ISO 27001 renewal: keeping your certificate valid

You pass the self-assessment once and receive a certificate with a term of 3 years. In each year of that term you confirm the certificate with a short online re-audit.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. Customers in Switzerland and Liechtenstein pay these prices including 8.1% Swiss VAT.

Term

The certificate is valid for 3 years from the date of issue.

Yearly confirmation

The online re-audit shows that your information security management system (ISMS) still matches what you stated in the assessment. It is covered by the yearly fee.

Public record

Anyone can check the certificate by its number or by the QR code on the PDF. A purchasing department does not need to ask you for proof.

• See how the process works

A re-audit goes quickly if the ISMS has been maintained during the year. These six points cover most of what changes in a company over twelve months.

1. 01

   Risk assessment

   Check whether assets, threats or suppliers have changed since last year. Update the risk register and the treatment decisions. Planning (clause 6) starts here.

2. 02

   Statement of Applicability

   Compare it with the controls you actually run. Remove controls you have dropped, add new ones and write down the reason for each change.

3. 03

   Policy and objectives

   Confirm that the security policy is still approved, that staff know where to find it and that the objectives are being measured.

4. 04

   Access rights

   Review leavers, new joiners, administrator accounts and external contractors. Outdated accounts are the most common gap.

5. 05

   Incidents

   Go through the incident log, including near misses. Note what you changed afterwards, because improvement (clause 10) means acting on what went wrong.

6. 06

   Awareness training

   Check that every employee, including those who joined this year, has been trained in the last twelve months.

• Requirements of ISO 27001:2022

Do not wait for the re-audit when something material changes. A move to a new cloud provider, a new product that handles customer data, an acquisition or a serious incident each call for an updated risk assessment and Statement of Applicability at the time.

The same applies when the person responsible for information security leaves. Name a successor, and record the handover. The re-audit then confirms a system that is already current, instead of forcing you to catch up in one sitting.

The three-year term does not replace the yearly confirmation. The certificate holds only while that confirmation is in place, so an overdue re-audit weakens what you can show to a customer.

If you notice a missed re-audit, complete it as soon as possible. Afterwards, open the verification page and enter your certificate number to see what a customer sees.

Cancellation is a separate case. The yearly subscription renews automatically and can be cancelled at any time in the customer account, to the end of the current year. If you cancel, the certificate ends with the paid year. Put the re-audit date in the calendar of the person who owns the ISMS, and well before the next supplier questionnaire deadline.

On the classic route with an on-site audit by a certification body, the certificate also runs for three years. The certification body returns for a surveillance audit in the first and second year. Before the third year ends, a recertification audit follows.

A surveillance audit looks at selected parts of the ISMS. The recertification audit reviews the system as a whole. Each visit has to be scheduled with the auditors and your staff have to be available for interviews.

• Compare the certification routes
• Certification cost explained

The first certificate is based on the self-assessment for ISO 27001:2022. It has 48 yes/no questions. 13 of them are mandatory requirements of the standard and must all be answered yes. Among the other 35, at least 24 yes answers are needed to pass. After you pass and pay, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before the certificate is issued.

You do not need an account to buy. If you certify against two standards, you get 20% off, and from three standards 30%. The discount also applies to the yearly fee.

• ISO 27001 certificate at Zertify
• Pricing
• Start the free self-assessment