ISO 27001:2022 for companies in Aarau
ISO 27001 in Aarau: certified online, without an auditor on site
If a customer in Aarau or anywhere else asks for ISO 27001 in a supplier questionnaire, you can answer with a certificate instead of a promise. At Zertify you complete a self-assessment in your browser. After you pass and pay, the certificate arrives within 4 hours.
01: Who needs it
Which companies in Aarau ask for ISO 27001?
ISO 27001 is the standard for information security. It matters wherever a company stores, processes or hosts data that belongs to someone else. Aarau is the capital of the canton of Aargau, and companies of all sizes work there. The ones that meet this standard most often fall into a few groups.
- IT service providers and software companies
- Customers want to know how you handle access rights, backups and incidents before they give you access to their systems.
- Cloud and hosting providers
- Your customers' data sits on your infrastructure. The certificate shows that this risk is managed in a defined way.
- Financial service providers
- Banks, insurers and their service providers pass information security requirements down to their suppliers.
- Healthcare and related services
- Patient and health data call for documented protection and clear responsibilities.
- E-commerce and online services
- Customer accounts, addresses and payment data make you a target, and larger buyers ask about it in tenders.
Any other company that handles sensitive customer data can be added to this list. Often the trigger is a single document: a questionnaire from a purchasing department or a tender with a security chapter.
02: Requirements
What ISO 27001:2022 expects from your company
The standard describes an information security management system, short ISMS. Its centre is the risk assessment. It decides which Annex A controls you implement and why. The 2022 edition revised the controls and now covers cloud services, data protection and cyber risks among others.
Assess information security risks
Identify what could go wrong with your information, how likely it is and how serious the damage would be.
Define a security policy and objectives
Management sets out in writing what the company wants to protect and what it aims to achieve.
Implement security controls from Annex A
Choose the controls that answer your risks and put them into practice.
Prepare a Statement of Applicability
The SoA lists which controls apply to you, which do not, and the reason for each decision.
Train and inform employees
People handle the data every day, so they need to know the rules and the reporting channels.
Manage incidents and learn from them
Record security incidents, deal with them and adjust your measures afterwards.
03: Comparison
Classic on-site audit or online route: what changes for a company in Aarau?
The classic route means a certification body sends auditors to your premises. That suits some companies, especially when a customer names this route explicitly. For many small and medium businesses the effort is the real obstacle: dates, preparation days and staff tied up during the visit.
| Aspect | Classic route with on-site audit | Zertify online route |
|---|---|---|
| Where it happens | At your premises, with auditors travelling to you | In your browser, from any desk |
| Basis of the decision | Audit by a certification body | Online self-assessment with 48 yes/no questions, reviewed by SICE |
| Time to certificate | Indicatively several weeks to months, depending on booking and preparation | Within 4 hours after passing and payment |
| Cost | Indicatively several thousand francs, depending on company size and certification body | Fixed and published, see pricing |
| Yearly confirmation | Follow-up audits set by the certification body | Short online re-audit each year |
| Checking the certificate | Depends on the body | Public verification by number and QR code |
Which route your customer accepts is a question for the customer. The guide on the certification routes helps you prepare it.
04: Zertify
How Zertify fits for a company in Aarau
Zertify is an online service. There is no office in Aarau and none is needed: you never travel and nobody visits you. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued.
The price is CHF 849 in the first year, then CHF 569 per year including the yearly online re-audit. The certificate is valid for 3 years. For customers in Switzerland the prices include 8.1% VAT. Details on the standard are on the ISO 27001 page, and the full price model is on the pricing page.
05: Process
From the first question to the certificate: the steps
The self-assessment is free. You need no account to buy the certificate afterwards.
Answer 48 yes/no questions
Thirteen of them are mandatory requirements of the standard. All thirteen must be answered with yes.
Reach the pass mark
Among the other 35 questions, at least 24 need a yes. Gaps you find show you what to fix first.
Pay and receive the certificate
SICE reviews the assessment. After passing and payment, the PDF reaches you within 4 hours.
Show it to your customer
The PDF carries a QR code. Your customer scans it and lands on the public verification page with the certificate number.
Confirm it every year
A short online re-audit keeps the certificate current within its 3 years of validity.
Answer honestly. The questions describe measures your company has to have in place, such as a risk assessment and a Statement of Applicability. If something is missing, build it first and then take the assessment.
06: FAQ
Questions about ISO 27001 in Aarau
07: Guide
Related pages
Check where your company stands on ISO 27001
The self-assessment takes you through the 48 questions and shows which requirements you already meet.
Free and without registration.