ISO 27001 for energy sector: certificate online, without an on-site audit

Energy companies hold data that other businesses depend on: consumption data, contract and billing records, access to metering and plant systems. A municipal utility or an industrial customer that passes this data to a supplier wants to know the supplier handles it under control.

The request arrives in ordinary documents. A supplier questionnaire asks whether you hold an information security certificate. A tender lists ISO 27001 as a requirement or awards points for it. A customer audit asks for your security policy and your risk assessment. One certificate answers all three.

Smaller firms feel this most. PV installers who connect to systems remotely, billing software vendors, metering service providers and energy consultants with access to customer load profiles are not utilities. They sit in the supply chain of one, and the purchasing department asks them the same questions.

• ISO standards for small and medium businesses

ISO 27001 covers information security, not the physical safety of a plant. You define the scope yourself: the office network, the customer platform, the remote access to installations. The risk assessment then decides which Annex A controls apply.

Consumption and load data

Meter readings and load profiles reveal when a site is occupied or a machine runs. The risk assessment sets who may see this data, where it is stored and when it is deleted.

Remote access to installations

Technicians connect to inverters, storage systems or controllers from outside. Controls for authentication, remote working and supplier access apply here.

Billing and customer portals

Contract data and bank details sit in a few systems. Access rights, logging and backups protect them.

Cloud-based monitoring platforms

Many energy services run on external platforms. The 2022 edition added controls for the use of cloud services, which fit this case directly.

Field service partners and hosting providers

Subcontractors work with your customer data. Supplier controls require agreed rules and a review of how they are kept.

Ransomware and lost devices

An infected office network can stop invoicing for days. A lost tablet can hold site plans and access codes. Incident management defines who acts and what happens next.

The six core requirements look abstract on paper. In an energy business they translate into a few concrete decisions.

1. 01

   Assess information security risks

   List your assets: the customer database, the meter data platform, the remote access to installations. Rate each by likelihood and impact. The result is your risk register.

2. 02

   Define a security policy and objectives

   One short policy, signed by management. An objective can be as specific as: all technicians use two-factor authentication for remote access.

3. 03

   Implement Annex A controls

   Pick the controls your risks call for. A solar installer will weigh remote access and device management. A billing provider will weigh access rights and backups.

4. 04

   Prepare the Statement of Applicability

   List every control, state whether it applies and give the reason. A firm that works only from rented offices can justify excluding controls for its own data centre.

5. 05

   Train employees

   Office staff learn to spot phishing mails that imitate invoices. Field technicians learn how to handle customer site data and company laptops.

6. 06

   Manage incidents and learn from them

   Write down who is called when a technician loses a tablet, which passwords are changed and who informs the customer. After each case, adjust the rule.

The standard is the same for every company. The assets and the first controls differ by business.

• ISO 27001 standard page

You complete an online self-assessment with 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35 questions, at least 24 need a yes. After you pass and pay, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue.

Every certificate carries a number and a QR code on the PDF. A customer or a purchasing department opens the public verification page and sees that the certificate exists. A short online re-audit each year confirms it stays current.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing runs as an automatic yearly subscription, which you can cancel at any time to the end of the current year in your customer account. If you cancel, the certificate ends with the paid year. For two standards you get 20% off, for three or more 30%, also on the yearly fee. Swiss and Liechtenstein customers pay 8.1% VAT, included in the price. You need no account to buy.

• Start the free self-assessment
• See pricing
• How it works

Read the tender or the supplier questionnaire before you decide. Some customers name a specific route, others ask only for a valid ISO 27001 certificate. If the text is open, the online route saves you weeks of waiting and the cost of an auditor on site.

The classic route with an on-site audit by a certification body suits companies whose customers demand it in writing. The guides below compare both routes and the costs.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs