ISO 27001:2022 Information Security Management
ISO 27001 online: certificate after a self-assessment
You answer 48 yes/no questions about your information security management in the browser. If you pass and pay, the certificate arrives within 4 hours, with a QR code that anyone can check on the public verification page. No auditor visits your office.
01: Process
How do you get an ISO 27001 certificate online?
The whole route runs in the browser. You do not need an account to buy, and the assessment itself is free.
Answer the self-assessment
48 yes/no questions on ISO 27001:2022. You can start without registration.
Pass the assessment
All 13 mandatory questions must be answered yes, plus at least 24 yes answers among the other 35.
Pay in the checkout
Payment is made online. The price model is explained further down.
Review and issue
SICE reviews your assessment. G6 Agency AG then issues the certificate under licence from SICE, within 4 hours after you have passed and paid.
Share the certificate
The PDF carries the certificate number and a QR code. Your customer scans it or enters the number on the public verification page.
02: Preparation
What to prepare before you open the assessment
The questions follow ISO 27001:2022, so preparing means doing the work an information security management system (ISMS) needs anyway. Have the following at hand, in writing where the standard expects it.
- Risk assessment
- The core of the standard. Which information assets you hold, which threats apply, which risks you accept and which you treat. The result decides which Annex A controls you implement.
- Security policy and objectives
- A written policy approved by management, with objectives you can measure.
- Annex A controls
- The controls you have put in place, including those for cloud services, data protection and cyber risks that the 2022 edition revised.
- Statement of Applicability
- The list of controls that apply to you and the reason for each one you leave out.
- Awareness and training
- Who has been trained, when, and on what.
- Incident handling
- How security incidents are reported and recorded, and what you changed afterwards.
Answer honestly. A certificate is only useful if the answers match how you actually work, because a customer's auditor may ask about exactly these points.
03: Scoring
How many questions do you have to answer yes?
The 13 mandatory questions are requirements of the standard itself. A strong result in the other 35 does not make up for a no in one of the 13.
| Question group | Questions | Required to pass |
|---|---|---|
| Mandatory requirements | 13 | All 13 answered yes |
| Other questions | 35 | At least 24 answered yes |
| Total | 48 | Both conditions met |
If a mandatory answer is no, that requirement is not yet met in your organisation. Close the gap first, then complete the assessment.
04: Comparison
ISO 27001 online or with an on-site audit?
The classic route with an on-site audit by a certification body means fixing dates, freeing staff for interviews and waiting for the audit report. The online route replaces that with a questionnaire you complete when it suits you.
The saving comes from three places: no auditor days to book, no travel, and no weeks between audit and certificate.
| Aspect | Zertify online | Classic route with on-site audit |
|---|---|---|
| Audit method | Self-assessment with 48 yes/no questions, reviewed by SICE | Audit at your premises by a certification body |
| Time to certificate | Within 4 hours after passing and payment | Depends on the audit calendar of the certification body |
| Staff time | Time needed to answer the questions | Interviews, document review and audit days |
| Cost | CHF 849 in the first year, then CHF 569 per year including the online re-audit | Quoted by the certification body, varies with company size and audit days |
| Yearly check | Short online re-audit | Follow-up audits during the certificate cycle |
05: Zertify
Where Zertify fits in
The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). SICE reviews every assessment before the certificate is issued. It rests on your self-assessment, not on an on-site audit, and every certificate can be verified publicly by number and QR code.
The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.
Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. The certificate then ends with the paid year. If you certify against two standards, you get 20% off, and with three or more 30%, also on the yearly fee.
06: Use cases
Who asks for an ISO 27001 certificate?
The certificate is most often requested from IT service providers and software companies, cloud service providers, financial service providers and banks, healthcare organisations, e-commerce and online services, and any company that handles sensitive customer data.
The request usually arrives as a line in a supplier questionnaire, a tender or a customer audit plan. Your purchasing contact can verify the certificate number on the verification page without calling you.
Some buyers prescribe a specific certification route in their tender terms. Check those requirements before you order.
07: FAQ
Questions about ISO 27001 online
08: Guide
Related pages
Find out where your ISMS stands
Answer the 48 questions and see whether your information security management meets the requirements.
Free and without registration.