ISO 27001:2022
ISO 27001 for financial services
Clients, partners and tenders in finance ask for proof that you protect data and payments in an organised way. ISO 27001 is that proof. With Zertify you answer an online self-assessment and receive a verifiable certificate within 4 hours after passing and payment.
01: Demand
Why financial firms are asked for ISO 27001
A bank, an asset manager or a payment start-up holds data that clients cannot replace: account details, portfolios, identity documents, payment files. Corporate clients and partners know this. Before they hand over data or connect to your systems, they want to see that you manage the risk.
The request usually arrives as a question. A purchasing department sends a supplier questionnaire that asks whether you hold ISO 27001. A tender lists the certificate as a requirement or awards points for it. A custodian, a software vendor or an outsourcing partner asks for it during onboarding. Without a certificate, you fill in the same forty pages by hand every time.
ISO 27001 gives these readers one reference. The certificate carries a number and a QR code on the PDF. Both lead to a public verification page, so the buyer checks it in a minute and moves on.
02: Risks
Which risks of financial services does ISO 27001 cover?
The standard sets out how to build an information security management system (ISMS). It prescribes no product and no technology. At its core is the risk assessment: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among others.
In finance, the risk assessment usually ends up with these areas:
- Client and account data
- Portfolios, tax documents and identity copies sit in a CRM, a shared drive and email. The assessment decides who may open which folder and how access is withdrawn when an employee leaves.
- Payment and transaction files
- A manipulated payment file or a changed account number causes direct financial loss. Controls cover approval by two people, logging and separation of duties.
- Trading and portfolio platforms
- Administrator accounts on these systems can move money or change positions. Strong authentication and regular review of privileged access reduce the exposure.
- Outsourced providers and cloud services
- Hosting, custody, core banking software and document archives often run at third parties. The standard asks you to assess these suppliers and define what they must guarantee.
- Advisers on the move
- Laptops and phones carry client mails to meetings. Device encryption, remote wipe and clear rules for private devices belong in the control set.
- Fraud by impersonation
- Fake emails from a supposed client or director request urgent transfers. Training and a call-back rule for changed payment details address this directly.
03: Practice
How a financial services firm meets the key requirements
The requirements are the same for a ten-person asset manager and a larger lender. What differs is the scope of the answers. The table shows what each requirement can look like in a small or mid-sized financial firm.
| Requirement | Example in a financial firm |
|---|---|
| Risk assessment (clause 6) | An independent asset manager lists client files, the portfolio system and the email archive, then rates likelihood and impact of loss, leak or manipulation for each. |
| Security policy and objectives (clause 5) | Management signs a short policy and sets an objective, for example two-factor login on every client portal by year end. |
| Annex A controls | Access by role, encrypted laptops, logging on the payment system, written security terms for the hosting provider. |
| Statement of Applicability | A list of all controls with a decision for each. Physical controls for a branch office apply, those for a data centre do not, and the reason is written down. |
| Awareness and training (clause 7) | A yearly session for all staff, including a simulated email asking for an urgent transfer to a new account. |
| Incident management | An adviser loses a phone with client mail. The loss is reported the same day, the device is wiped, the case is logged and the rule for private devices is tightened. |
| Performance evaluation and improvement (clauses 9 and 10) | Once a year, management reviews open incidents, supplier changes and the risk list, and assigns the next measures. |
A small firm does not need a security department. The owner or the head of operations can answer most of these points, provided the documents exist and staff follow them.
04: Zertify
Getting the certificate with Zertify
Zertify issues the ISO 27001:2022 certificate on the basis of an online self-assessment. There is no on-site audit. The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education), and SICE reviews every assessment before it is issued. You do not need an account to buy.
The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years and is confirmed each year by that short re-audit. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. If you certify a second or third standard, a discount of 20% or 30% applies, also on the yearly fee.
Answer 48 yes/no questions
13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 35, at least 24 must be yes.
Pay online
Billing is an automatic yearly subscription. You can cancel it at any time in the customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year.
Receive the certificate
After you pass and pay, the PDF arrives within 4 hours. Clients enter the number or scan the QR code to verify it.
05: Routes
Online certificate or classic audit: what fits your clients?
Some tenders and some large clients name the classic route with an on-site audit by a certification body. If a requirement is worded that way, read it before you decide. Other buyers only want a verifiable certificate for their supplier file, and for them the online route answers the question.
The classic route needs preparation, auditor days at your premises and a longer lead time. As an indicative range, plan several months from start to certificate, and a cost clearly above the online route. Zertify suits firms that need the certificate for a questionnaire, a quote or a partner review within days, not months.
Readers who want to weigh both options will find the comparison in the guides below.
06: FAQ
Questions about ISO 27001 in financial services
07: Guide
Related pages
Check where your firm stands on ISO 27001
The self-assessment shows within minutes whether your answers meet the requirements of the standard.
Free and without registration.