ISO 27001:2022 certification
ISO 27001 process: from self-assessment to verifiable certificate
The ISO 27001 process at Zertify runs online in six steps. You answer 48 yes/no questions about your information security management system, pass the assessment and receive a certificate that anyone can check by number or QR code. No auditor visits your office.
01: Overview
The ISO 27001 process in six steps
Zertify replaces the on-site audit with a structured self-assessment. SICE reviews every assessment, and G6 Agency AG issues the certificate under licence from SICE. This is the sequence from first click to the document in your inbox.
Start the self-assessment
Open the assessment for ISO 27001:2022. It is free and needs no registration.
Answer 48 questions
Each question is a plain yes or no. Thirteen concern mandatory requirements of the standard, the other 35 cover the remaining requirements.
Reach the pass mark
All 13 mandatory questions need a yes. Among the other 35, at least 24 must also be yes.
Pay for the certificate
After you pass, you choose the certificate and pay. You do not need an account for this. SICE reviews your assessment before the certificate is issued.
Receive the certificate
The PDF reaches you within 4 hours of passing and payment. It carries a certificate number and a QR code.
Confirm it every year
A short online re-audit confirms your answers once a year. The certificate is valid for 3 years.
02: Assessment
What the self-assessment asks and when you pass
The questions follow ISO 27001:2022. They deal with the risk assessment, the security policy and objectives, the Annex A controls, the Statement of Applicability, staff awareness and incident handling. You answer from what your company does today, not from what you intend to do next quarter.
| Question group | Number of questions | Requirement to pass |
|---|---|---|
| Mandatory requirements of the standard | 13 | All answered yes |
| Further questions | 35 | At least 24 answered yes |
| Total | 48 | Both conditions met |
The assessment itself is free. You can find out where you stand before you commit to anything.
03: Preparation
What to prepare before you answer the first question
Most of the work happens before the assessment. The 2022 edition revised Annex A, with changes touching cloud services, data protection and cyber risks, so documents written for an older edition may need a second look. Have these five items at hand.
- Risk assessment
- A record of the information assets you hold, the risks that threaten them and how you rate those risks. The result decides which Annex A controls apply to you.
- Security policy and objectives
- A written policy approved by management, with objectives you can measure.
- Statement of Applicability
- A list of the Annex A controls, each marked as applied or excluded, with a reason.
- Awareness and training
- Staff know the policy and their own duties. Keep a record of who was trained and when.
- Incident management
- A defined way to report, handle and review security incidents, and to act on what you learn.
04: Zertify
How Zertify fits into the process
Zertify covers the path from assessment to certificate. The ISO 27001 page explains the requirements in detail. The assessment is where you test them against your own company.
The certificate costs CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. Customers in Switzerland and Liechtenstein pay 8.1% VAT, which is already included in these prices.
Billing is an automatic yearly subscription. You can cancel at any time in the customer account, effective at the end of the current year, and the certificate then ends with the paid year. If you certify several standards, you get 20% off for two and 30% off for three or more, also on the yearly fee.
05: Comparison
Zertify or the classic route with an on-site audit?
Some customers and tenders name the route they expect. Check your contract or the tender documents before you decide. The table shows where the two routes differ in practice.
| Aspect | Zertify | Classic route |
|---|---|---|
| Assessment | Online self-assessment with 48 yes/no questions | Audit by a certification body, including a visit on site |
| Time to certificate | Within 4 hours after passing and payment | Indicative: several weeks to a few months, depending on scope and auditor availability |
| Yearly follow-up | Short online re-audit, included in the yearly fee | Follow-up audits by the certification body |
| Cost | Fixed and published on the pricing page | Quote per company, varies with size and provider |
| Verification | Public, by certificate number and QR code | Depends on the certification body |
The guide on certification routes sets both side by side in more detail.
06: After issue
Using and keeping the certificate
Attach the PDF to the supplier questionnaire, the quote or the tender file. The QR code opens the verification page. A purchasing department or a customer auditor can confirm the number and the validity there without contacting you.
Once a year, the online re-audit confirms that your answers still hold. If your setup has changed, for example through a new cloud provider, update your ISMS documents first and answer the questions against the current state.
07: FAQ
Questions about the ISO 27001 process
08: Guide
Related pages
Start your ISO 27001 assessment
Answer the 48 questions and see whether your information security management system passes.
Free and without registration.