ISO 27001 for service companies

A fiduciary, an agency, a consultancy or a staffing firm owns little machinery. What it holds is other people's information: annual accounts, payroll lists, contracts, campaign plans, applicant files. Clients know this, and their purchasing departments have turned the concern into a line on a form.

The question reaches you in one of three ways. A supplier questionnaire arrives before onboarding. A tender asks for proof of information security. Or a customer announces an audit for next quarter. Without a certificate, each of these means long free-text answers written by hand. With one, you attach the PDF and point to the verification page.

Partners ask for the same reason. If you work as a subcontractor inside a larger firm's project, your least protected laptop becomes their problem.

• ISO standards for small and medium businesses

The standard starts from the information you handle, not from technology. The risk assessment, which belongs to clause 6 (Planning), lists what can go wrong and decides which Annex A controls you apply. In a service company the same few assets come up again and again.

Client documents

Contracts, balance sheets and applicant files sit in shared folders. The risk is wrong access rights or a file sent to the wrong recipient.

Access to client systems

Staff log in to client portals, CRMs or accounting software. Shared passwords and accounts that outlive the project are the usual weak point.

Mobile work

Laptops and phones travel to client sites, trains and home offices. Loss, theft and unencrypted drives are the exposure.

Email and invoices

Phishing aimed at the finance contact and altered bank details on invoices cost service firms real money and client trust.

Freelancers and subcontractors

External people work with project data under their own devices and habits. Contracts and access removal at project end decide the risk.

Leavers

A departing employee who keeps a mailbox, a password manager entry or a client login is a gap nobody notices until it matters.

ISO 27001:2022 describes how an information security management system (ISMS) is built. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks among others. For a team of ten to a hundred people, the requirements translate into modest, concrete measures.

Most firms already do half of this without a name for it. Collecting it in one place takes a few working days.

1. 01

   List client data and systems

   Write down which client information you hold, where it is stored and who can reach it.

2. 02

   Name one person responsible

   A partner, the managing director or the IT lead. Someone must own the topic and answer for it.

3. 03

   Write the policy

   One page is enough, as long as it states what you protect, from what and who is accountable.

4. 04

   Check the basics

   Multi-factor login, encrypted laptops, tested backups and a fixed routine for removing access when someone leaves.

5. 05

   Brief your staff

   Run a short session and keep the record. Include freelancers who work with your client data.

6. 06

   Define incident reporting

   Staff must know whom to tell and how, the moment something goes wrong.

The self-assessment has 48 yes/no questions for this standard. 13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 35 questions, at least 24 need a yes. You can take it without an account. No on-site audit takes place. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before the certificate is issued.

The first year costs CHF 849 (€849), then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years and confirmed each year by that short re-audit. The subscription renews automatically and can be cancelled at any time to the end of the current year in the customer account. The certificate then ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. If you certify two standards, you get 20% off, with 30% for three or more, also on the yearly fee.

Every certificate carries a number and a QR code. Your client's purchasing department opens the public verification page and checks it without contacting you. If a tender specifies the classic route with an on-site audit by a certification body, compare both routes before you decide.

• ISO 27001 standard page
• Pricing
• Compare the certification routes
• Start the free self-assessment