ISO 27001 in Basel: certificate fully online

The Basel region is widely known for life sciences, chemicals, banking, logistics and trade fairs. These sectors handle sensitive data and expect the same care from their suppliers. For a smaller company, the request usually shows up as a line in a supplier questionnaire, a tender or a customer audit: do you hold ISO 27001?

The following kinds of business meet this question most often.

IT service providers and software companies

They run systems or process data for other businesses, so customers want proof that access, backups and incident handling are under control.

Cloud service providers

Hosting and SaaS customers compare providers by their security certificates before they sign.

Financial service providers and banks

They must show that their own processes and those of their outsourcing partners protect client data.

Healthcare

Patient data is among the most sensitive data there is, and service providers to clinics and practices are asked how they protect it.

E-commerce and online services

Payment data, customer accounts and order histories make these businesses a target, and larger partners ask about it.

Companies handling sensitive customer data

Consultancies, agencies and trustees often hold confidential documents and are asked for evidence in due diligence.

ISO 27001:2022 sets out how an information security management system (ISMS) is built. At its core is the risk assessment: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among others.

Six requirements make up the working core of the standard.

1. 01

   Assess information security risks

   You identify what could go wrong with your information and rate each risk.

2. 02

   Define a security policy and objectives

   Management states in writing what the ISMS is meant to achieve.

3. 03

   Implement security controls from Annex A

   The risk assessment determines which controls apply to you.

4. 04

   Prepare a Statement of Applicability

   The SoA lists every control, whether you use it, and the reason.

5. 05

   Raise awareness and train employees

   Staff need to know the rules and their own part in them.

6. 06

   Manage security incidents and learn from them

   You record incidents, respond to them and adjust your controls afterwards.

• ISO 27001 at Zertify

Which route fits depends on what your customers ask for. Some tenders name the route explicitly, so read the requirement before you decide.

• Compare the certification routes
• Certification without an on-site audit

Zertify has no office in Basel and does not need one. The assessment, the review and the delivery of the certificate all happen online. You can buy without creating an account.

The certificate is based on your self-assessment and is issued by G6 Agency AG under licence from SICE. SICE reviews every assessment before the certificate is issued. It is valid for 3 years and confirmed each year by a short online re-audit.

The price is CHF 849 in the first year, then CHF 569 per year including the online re-audit. Both amounts include 8.1% Swiss VAT. The subscription renews automatically each year and you can cancel it at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. If you certify against two standards, you get 20% off, and from three standards 30%, also on the yearly fee.

• ISO 27001 standard page
• Pricing
• Start the free self-assessment

The self-assessment contains 48 questions. Thirteen of them are mandatory requirements of the standard, and all thirteen must be answered yes. Of the other 35 questions, at least 24 need a yes.

1. 01

   Gather your documents

   Have your security policy, risk assessment and Statement of Applicability to hand, so you can answer from fact and not from memory.

2. 02

   Answer the 48 questions

   Start the assessment free of charge. You can see straight away where you stand.

3. 03

   Close any gaps

   If a mandatory requirement is missing, fix it in your company first, then answer again.

4. 04

   Pass and pay

   Once you meet the pass criteria, you pay the first-year price.

5. 05

   Receive the certificate

   The PDF reaches you within 4 hours after passing and payment.

• How it works

Every certificate carries a number and a QR code on the PDF. Anyone who scans the code or enters the number on the public verification page can check that the certificate is genuine. A purchasing department in Basel or elsewhere can do this in a minute, without writing to you.

Attach the PDF to a supplier questionnaire, quote or tender, and name the verification page in your reply. Each year the short online re-audit confirms that your ISMS is still in place, which keeps the certificate current for the full 3 years of validity.

Smaller companies often ask whether the certificate is worth the effort. If your customers regularly send security questionnaires, one verifiable document can replace many individual answers.

• ISO for small and medium businesses
• What certification costs