ISO 27001 in Neuchâtel: certified online, without an auditor on site

The request rarely comes from the company itself. It comes from a customer. A purchasing department sends a supplier questionnaire, a tender lists information security as a criterion, or a customer audit asks how you protect shared data. A certificate answers all three with one document.

Zertify has no office in Neuchâtel and no local staff. What follows is a general picture of the kinds of businesses that typically run into the question.

Industrial suppliers

Firms in watchmaking, microtechnology and precision engineering often work for larger customers. Those customers pass their own security requirements down to suppliers who hold drawings, specifications or production data.

IT and software companies

Anyone who hosts, develops or supports systems for other businesses is asked about information security before the first contract is signed.

Medical technology and healthcare providers

Patient data and device data call for documented controls, and buyers in this sector ask for proof.

Fiduciary, finance and advisory firms

Client accounts, payroll and contracts are sensitive by nature. A certificate shows that access, backups and incident handling follow a defined system.

• ISO standards for small and medium businesses

ISO 27001:2022 describes how an information security management system (ISMS) is built. Its core is the risk assessment. It decides which Annex A controls you put in place and why. The 2022 edition revised these controls and covers cloud services, data protection and cyber risks among other topics.

In practice the standard comes down to six tasks.

1. 01

   Assess information security risks

   Identify what could go wrong with your data and systems, and how likely and serious it is.

2. 02

   Define a security policy and objectives

   Management sets the direction in writing, in line with clause 5 on leadership.

3. 03

   Implement Annex A controls

   Choose and apply the controls that match your risks, from access rights to supplier management.

4. 04

   Prepare a Statement of Applicability

   List which controls apply, which do not, and the reason for each decision.

5. 05

   Train your employees

   Staff know the rules and know what to do when something looks wrong.

6. 06

   Manage incidents and learn from them

   Incidents are recorded, handled and used to improve the system.

The classic route means an on-site audit by a certification body. An auditor visits your premises, interviews staff and inspects documents. For a company in Neuchâtel that means booking dates, releasing people from their work and usually paying for the auditor's time and travel. Costs and lead times depend on the body and the size of the company, so ask for a quote before you compare.

The online route replaces the visit with a structured self-assessment. The table shows the practical differences.

• Compare the certification routes
• Certification without an on-site audit

Zertify is an online platform. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is released. Because nothing depends on a visit, a company in Neuchâtel is treated exactly like one anywhere else in Switzerland.

The price is CHF 849 in the first year, then CHF 569 per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. If you certify against two standards you get 20% off, with three or more 30%, and the discount also applies to the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.

Details on the standard are on the ISO 27001 page. The pricing page lists every cost.

• ISO 27001 at Zertify
• Prices and discounts
• Start the free self-assessment

The route has four steps. You can stop after the first one at no cost.

1. 01

   Answer the 48 questions

   The self-assessment is free. Thirteen of the questions are mandatory requirements of the standard, and all thirteen must be answered with yes. Among the other 35 you need at least 24 yes answers.

2. 02

   Close any gaps

   If a mandatory answer is no, you work on that point in your company first and then answer again.

3. 03

   Pay and submit

   Once you have passed, you order the certificate. SICE reviews your assessment.

4. 04

   Receive and share the certificate

   The PDF arrives within 4 hours after passing and payment. Every certificate carries a number and a QR code that lead to the public verification page, so a customer can check it in seconds.

• How it works in detail

Read the wording of your customer's request first. A supplier questionnaire that asks for a valid ISO 27001 certificate is a different matter from a tender that requires an on-site audit by a certification body. Ask the purchasing department if the text is unclear.

Then be honest in the self-assessment. The questions describe real practice: a risk assessment that exists, a Statement of Applicability that is written, staff who have been trained. A yes should be one you could explain to a customer who asks.

The cost guide shows what the classic route and the online route involve in money and time, so you can set the figures side by side.

• What ISO certification costs