer for the company as it is today. Leave out what you plan for next quarter. If a control is not in place yet, say so and put it on your list.

Keep evidence. Policies, access lists, backup logs and training records are worth having even if nobody asks. If a customer does ask later, you can hand them over.

Involve management. Clause 5 requires leadership to take part. In a small company that usually means the owner reads the policy and signs it.

Review regularly. An ISMS is not a project you finish once. Clauses 9 and 10 call for monitoring, internal audits, management reviews and improvement, and for a small team a yearly review is a reasonable minimum.

What to tell your customers

Describe the certificate as it is. Your company completed a self-assessment against ISO 27001:2022 and on that basis holds a certificate issued by G6 Agency AG under licence from SICE. Do not suggest that an auditor visited you. Customers who understand the difference usually trust you more for saying it, and those who need an on-site audit will tell you, so you know where you stand.

Summary

An ISO 27001 certificate without an external audit is a self-assessment certificate. It helps you organise your security practice and show it to customers who accept that level of assurance. If a tender, contract or regulator demands an on-site audit, plan for the classic route with a certification body. When unsure, ask whoever requests the certificate before you spend time on either route.