ISO 27001 for manufacturing: the certificate your customers ask for

The request usually arrives as a supplier questionnaire. Somewhere between delivery performance and quality management sits a block on information security, and one of its first questions is whether you hold ISO 27001. Some tenders list the certificate as a requirement. Others award points for it.

The reason is the data that moves along the supply chain. A customer hands you CAD files, specifications, volume forecasts and sometimes tool designs. You pass parts of them on to a toolmaker, a surface finisher or a logistics partner. If one link loses the data, the customer's competitors may see it, and the customer's purchasing department has to explain why it chose that supplier.

A certificate shortens that discussion. Instead of a 60-page questionnaire and a follow-up call, purchasing receives one document with a number and a QR code that leads to a public verification page. For a small manufacturer, that can decide whether it stays on the approved supplier list.

• ISO for small and medium businesses

The standard does not hand you a fixed list of threats. Your own risk assessment decides which Annex A controls you implement and why. In manufacturing, the same risks come up again and again.

Customer drawings and CAD files

A drawing set stored on a shared drive that every employee can open is a leak waiting to happen. The standard asks you to decide who may access which project and to record that decision.

Production network next to the office network

When the office PCs and the machine controllers share one network, a phishing mail in the back office can stop a line. Separating the networks is a typical control.

Remote maintenance by machine vendors

The vendor of a milling centre often has a permanent remote connection. Risk assessment asks who may connect, when, and whether anyone notices.

Machines that cannot be updated

A control PC running an operating system the vendor no longer supports cannot be patched. You compensate with isolation, restricted access and a note in the risk register.

Shared logins at shop floor terminals

One account for a whole shift means nobody can say who changed a production order. Individual accounts, or at least logged badge logins, close that gap.

ERP and order data

Prices, delivery dates and customer lists sit in the ERP system. Backups, access rights and the departure of employees all fall under the standard.

ISO 27001 follows the high level structure: context, leadership, planning, support, operation, performance evaluation and improvement. The six requirements below carry most of the weight. The table shows what each one looks like in a plant with, say, 40 employees and a few key customers.

• ISO 27001 requirements in detail

Most of the work happens before you open the questionnaire. The assessment only asks what you already have in place, so it pays to check your own setup first. Production managers and the person who looks after IT should do this together.

1. 01

   List what you protect

   Write down the data sets that matter: customer drawings, machine programs, the ERP database, quotes, personnel files.

2. 02

   Name an owner for each

   Someone decides who gets access. For machine programs, that is usually the head of production, not IT.

3. 03

   Rate the risks

   For each data set, note what could go wrong and how bad it would be. A simple table with three levels is enough.

4. 04

   Select controls and write the SoA

   Choose the Annex A controls that answer your risks. The 2022 edition also covers cloud services, which matters if your drawings sit in a vendor's cloud.

5. 05

   Brief everyone

   Include shift workers and temporary staff. A 20-minute session with real examples from your own plant works better than a generic video.

6. 06

   Set up incident handling

   Agree who is called, who decides and where the case is recorded. Then you can answer yes to the incident questions with a clear conscience.

Zertify is an online platform. You complete a self-assessment with 48 yes/no questions for ISO 27001. Thirteen of them are mandatory requirements of the standard, and all must be answered yes. Of the other 35 questions, at least 24 need a yes. You do not need an account to buy.

The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. After you pass and pay, the PDF reaches you within 4 hours. It carries a number and a QR code, and anyone can check it on the public verification page.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. Swiss customers pay 8.1% VAT, included in these prices. Holding two standards earns 20% off, three or more 30%, also on the yearly fee.

This route has no on-site audit. If a customer insists on an audit by a certification body at your site, the guide on certification routes explains the differences.

• Start the free self-assessment
• See pricing
• Compare certification routes