ISO 27001 for retail and trade: certificate without an on-site audit

A retailer or wholesaler holds more data than the shop floor suggests: customer accounts, delivery addresses, order histories, supplier prices, bank details for refunds. When a larger chain, a marketplace or a corporate buyer takes you on as a supplier, the purchasing department sends a questionnaire. One of the first questions is whether you hold an information security certificate.

Tenders work the same way. A certificate attached to the quote answers the question before it is asked. Without it, you fill in pages of security questions for every new customer, and each buyer's IT team reads them one by one.

ISO 27001:2022 is the standard those questionnaires point to. It prescribes no product and no tool. It asks you to assess your own risks, decide which controls you need and show that you keep them running.

• Overview of all standards

The risk assessment is the core of ISO 27001. In retail and trade it usually starts with the systems that touch money, stock and customer data.

Online shop and customer accounts

Logins, addresses and order histories sit in the shop system. Typical risks are account takeover, leaks through third-party plug-ins and weak admin passwords.

Point-of-sale and card terminals

Tills, tablets and terminals share the store network. Outdated software and one login shared across a whole shift are the usual weak points.

Inventory and ERP

Stock levels, purchase prices and margins are stored here. Wrong access rights, manipulated orders or an outage that stops dispatch are the risks to rate.

Supplier and partner interfaces

EDI links, price list uploads and wholesaler portals connect you to outside parties. Forged invoices, changed bank details and exposed credentials belong in the assessment.

Loyalty and newsletter data

Customer lists often live in marketing tools and spreadsheets. A staff member who leaves with an export is a realistic scenario.

Seasonal and temporary staff

Peak season means short contracts and quickly created accounts. Accounts that stay active after the contract ends are a common finding.

The standard has six requirements that matter most in practice. The table shows what each one looks like in a shop or trading business.

Most small and medium businesses already do part of the work without calling it that. The task is to write it down and close the gaps. Clause 6 (Planning) of the standard covers the risk assessment, clause 9 (Performance evaluation) the regular check that your controls still work.

1. 01

   List your systems and data

   Shop, ERP, tills, mailboxes, supplier portals, cloud storage. Note who has access to each.

2. 02

   Rate the risks

   Give each system a likelihood and a damage rating. Start with the ones that hold customer or payment data.

3. 03

   Choose controls and write the SoA

   Go through Annex A, mark what applies and what is already in place.

4. 04

   Write a short policy

   Keep it to what your staff will read. The owner signs it.

5. 05

   Brief your team

   Include temporary staff before the season starts, not after.

6. 06

   Run the self-assessment

   The questions show which requirements are still open.

• ISO for small and medium businesses

The self-assessment has 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 35 questions you need at least 24 yes answers. No account is needed to start or to buy.

The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). SICE reviews every assessment before the certificate is issued. After you pass and pay, the certificate reaches you within 4 hours.

It costs CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. Companies that certify to two standards get 20% off, three or more get 30%, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

• ISO 27001 certificate at Zertify
• Pricing
• Start the free self-assessment

Every Zertify certificate carries a number and a QR code on the PDF. A purchasing department scans the code or enters the number on the public verification page and sees whether the certificate is valid. You can attach the PDF to a quote, a tender or a supplier questionnaire and let the buyer check it.

The certificate rests on an online self-assessment and a short online re-audit every year. There is no on-site audit. The classic route has a certification body send auditors to your premises, which takes more planning and more of your staff's time. Some buyers name the route they expect in their tender documents, so read the requirements before you decide.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs