ISO 27001 in Thun: certification online, without an on-site audit

Thun and the surrounding region host businesses from many sectors. Whether you need ISO 27001 depends less on your address than on your customers. The standard is asked for wherever a company handles information that belongs to someone else.

The following kinds of businesses meet the requirement most often, in Thun as anywhere in Switzerland.

IT service providers and software companies

Customers want proof that their data is handled under a defined security management system.

Cloud service providers

Hosting and platform operators are asked about access control, backup and incident handling in almost every contract.

Financial service providers

Banks and their suppliers pass security requirements down the chain to every service provider.

Healthcare

Patient data is sensitive, so practices, clinics and their IT suppliers are asked how it is protected.

E-commerce and online services

Customer accounts and payment-related data make a documented security approach a common purchasing criterion.

Companies with sensitive customer data

Fiduciaries, consultancies and agencies hold contracts, financial figures and personal data for their clients.

• ISO standards for small and medium businesses

The classic route with an on-site audit by a certification body means auditors visit your premises, interview staff and inspect documents on location. Dates have to be coordinated with their calendar and with your team. The online route moves the assessment to a questionnaire and drops the visit.

The table sets the two routes side by side.

• Compare the certification routes
• Certification without an on-site audit

ISO 27001:2022 sets out how an information security management system (ISMS) is built. At its core is the risk assessment: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among others.

In practice, six requirements carry the work.

1. 01

   Assess information security risks

   You identify what could go wrong with your data and systems, and rate each risk. This belongs to clause 6, Planning.

2. 02

   Define a security policy and objectives

   Management writes down what it wants to protect and what it aims to achieve.

3. 03

   Implement security controls

   From Annex A you select the controls that answer your risks, such as access rights, backup or supplier checks.

4. 04

   Prepare a Statement of Applicability

   The SoA lists every Annex A control, states whether it applies and gives the reason.

5. 05

   Raise awareness and train employees

   Staff need to know the rules and their own part in them.

6. 06

   Manage security incidents and learn from them

   Incidents are recorded, handled and used to improve the system.

Zertify has no office in Thun and does not need one. The assessment, the review and the certificate all run online, so the process is identical for a company in Thun and one anywhere else in Switzerland.

The self-assessment for this standard has 48 yes/no questions. 13 of them are mandatory requirements of ISO 27001 and must all be answered yes. Of the other 35 questions, at least 24 need a yes. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before it is issued.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you can cancel at any time in your customer account, effective at the end of the current year; the certificate then ends with the paid year. If you certify for two standards you get 20% off, for three or more 30%, also on the yearly fee. Customers in Switzerland and Liechtenstein pay prices that include 8.1% VAT. You do not need an account to buy.

• ISO 27001 at Zertify
• Pricing
• Start the free self-assessment

The path is short, but the answers should be accurate. Each yes states that your company meets a requirement.

1. 01

   Read the questions first

   Go through the 48 questions with whoever runs IT and with management. Gaps show up before you commit to anything.

2. 02

   Close open points

   If a mandatory question is still a no, for example a missing risk assessment or policy, fix it and answer again.

3. 03

   Complete the self-assessment

   Answer all questions online. All 13 mandatory requirements need a yes, plus at least 24 yes among the other 35.

4. 04

   Pay and receive the certificate

   After SICE has reviewed the assessment and you have paid, the certificate follows within 4 hours.

5. 05

   Confirm it every year

   A short online re-audit keeps the certificate current. It is included in the yearly fee.

• How it works

Many supplier questionnaires and tenders ask whether you hold ISO 27001. You answer with the certificate number and attach the PDF.

Every certificate carries a QR code on the PDF. It leads to a public verification page, where anyone can check the certificate by its number. A purchasing department or a customer auditor does not have to write to you to confirm it.

• What certification costs