ISO 27001 in Bern: certification entirely online

Bern is the seat of the Swiss federal government, and many companies in the region work for public bodies, insurers, health institutions or other businesses that handle sensitive data. Such customers send supplier questionnaires and tender documents with a section on information security. ISO 27001 is a standard they commonly name there.

The certificate matters most where your company stores, processes or hosts data that belongs to someone else.

IT service providers and software companies

Customers want to know how you protect their systems and source code before they sign a contract.

Cloud service providers

Hosting other companies' data raises questions about access control, backups and incident handling.

Financial service providers and banks

Outsourcing partners are checked for their information security, and a certificate shortens that check.

Healthcare

Patient data is among the most sensitive data a company can hold.

E-commerce and online services

Customer accounts, addresses and payment-related data must be demonstrably protected.

Companies handling sensitive customer data

Fiduciaries, consultancies and agencies often hold confidential documents of their clients.

• ISO for small and medium businesses

ISO 27001:2022 sets out how an information security management system (ISMS) is built. At its core is the risk assessment: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among others.

In practice, six requirements carry the standard.

1. 01

   Assess information security risks

   You identify what could go wrong with your information and rate each risk.

2. 02

   Define a security policy and objectives

   Management states in writing what the ISMS is meant to achieve.

3. 03

   Implement security controls (Annex A)

   You choose the controls that answer your risks and put them in place.

4. 04

   Prepare a Statement of Applicability (SoA)

   This document lists every control, whether it applies, and the reason.

5. 05

   Raise awareness and train employees

   Staff must know the rules and their own part in following them.

6. 06

   Manage security incidents and learn from them

   Incidents are recorded, handled and used to improve the controls.

• ISO 27001 at Zertify

On the classic route, a certification body sends auditors to your premises. You fix dates, free up staff for interviews and wait for the audit report. For a team of ten people, that is a large share of a working week taken away from client projects.

The online route moves the assessment to a questionnaire that you complete when it suits you. Nothing depends on an auditor's travel or diary.

• Compare the certification routes
• Certification without an on-site audit

Zertify is an online platform. The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education), and SICE reviews every assessment before the certificate is issued.

The assessment for ISO 27001 has 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 35 questions you need at least 24 yes answers to pass.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you can cancel at any time in the customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. You do not need an account to buy, and the prices include 8.1% Swiss VAT.

• ISO 27001 certificate
• Prices and discounts
• Start the free self-assessment

The steps are the same wherever your company is based. What matters is that your answers match what your company actually does.

1. 01

   Collect your ISMS documents

   Have your risk assessment, security policy, Statement of Applicability, training records and incident log at hand. The questions refer to exactly these.

2. 02

   Answer the 48 questions

   The self-assessment is free and needs no registration. You see straight away whether you meet the 13 mandatory requirements.

3. 03

   Pay and receive the certificate

   After a passed assessment and payment, the certificate arrives as a PDF within 4 hours.

4. 04

   Confirm it every year

   A short online re-audit keeps the certificate current. It is included in the yearly fee.

• How it works
• What certification costs

The PDF carries a certificate number and a QR code. A purchasing department in Bern or elsewhere scans the code or enters the number on the public verification page and sees the certificate's status without writing to you. Attach the PDF to your next supplier questionnaire or tender submission, and name the number in the security chapter of your quote.

If you also work towards other standards, a multi-standard discount applies: 20% for two standards and 30% for three or more, also on the yearly fee. Many companies pair ISO 27001 with ISO 9001 for quality management.

• Overview of all standards
• ISO 9001 certificate