ISO 27001 in Biel: certified online, without an audit visit

Biel is a bilingual city in the canton of Bern with a mix of industry, technology companies and service businesses. ISO 27001 is not tied to a place. The request almost always comes from a customer: a supplier questionnaire asks whether you run a certified information security management system, or a tender lists the certificate as a requirement.

These are the kinds of businesses that meet this question most often.

IT service providers and software companies

Your customers give you access to their systems and data. Their purchasing department wants proof of how you protect it.

Cloud and hosting providers

Contracts for platform operation commonly refer to ISO 27001 as the baseline.

Manufacturers and industrial suppliers

Larger clients pass security requirements down to suppliers who receive drawings, specifications or production data.

E-commerce and online services

Customer accounts, orders and payment processes make information security a topic in every enterprise customer review.

Healthcare and financial service providers

Sensitive personal and financial data lead partners to ask for documented controls.

ISO 27001:2022 sets out how an information security management system (ISMS) is built. At its core is the risk assessment: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks among others.

In practice, six requirements carry the standard.

Risk assessment

You identify and rate the information security risks of your company.

Security policy and objectives

Management defines what is protected and which goals apply.

Annex A controls

You implement the controls that your risk assessment calls for.

Statement of Applicability (SoA)

A document that lists the controls, states whether each applies and gives the reason.

Awareness and training

Employees know the rules and their own part in following them.

Incident management

Security incidents are recorded, handled and used to improve the system.

Both routes lead to an ISO 27001 certificate. They differ in effort, duration and in how the proof is delivered. The figures for the classic route are indicative and vary with company size and certification body.

• Compare the certification routes
• Certification without an on-site audit

Zertify is an online service. There is no office, auditor or partner in Biel, and none is needed because every step happens on screen. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued.

1. 01

   Start the self-assessment

   It is free and needs no registration.

2. 02

   Answer 48 yes/no questions

   13 of them are mandatory requirements of the standard and must all be answered yes. Among the other 35 questions you need at least 24 yes answers.

3. 03

   Pay online

   You do not need an account to buy.

4. 04

   Receive the certificate

   After SICE has reviewed your assessment, you get the PDF.

5. 05

   Pass it on

   Attach it to quotes and questionnaires. Every certificate can be verified publicly by number and QR code.

• ISO 27001 standard page
• How it works
• Start the free self-assessment

The certificate costs CHF 849 in the first year, then CHF 569 per year including the yearly online re-audit. It is valid for 3 years. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

If you certify against several standards, a discount applies: 20% for 2 standards and 30% for 3 or more, also on the yearly fee. Companies that already hold ISO 9001 or run a quality system often add ISO 27001 as the second standard.

• Pricing
• Guide to certification cost

Attach the PDF to the supplier questionnaire or the quote. The QR code leads to the verification page, where your customer's purchasing department checks the certificate number without writing to you.

The certificate does not replace the work behind it. A customer audit may still ask to see your risk assessment, your Statement of Applicability or training records. If these exist and are current, the self-assessment is a matter of answering honestly. If they do not, build them first.

• ISO for small and medium businesses
• All standards