ISO 27001 for education: certificate online, without an on-site audit

A school or training provider holds more personal data than its size suggests. Enrolment forms, grades, attendance lists, payment details and, in many cases, data on minors. When such an organisation buys a learning platform or hands course administration to a service provider, the purchasing department wants evidence that the supplier handles this data under control.

That evidence usually arrives as a supplier questionnaire. Questions about access rights, backups and incident handling take hours to answer, and every client sends a different version. An ISO 27001 certificate answers many of them at once and points to a verification page the client can check itself.

The same applies in the other direction. A language school that delivers corporate courses, an e-learning company bidding in a tender or a private college working with exchange partners will be asked for proof of information security before the contract is signed.

• ISO standards for small and medium businesses

ISO 27001:2022 sets out how to build an information security management system (ISMS). The risk assessment sits at its core: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, which matters for providers that run on hosted learning platforms.

Five terms come up in every conversation about the standard. Here they are with examples from education.

Information asset

Anything the institution would struggle without: the student register, grade lists, exam papers before the sitting, course recordings, teachers' laptops.

Risk

The likelihood and impact of losing confidentiality, integrity or availability of an asset. Example: a teacher's account is phished and grades are changed.

Annex A control

A measure chosen from the catalogue in Annex A. Example: multi-factor login for the learning platform.

Statement of Applicability

The document that lists which Annex A controls you apply, which you leave out and why. A fully remote course provider explains there why server-room controls do not apply to it.

Security incident

An event that harms information. Example: a class list sent to the wrong email address.

The risks sit in ordinary daily processes, not in exotic attacks. The table shows where an education provider usually has to look.

The requirements are the same for a ten-person training firm and a large college. Only the scale of the answers differs.

1. 01

   Assess the risks

   List the assets by process: register, platform, exam material. Rate each risk and record the decision. Clause 6 on planning covers this, and a spreadsheet is enough for a small provider.

2. 02

   Define policy and objectives

   Write a short security policy and have the head of the institution or the owner sign it (clause 5, Leadership). An objective can be as concrete as: no unauthorised access to the grade system during the year.

3. 03

   Implement controls

   Multi-factor login for staff accounts, encrypted laptops, separate accounts for students and teachers, a backup of the learning platform that has been restored at least once as a test.

4. 04

   Prepare the Statement of Applicability

   Go through the Annex A controls, mark those that apply and give a reason for each exclusion. The risk assessment supplies most of the reasons.

5. 05

   Train employees

   Teachers and administrative staff get a short session on phishing, password handling and the correct way to send class lists. Keep a record of who attended (clause 7, Support).

6. 06

   Manage incidents

   Decide who is informed when a laptop is lost or a mailing reaches the wrong recipients. Record the event, the cause and what you changed afterwards.

You answer 48 yes/no questions online. 13 of them are mandatory requirements of the standard and must all be answered yes. Among the other 35, at least 24 need a yes. There is no on-site audit: the certificate rests on your self-assessment.

G6 Agency AG issues the certificate under licence from SICE, and SICE reviews every assessment before issue. After you have passed and paid, the certificate arrives within 4 hours as a PDF with a certificate number and a QR code. Anyone can check it on the public verification page.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years and is confirmed each year by that short re-audit. The subscription renews automatically and you can cancel it at any time in the customer account, effective at the end of the current year. The certificate then ends with the paid year. Customers in Switzerland and Liechtenstein pay 8.1% VAT, which is included, and you can buy without creating an account. If you add a second standard, 20% comes off, and 30% from three standards, also on the yearly fee.

• Start the free self-assessment
• ISO 27001 at Zertify
• Pricing

Attach the PDF to your quote or tender documents and add the link to the verification page. Purchasing staff can enter the certificate number or scan the QR code and see for themselves that it is valid.

In supplier questionnaires, refer to the certificate in the first answer on information security. Keep your policy and Statement of Applicability ready for follow-up questions.

Some tenders prescribe the route to certification. Read the wording carefully. If a client expects an on-site audit by a certification body, compare the routes before you decide.

• Compare the certification routes
• Certification without an on-site audit