ISO 27001 in Schaffhausen: certified online, without a site visit

ISO 27001:2022 sets out how an information security management system (ISMS) is built. At its core is the risk assessment. It decides which Annex A controls you implement, and it gives the reason for each choice.

The 2022 edition revised the controls. They now cover cloud services, data protection and cyber risks, among other topics. The standard asks for the following.

Risk assessment

You identify and assess the information security risks that apply to your business.

Policy and objectives

Management defines a security policy and sets objectives that can be checked.

Annex A controls

You implement the controls your risk assessment calls for.

Statement of Applicability

You document which controls apply, which do not, and why.

Awareness and training

Employees know the rules and their own part in following them.

Incident management

You handle security incidents and use them to improve.

• ISO 27001 in detail

Demand for ISO 27001 follows the data a company handles, not its postcode. It is most common among IT service providers and software companies, cloud service providers, financial service providers and banks, healthcare organisations, e-commerce and online services, and any company that holds sensitive customer data.

In daily work the request rarely arrives as an abstract wish. It shows up as a line in a supplier questionnaire, a requirement in a tender, or a question from a customer's purchasing department during an audit. A small business in Schaffhausen that supplies such customers meets the same question as one in Zurich or Munich.

A certificate answers that question with a document the customer can check itself.

• ISO standards for small and medium businesses

Zertify is an online service. It has no office in Schaffhausen, and the process does not need one. Nobody visits your premises and no appointment has to be coordinated with your team.

The person responsible for IT or security, together with management, answers the questions at their own desk. The answers must describe what your company actually does. The assessment does not replace the work of building the ISMS; it records where you stand against the requirements of the standard.

• Certification without an on-site audit
• How it works

Both routes lead to an ISO 27001 certificate. They differ in how the evidence is collected and in the effort around it.

• Compare the certification routes
• Certification cost explained

The path is short, and you can stop after the assessment if the result shows gaps.

1. 01

   Start the self-assessment

   You begin without an account. The assessment is free.

2. 02

   Answer 48 questions

   Thirteen of them are mandatory requirements of the standard and must all be answered with yes.

3. 03

   Reach the pass mark

   Besides the 13 mandatory questions, at least 24 of the other 35 questions need a yes.

4. 04

   Pay and wait for the review

   SICE reviews every assessment before the certificate is issued. The certificate arrives within 4 hours after passing and payment.

5. 05

   Use the certificate

   Attach the PDF to quotes and questionnaires. Customers scan the QR code or enter the number on the verification page.

The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). It is valid for 3 years and confirmed every year by a short online re-audit.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the re-audit. Billing is an automatic yearly subscription. You can cancel it in your customer account at any time to the end of the current year; the certificate then ends with the paid year. Customers in Switzerland and Liechtenstein pay prices that include 8.1% Swiss VAT.

If you certify more than one standard, a discount applies, also on the yearly fee: 20% for two standards, 30% for three or more.

• ISO 27001 certificate
• Pricing
• Start the free self-assessment