ISO 27001 in Fribourg: certificate online, without an on-site audit

ISO 27001 is the international standard for information security management. In practice it reaches a company in Fribourg through a supplier questionnaire, a tender or a customer audit. The question is short: do you operate a certified information security management system?

Fribourg is a bilingual canton, and companies based here often work for customers in French and German speaking Switzerland and abroad. Those customers apply their own procurement rules. A purchasing department does not ask where your office is. It asks whether you can show a certificate.

ISO 27001:2022 builds an information security management system (ISMS) around the risk assessment. The assessment decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among others.

• ISO 27001:2022 in detail

Demand follows the kind of data you handle, not the postcode. These are the business types where customers most often ask for the certificate, in Fribourg as in any other Swiss canton.

IT service providers and software companies

Your customers hand you access to their systems or data. The certificate answers the security section of their questionnaire.

Cloud service providers

Hosting and software-as-a-service customers want evidence that operations, access and incident handling are managed.

Financial service providers and banks

Institutions in this sector pass requirements on to their suppliers, including small ones.

Healthcare

Patient and health data are sensitive. Partners and clients expect a structured approach to protecting them.

E-commerce and online services

Customer accounts, addresses and payment-related processes make information security part of the sales conversation.

Companies handling sensitive customer data

Fiduciaries, consultancies, agencies and manufacturers with confidential customer documents belong here too.

The standard follows the usual management system structure, from context in clause 4 to improvement in clause 10. The core work sits in planning and operation. These are the key requirements you should be able to answer for:

1. 01

   Assess information security risks

   You identify what could go wrong with your information, rate each risk and decide how to treat it.

2. 02

   Define a security policy and objectives

   Management sets a written policy and objectives that the team can actually follow.

3. 03

   Implement security controls from Annex A

   The risk assessment determines which controls apply to you.

4. 04

   Prepare a Statement of Applicability

   The SoA lists every control, whether you use it and why.

5. 05

   Raise awareness and train employees

   Staff know the rules and their own part in keeping information safe.

6. 06

   Manage security incidents and learn from them

   Incidents are recorded, handled and used to improve the system.

The classic route with an on-site audit by a certification body is one way to certify. The Zertify route is another. Both start from the same standard. They differ in how the evidence is collected and how much time and travel it costs you.

• Compare the certification routes
• Certification without an on-site audit

Zertify is an online platform. It has no office, auditors, customers or partners in Fribourg, and the process does not depend on any of them. You work from your own desk, whatever the canton.

The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). SICE reviews every assessment before the certificate is issued. The PDF carries a number and a QR code, so a customer can check it on the public verification page without contacting you.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you can cancel at any time in your customer account, to the end of the current year. If you cancel, the certificate ends with the paid year. Companies certifying for several standards get 20% off for two and 30% off for three or more, also on the yearly fee. Prices for customers in Switzerland and Liechtenstein include 8.1% VAT. You do not need an account to buy.

• ISO 27001 at Zertify
• Pricing
• Start the free self-assessment

The questions refer to things your company should already have in place, such as a risk assessment, a policy and a Statement of Applicability. Answer them as they are today.

1. 01

   Open the self-assessment

   It is free and needs no registration. It contains 48 yes/no questions for ISO 27001:2022.

2. 02

   Answer the 13 mandatory questions

   These are requirements of the standard. All 13 must be answered yes.

3. 03

   Reach 24 yes answers among the other 35

   This is the second condition for passing. If you fall short, you see which areas to work on first.

4. 04

   Pay and receive the certificate

   After passing and payment, SICE reviews the assessment and the certificate arrives within 4 hours.

5. 05

   Share the verification link

   Send the PDF or the verification page to the customer who asked. Each year a short online re-audit confirms the certificate.

• How it works
• Take the self-assessment