ISO 27001 in Chur: certified online, without an auditor on site

ISO 27001:2022 sets out how an information security management system (ISMS) is built. At its core is the risk assessment. It decides which Annex A controls you implement and why. The 2022 edition revised the controls and now covers cloud services, data protection and cyber risks, among others.

The standard is the same everywhere. A company in Chur works to the same requirements as one in Zurich or Hamburg. Zertify has no office in Chur and does not need one, because the assessment runs entirely online.

Risk assessment

You identify the information security risks of your business and rate them. The result drives every other decision.

Policy and objectives

You write down a security policy and set objectives that management has approved.

Annex A controls

You choose and implement the controls that answer your risks, for example access rights, backups or supplier management.

Statement of Applicability

The SoA lists which controls apply, which do not, and the reason for each decision.

Awareness and training

Employees know the rules and what to do when something goes wrong.

Incident management

Security incidents are recorded, handled and used to improve the system.

• ISO 27001 at Zertify

Chur is the capital of the canton of Graubünden. The demand for ISO 27001 does not depend on the postcode. It comes from the customers and partners a company works with. Where a business handles other people's data, the question tends to come up sooner or later.

These are the groups that meet it most often:

IT service providers and software companies

Their customers send security questionnaires before signing and expect a certificate as the answer.

Cloud service providers

They host data that belongs to others, so buyers want proof of a managed security system.

Financial service providers and banks

Regulated customers pass their requirements down to every supplier in the chain.

Healthcare

Patient data is among the most sensitive data there is, and partners ask how it is protected.

E-commerce and online services

Customer accounts, orders and payment flows are the daily business and the main risk.

Companies handling sensitive customer data

Fiduciaries, consultancies and agencies hold contracts and personal data that clients expect to be safe.

The classic route with an on-site audit by a certification body means appointments, auditors visiting your premises and a longer lead time. The online route moves the assessment to a questionnaire that you complete when it suits you. The table shows the practical differences.

• Compare the certification routes
• Certification without an on-site audit

Zertify is an online platform. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. The certificate is valid for 3 years and is confirmed each year by a short online re-audit.

The 48 questions for ISO 27001 cover the topics above. 13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 35, at least 24 need a yes. The questions assume that your risk assessment, policy and Statement of Applicability exist, so answer them honestly.

Prices include 8.1% Swiss VAT for customers in Switzerland. You do not need an account to buy. Billing is a yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. If you certify a second or third standard, you get 20% off for two standards and 30% for three or more, also on the yearly fee.

• Standard page ISO 27001
• Prices
• Start the free self-assessment

The path is short, and none of it requires you to leave your office in Chur.

1. 01

   Check your ISMS

   Before you start, make sure the risk assessment, the security policy and the Statement of Applicability exist in a usable form.

2. 02

   Take the self-assessment

   Answer the 48 yes/no questions online. The assessment is free and needs no registration.

3. 03

   Pass the thresholds

   All 13 mandatory questions must be answered yes, plus at least 24 yes among the other 35.

4. 04

   Pay and receive the certificate

   After SICE's review and your payment, the certificate follows within 4 hours as a PDF with a QR code.

5. 05

   Confirm it every year

   A short online re-audit keeps the certificate current during its 3 years of validity.

• How it works

A supplier questionnaire from a larger customer often asks for ISO 27001 in its first section. A tender may list it as a condition. The purchasing department of your customer wants a document it can file and check.

Every Zertify certificate has a number and a QR code. Anyone can open the public verification page and see that the certificate is genuine and current. In a customer audit, you point to the page instead of sending a scan that has to be trusted.

Smaller companies have the same questions as large ones, only with fewer people to answer them. The guide for small and medium businesses explains what the standards ask of a firm of that size.

• ISO for small and medium businesses
• Certification cost explained