ISO 27001:2022 for Lucerne
ISO 27001 in Lucerne: certification fully online
Companies in Lucerne can get ISO 27001 certified without an auditor on their premises. You answer 48 yes/no questions in an online self-assessment. The certificate follows within 4 hours after you pass and pay.
01: Overview
What ISO 27001 asks of a company in Lucerne
ISO 27001:2022 describes how to build an information security management system, or ISMS. The standard does not depend on location. A software firm in the city centre and a service company in the surrounding region face the same requirements.
At its core is the risk assessment. You work out which information security risks affect your business, and the result decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among other topics.
Most Lucerne companies do not come to the standard out of curiosity. A customer sends a supplier questionnaire, a tender asks for proof, or a purchasing department wants a certificate number it can check.
02: Who needs it
Which Lucerne businesses are asked for ISO 27001?
The region has a mixed economy, so the requests come from several directions. The standard itself is voluntary. The pressure comes from customers, contracts and tenders, and it is strongest where sensitive data changes hands.
- IT service providers and software companies
- Customers give you access to their systems and data. Supplier questionnaires and tenders ask for ISO 27001 early in the process.
- Cloud service providers
- Before signing, customers want to know how hosting, access rights and backups are controlled.
- Financial service providers
- Banks and other financial firms pass security obligations on to the service providers they use.
- Healthcare
- Patient data is sensitive. Practices, clinics and their suppliers need to show how they protect it.
- E-commerce and online services
- Online shops and booking platforms store customer, order and payment data. Tourism businesses with online booking belong in this group.
Companies that handle sensitive customer data without fitting one of these labels meet the same questions. Your customers may sit in Zurich, Germany, Austria or France. The questionnaire looks the same.
03: Requirements
What has to be in place before you answer the questions
The standard follows the high level structure shared by ISO management system standards: context (clause 4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). In practice, six topics carry most of the work.
- Risk assessment
- You identify information security risks and rate them. Everything else in the ISMS builds on this result.
- Security policy and objectives
- Management signs a policy and sets objectives that can be checked.
- Annex A controls
- You implement the controls your risk assessment calls for and record the reason for each choice.
- Statement of Applicability
- This document lists every Annex A control, whether it applies to you, and why.
- Awareness and training
- Employees know the rules and their own part in them.
- Incident management
- Security incidents are recorded, handled and used to improve the system.
04: Comparison
Classic on-site audit or online route?
The classic route means an on-site audit by a certification body. The online route works from a self-assessment and needs no visit. The table shows where the two differ in practice. Figures for the classic route are indicative ranges and vary with company size and scope.
| Aspect | Classic route | Zertify online route |
|---|---|---|
| Basis | On-site audit by a certification body | Online self-assessment with 48 yes/no questions |
| Travel and visits | Auditors visit your premises and need staff time on site | None, everything runs online |
| Time to certificate | Indicative: several weeks to a few months from first contact | Within 4 hours after passing and payment |
| Cost | Indicative: several thousand francs, depending on size and scope | CHF 849 in the first year, then CHF 569 per year including the online re-audit |
| Ongoing checks | Surveillance audits scheduled with the certification body | Short online re-audit every year |
| Proof for customers | Certificate document | PDF with certificate number and QR code, public verification page |
Check what your customer or tender actually asks for. Some call for an on-site audit explicitly, others only ask for a valid ISO 27001 certificate.
05: Steps
How certification works for a Lucerne company
The whole process runs in a browser. You do not book an appointment and nobody travels to Lucerne.
Start the self-assessment
No account is needed. You work through 48 yes/no questions for ISO 27001:2022.
Answer against your real situation
13 questions cover mandatory requirements of the standard, and all 13 must be answered yes. Of the other 35 questions, at least 24 need a yes.
Pay after passing
Once you have passed, you pay online. You do not need to create an account to buy.
Review and issue
SICE reviews every assessment before the certificate is issued by G6 Agency AG. The certificate arrives within 4 hours after you pass and pay.
Show it to your customers
The PDF carries a certificate number and a QR code. Your customer opens the public verification page and sees that the certificate is valid.
A no on a mandatory question means the requirement is not met yet. Close that gap in your organisation first, then the certificate makes sense.
06: Zertify
Where Zertify fits in for Lucerne companies
Zertify is an online platform. It has no office in Lucerne and does not need one, because the self-assessment, the review and the certificate all work remotely. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. It is based on your self-assessment, not on an on-site audit, and it is confirmed every year by a short online re-audit.
The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year.
Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. If you certify more than one standard, you get 20% off for two standards and 30% off for three or more, also on the yearly fee.
07: FAQ
Questions about ISO 27001 in Lucerne
08: Guide
Related pages
Check where your company stands on ISO 27001
The self-assessment takes you through 48 questions and shows whether you meet the requirements.
Free and without registration.