ISO 27001 for chemicals and pharma

A formulation, a synthesis route or a set of study results is often worth more than the plant that produces it. Customers know this. A supplier questionnaire now almost always contains a section on information security, and a certificate answers most of it in one document.

The request comes from several sides. Large manufacturers add it to supplier onboarding. Clients of contract manufacturers and contract research organisations ask for it before they release specifications or samples. Some tender documents list it as a requirement or award points for it. Distributors who hold product and batch data for a manufacturer meet the same question.

Without a certificate, every customer sends its own questionnaire and your IT lead or quality manager answers the same points again and again. With a certificate, you attach one PDF with a QR code and the buyer checks it on the verification page.

• ISO 27001 at a glance

ISO 27001:2022 does not prescribe technology. It requires an information security management system (ISMS) built around a risk assessment. You list your information assets, rate the risks and select the Annex A controls that fit. In this industry the assets typically look like this:

Formulations and recipes

Compositions, synthesis routes and process parameters that a competitor could use directly.

Batch and quality records

Batch documentation, release data and deviation reports that must stay complete and unaltered.

Laboratory data

Results from the laboratory information system, analytical methods and stability studies.

Plant control systems

Control networks and engineering workstations on the production floor that are linked to the office network.

Study and trial data

Results and patient-related data that you receive from partners or pass on to them.

Partner exchange

Specifications, certificates of analysis and orders exchanged through supplier portals and shared folders.

The risk assessment decides which controls apply to you. Controls you leave out are listed in the Statement of Applicability with a reason.

The examples below show what a specialty chemicals producer or a small pharma service company might do. They are illustrations, not prescriptions.

1. 01

   Assess the risks

   The company lists formulations, customer specifications, the laboratory system and the plant network as assets. For each it notes who has access, what could go wrong and how severe the damage would be. This is the planning part of the standard (clause 6).

2. 02

   Define policy and objectives

   Management signs a short security policy. One objective could be that every external partner with access to specifications works under a signed confidentiality agreement.

3. 03

   Implement controls and write the SoA

   Laboratory staff get individual logins instead of a shared account. The plant network is separated from the office network. The Statement of Applicability records which Annex A controls are in force and why.

4. 04

   Train employees

   Production and laboratory staff attend a short session on phishing, USB sticks and sending files to partners. Attendance is recorded.

5. 05

   Handle incidents

   An infected laboratory PC is reported, isolated and cleaned. The company notes the cause and the fix, then changes the rule on external storage devices. This is the improvement loop of clause 10.

You complete an online self-assessment with 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35 questions, at least 24 need a yes. No account is needed to start, and none to buy.

After you pass and pay, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. There is no on-site audit. Each certificate carries a number and a QR code, so your customer can verify it publicly.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Customers in Switzerland and Liechtenstein pay 8.1% VAT, already included. If you add further standards, a 20% discount applies for two and 30% for three or more, also on the yearly fee.

• Start the free self-assessment
• See pricing
• How it works

Some customers write into their requirements that an on-site audit by a certification body must take place. If your buyer states this, follow it. Read the supplier questionnaire or tender text before you decide.

The classic route means agreeing an audit date, preparing documents for auditors and hosting them at your site. The guides below set both routes side by side.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs