ISO 27001 in Geneva: certified online, without an audit visit

Geneva is widely known as a centre for banking, wealth management, trading and international organisations. Companies that supply these sectors, or work next to them, receive security questionnaires as a matter of routine. ISO 27001 is the standard they are most often asked about.

The need follows the data you handle, not the size of your office. A ten-person software company with access to a client's customer records faces the same questions as a larger one.

IT service providers and software companies

Clients want to know how you protect their systems and data before they sign a contract.

Cloud and hosting providers

Customers hand you their infrastructure. A certificate answers the first round of due diligence questions.

Financial service providers and their suppliers

Banks and asset managers pass their own security expectations down to every external provider.

Healthcare and related services

Patient and insurance data is sensitive, and partners ask how it is protected.

E-commerce and online services

Payment and customer data are your daily business, and marketplaces and partners ask for proof.

• ISO standards for small and medium businesses

ISO 27001:2022 describes how an information security management system (ISMS) is built and run. Its core is the risk assessment. It decides which Annex A controls you apply and why. The 2022 edition revised the controls and now covers cloud services, data protection and cyber risks among others.

1. 01

   Assess information security risks

   You identify what could go wrong with your data and systems, and rate how likely and how serious it is.

2. 02

   Define a security policy and objectives

   Management sets the direction in writing and names measurable goals.

3. 03

   Implement security controls from Annex A

   You choose the controls that answer your risks, such as access rights, backups or supplier checks.

4. 04

   Prepare a Statement of Applicability

   The SoA lists every Annex A control, whether it applies, and the reason.

5. 05

   Raise awareness and train employees

   Staff know the rules and what to do when something looks wrong.

6. 06

   Manage security incidents and learn from them

   Incidents are recorded, handled and used to improve the system.

The classic route with an on-site audit by a certification body means fixing dates with auditors, preparing rooms and staff for their visit, and working through an audit programme. It suits organisations that want or are required to have that format.

The online route replaces the visit with a structured self-assessment that you complete when it suits you. The table shows the practical differences.

• Compare the certification routes
• Certification without an on-site audit

Zertify works fully online and has no office in Geneva. That is the point: the process does not depend on where you are. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education, and SICE reviews every assessment before the certificate is released.

The price is CHF 849 in the first year, then CHF 569 per year including the yearly online re-audit. The certificate is valid for 3 years and is confirmed each year by that short re-audit. Billing is an automatic yearly subscription. You can cancel at any time to the end of the current year in your customer account, and the certificate then ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. If you certify more than one standard, you get 20% off for two and 30% off for three or more, also on the yearly fee.

You do not need an account to buy.

• ISO 27001 on Zertify
• Pricing
• Start the free self-assessment

Allow time for the first step. The assessment itself is quick if your documentation exists, and slow if you still have to write your policy.

1. 01

   Gather what you already have

   Risk register, security policy, Statement of Applicability, training records and incident log. Gaps you find now are cheaper to close than later.

2. 02

   Start the self-assessment

   It is free and needs no registration. There are 48 questions, each answered yes or no.

3. 03

   Pass the thresholds

   13 questions are mandatory requirements of the standard and must all be answered yes. Among the other 35, at least 24 must be yes.

4. 04

   Pay and receive the certificate

   After SICE has reviewed your assessment and you have paid, the certificate arrives as a PDF with a number and QR code.

5. 05

   Confirm it every year

   A short online re-audit keeps the certificate current during its 3 years of validity.

Purchasing departments and customer security teams rarely read your policies in full. They look for a number they can check. Every Zertify certificate can be verified publicly by its number or by scanning the QR code on the PDF, so the reader lands on a verification page instead of asking you for a scan.

Add the certificate number to your quotes, your tender answers and the security section of your website. When a customer audit or questionnaire comes in, point to the certificate for the baseline questions and spend your time on the specific ones.

• How it works
• All standards at a glance