ISO 27001 in Solothurn: certificate without an on-site audit

ISO 27001 deals with information security, so it matters wherever a company holds data that belongs to someone else. In the Solothurn region that covers a broad mix of businesses. Some of them are listed below.

The request rarely starts inside the company. It arrives as a line in a supplier questionnaire, a requirement in a tender or a question during a customer audit. A company that has to answer that no information security management system exists weakens its offer, however good the product is.

IT service providers and software companies

Customers hand over systems and data, and their purchasing departments ask for proof of how that data is protected.

Industrial suppliers

Manufacturers that deliver to larger groups receive security questionnaires along with drawings, specifications and order data.

Fiduciary, legal and consulting firms

Client files, payroll data and contracts sit on your systems. Clients increasingly ask how you protect them.

Healthcare and care providers

Patient and resident data is sensitive by nature and calls for a documented approach to access and incident handling.

Online shops and web services

Customer accounts, orders and payment-related processes make information security part of the sales conversation.

• ISO standards for small and medium businesses

The standard describes how an information security management system (ISMS) is built. Its core is the risk assessment: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among other topics.

In practice, six requirements carry the work.

1. 01

   Assess information security risks

   You identify what could go wrong with your information and how serious it would be.

2. 02

   Define a security policy and objectives

   Management states what the company protects and what it wants to achieve.

3. 03

   Implement security controls from Annex A

   You choose the controls that answer your risks, such as access rights, backups or supplier management.

4. 04

   Prepare a Statement of Applicability

   This document lists the controls you apply and explains why others do not apply.

5. 05

   Raise awareness and train employees

   People who handle data every day need to know the rules and the reasons behind them.

6. 06

   Manage security incidents and learn from them

   Incidents are recorded, handled and used to improve the system.

• ISO 27001 standard page

The classic route means a certification body sends auditors to your premises. That takes preparation, audit days and staff who are free to answer questions. The online route replaces the visit with a structured self-assessment. The location of your office makes no difference to either the process or the result.

• Compare the certification routes
• Certification without an on-site audit

Zertify is an online platform with no office in Solothurn. It does not need one. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education, and SICE reviews every assessment before the certificate is issued. The certificate is based on your self-assessment, not on a visit.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. Companies that certify two standards receive 20% off, three or more receive 30%, and the discount also applies to the yearly fee.

Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.

• ISO 27001 at Zertify
• Prices and discounts
• Start the free self-assessment

You can do all of this from your desk in Solothurn. Prepare your ISMS documents beforehand, because the questions refer to what your company actually has in place.

1. 01

   Start the self-assessment

   It is free and needs no registration. You see all 48 questions and answer each with yes or no.

2. 02

   Meet the pass conditions

   13 of the questions are mandatory requirements of the standard, and all 13 must be answered yes. Of the other 35 questions, at least 24 need a yes.

3. 03

   Pay and submit

   After passing you pay for the first year. SICE reviews your assessment before anything is issued.

4. 04

   Receive the certificate

   The PDF arrives within 4 hours after passing and payment. It carries a certificate number and a QR code.

5. 05

   Repeat the check each year

   A short online re-audit confirms the certificate every year. It is included in the yearly fee.

• How the process works

Attach the PDF to your next quote or tender submission, or link it in your reply to a supplier questionnaire. The QR code on the PDF leads to a public verification page. A purchasing department can confirm the certificate by its number without writing to you.

Because the re-audit takes place every year, the certificate stays current while you keep your ISMS up to date. Cost questions that come up before you decide are covered in the guide on certification cost.

• What ISO certification costs
• General questions and answers