ISO 27001 in St. Gallen: certified online, without an on-site audit

ISO 27001 matters wherever a customer hands you data or depends on your systems. St. Gallen is a commercial centre, so the businesses that come under this standard are the same kinds you find in any Swiss city. The request rarely comes from a law. It comes from a supplier questionnaire, a tender or a contract clause.

IT service providers and software companies

Customers want evidence that access rights, operations and development are under control. Questionnaires from larger buyers name the certificate directly.

Cloud service providers

You host data that belongs to others. The standard shows how you protect it and how you handle incidents.

Financial service providers and banks

Institutions in this sector expect their own suppliers and outsourcing partners to demonstrate information security.

Healthcare

Patient and health data call for documented risk management and clear responsibilities.

E-commerce and online services

Customer accounts, addresses and payment-related data are your daily material, and buyers on the other side of a contract notice that.

Companies handling sensitive customer data

Fiduciary firms, consultancies and HR service providers fall into this group when clients ask how their documents are protected.

• ISO standards for small and medium businesses

ISO 27001:2022 describes how to build an information security management system (ISMS). The risk assessment sits at its core. It decides which Annex A controls you implement and why. The 2022 edition revised these controls and covers cloud services, data protection and cyber risks, among other topics.

1. 01

   Assess information security risks

   You identify what could go wrong with your information, rate it and decide how to treat it. This belongs to clause 6, Planning.

2. 02

   Define a security policy and objectives

   Management sets the direction in writing. Clause 5, Leadership, makes this a task for the top, not for IT alone.

3. 03

   Implement security controls from Annex A

   You apply the controls your risk assessment calls for, for example access management, backup and supplier relationships.

4. 04

   Prepare a Statement of Applicability

   The SoA lists every Annex A control, states whether it applies and gives the reason.

5. 05

   Raise awareness and train employees

   People who handle data need to know the rules. Clause 7, Support, covers competence and awareness.

6. 06

   Manage security incidents and learn from them

   You record incidents, respond and feed the findings back into the system. Clause 10, Improvement, closes that loop.

The classic route means a certification body sends an auditor to your premises. That requires appointments, preparation days and staff available for interviews. The online route moves the same effort into a structured self-assessment you complete at your own desk.

• Compare the certification routes
• Certification without an on-site audit

Zertify is an online service. It has no office in St. Gallen and needs none, because the whole process runs in your browser. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued.

The self-assessment for ISO 27001 has 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35, at least 24 need a yes. You do not need an account to buy.

The certificate costs CHF 849 in the first year, then CHF 569 per year including the yearly online re-audit. It is valid for 3 years and billed as an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. Prices include 8.1% Swiss VAT. If you certify against two standards you get 20% off, with three or more 30%, also on the yearly fee.

• Start the free self-assessment
• ISO 27001 standard page
• Pricing

Preparation takes longer than the assessment itself. A company with a working risk assessment and written policies can answer the questions in one sitting.

1. 01

   Gather your documents

   Have your risk assessment, security policy, Statement of Applicability and training records at hand. Name the person responsible for information security.

2. 02

   Answer the 48 questions

   Go through them honestly. A no on any of the 13 mandatory questions means a requirement is still open in your ISMS.

3. 03

   Close gaps before you continue

   Fix what is missing, for example an unwritten incident procedure or an outdated risk list, then pass the assessment.

4. 04

   Pay and receive the certificate

   After you pass and pay, the certificate arrives within 4 hours as a PDF with a number and a QR code.

5. 05

   Repeat the check each year

   The short online re-audit confirms that your ISMS still meets the requirements. Its cost is part of the yearly fee.

• How it works in detail

Attach the PDF to a quote or send it to a customer's purchasing department. Every certificate can be checked publicly by its number or by scanning the QR code, which leads to the verification page. The buyer does not have to take your word for it.

Be clear about what the certificate rests on: an online self-assessment, reviewed by SICE, confirmed every year. It is not the result of an on-site audit. For most questionnaires that is sufficient. If a customer audit explicitly demands the classic route, you will know before you start.

• What ISO certification costs
• All ISO standards at a glance