ISO 27001:2022 for companies in Lugano
ISO 27001 in Lugano: certified online, without a site visit
Zertify is an online service. A company in Lugano answers 48 yes/no questions, and nobody has to travel or receive an auditor. After passing and payment, the certificate arrives within 4 hours as a PDF that your customers can verify online.
01: Standard
What does ISO 27001:2022 ask of a company?
ISO 27001:2022 describes how to build an information security management system (ISMS). The risk assessment sits at its core: it decides which Annex A controls you apply and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among other topics.
- Risk assessment
- You identify information security risks and rate them. Every later decision refers back to this result.
- Policy and objectives
- Management defines a security policy and objectives. This belongs to the leadership and planning clauses (5 and 6).
- Annex A controls
- You select and implement the controls that answer your risks, from access rights to supplier management.
- Statement of Applicability
- A document that lists which controls apply, which do not, and the reason for each decision.
- Awareness and training
- Employees know the rules and understand their own part in keeping information safe.
- Incident handling
- Security incidents are recorded and handled. What you learn from them goes back into the system.
02: Who needs it
Which businesses in the Lugano area ask for ISO 27001?
The standard does not depend on location. What counts is the data you handle and who asks you about it. Lugano is widely known as a financial centre, and companies in financial services meet the question early: clients and partners want to see how their data is protected.
IT service providers and software companies receive security questionnaires from the purchasing departments of larger customers. Cloud providers and online shops hold customer accounts and payment data. Healthcare providers keep patient records. Any company that processes sensitive customer data can find ISO 27001 as a line in a tender.
If you serve customers outside Ticino, the same questionnaire reaches you from there. A certificate with a number and a verification page gives the reviewer something concrete to check.
03: Comparison
Classic on-site audit or online route: what changes?
The classic route means an on-site audit by a certification body. It suits companies that want that format or whose customers expect it. The online route replaces the site visit with a structured self-assessment.
| Aspect | Classic route with on-site audit | Zertify online route |
|---|---|---|
| Audit format | Auditor visits your premises and interviews staff | Online self-assessment with 48 yes/no questions |
| Travel and scheduling | Audit dates and travel have to be arranged | None, you answer when it suits you |
| Time to certificate | Planned over weeks to months (indicative) | Within 4 hours after passing and payment |
| Cost model | Quoted individually by the certification body | Fixed price, published in advance |
| Proof for customers | Certificate document | PDF with number and QR code, publicly verifiable |
| Yearly check | Surveillance audits, usually on site | Short online re-audit |
The online route does not lower the content of the standard. The questions follow ISO 27001:2022, and the 13 mandatory requirements must all be answered yes.
04: Zertify
How does Zertify certify a company in Lugano?
Zertify has no office in Lugano and works with no local auditors. Everything runs through the website: assessment, payment, certificate and yearly re-audit. Your location only matters for your own address on the certificate.
The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). SICE reviews every assessment before the certificate is issued. It is valid for 3 years and confirmed each year by a short online re-audit.
The price is CHF 849 in the first year, then CHF 569 per year including the online re-audit. Prices include 8.1% Swiss VAT, and you do not need an account to buy. If you certify under several standards, a discount of 20% for two and 30% for three or more applies, also on the yearly fee.
05: Steps
Which steps lead to the certificate?
The path has five stages. Most of the effort lies in the first one.
Put your ISMS in place
Write the risk assessment, the security policy and the Statement of Applicability, and train your staff. The assessment confirms what exists, it does not replace it.
Take the self-assessment
Answer 48 yes/no questions. All 13 mandatory questions need a yes, and at least 24 of the other 35 must be yes as well.
Pay and receive the certificate
After you pass and pay, SICE's review is completed and the certificate follows as a PDF with its number and a QR code.
Show it to customers
Attach the PDF to quotes, tenders and supplier questionnaires. Anyone can open the verification page by number or QR code.
Confirm it every year
A short online re-audit keeps the certificate current during its 3 years of validity.
06: Preparation
What should be ready before you start?
The questions are yes/no, so every yes must be true on the day you answer. Reviewers at SICE read the assessment, and your customers may later ask how you came to your answers. Treat each question as a check on your own documents.
Have the following at hand: the scope of your ISMS, the risk assessment with its results, the security policy, the Statement of Applicability, records of staff training and a log of security incidents. If one of these is missing, build it first. The shortfall will show up in the questions anyway.
Small teams can manage this without a large project. Pick one person who owns information security and give them time for it.
07: FAQ
Questions about ISO 27001 in Lugano
08: Guide
Related pages
Check your ISO 27001 readiness today
Answer the 48 questions online and see whether your company in Lugano meets the requirements.
Free and without registration.