ISO 27001 certification online
ISO 27001 in Winterthur: certification fully online
Zertify has no office in Winterthur, and you do not need a local one: the whole process runs online. You answer 48 yes/no questions about your information security, and the certificate is issued within 4 hours after you have passed and paid. No auditor visits your premises.
01: Context
Why a Winterthur company gets asked for ISO 27001
The request usually reaches you as a line in a supplier questionnaire, a tender document or a customer audit: do you hold an ISO 27001 certificate? The answer decides whether your quote moves on to the next round.
Where your office is makes no difference to the question. A company in Winterthur is measured against the same ISO 27001:2022 requirements as one in Zurich, Munich or Lyon. What does differ is the time you can spare. A site audit means coordinating diaries, receiving an auditor and pulling staff away from work for clients.
02: Industries
Which businesses in the Winterthur region need ISO 27001
The standard applies to any organisation that handles information. Some kinds of business are asked for it more often than others.
- IT service providers and software companies
- Customers give them access to systems and data, so purchasing departments want proof of how that access is protected.
- Cloud service providers
- Hosting and platform operators are expected to show a managed approach to availability, access and cyber risks.
- Financial service providers and banks
- They pass their own security requirements on to suppliers and expect evidence in return.
- Healthcare
- Patient data is among the most sensitive data a supplier can hold, and clinics and practices ask how it is protected.
- E-commerce and online services
- Shops and platforms store customer accounts and payment-related data, and larger partners ask how it is secured.
- Companies handling sensitive customer data
- Engineering firms, consultancies and agencies that hold customer plans, contracts or personal data belong here, whatever their sector.
A manufacturer or trading company with a handful of IT systems can receive the same questionnaire from a large customer.
03: The standard
What ISO 27001:2022 requires from you
ISO 27001:2022 sets out how an information security management system (ISMS) is built. At its core is the risk assessment: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among other topics.
In practice you assess information security risks, define a security policy and objectives, implement the controls from Annex A and record your choices in the Statement of Applicability (SoA). Employees are trained, and security incidents are managed and learned from. The clauses follow the usual ISO structure, from context (4) and leadership (5) to performance evaluation (9) and improvement (10).
04: Comparison
Classic on-site audit or online route
Both routes end with an ISO 27001 certificate. They differ in how evidence is collected and how much of your working time it takes.
| Aspect | Classic route with on-site audit | Zertify online route |
|---|---|---|
| Evidence | Auditor reviews documents and interviews staff on site | Online self-assessment with 48 yes/no questions, reviewed by SICE |
| Travel and appointments | Audit dates are agreed and staff must be available | None, you answer when it suits you |
| Follow-up | Further audits during the certificate cycle | Short online re-audit every year |
| Cost | Individual quote, depends on company size and scope | Fixed yearly price, see the pricing page |
| Proof for customers | Certificate as PDF or paper | Certificate PDF with QR code and a public verification page |
Some customers and tenders name the classic route explicitly. Read the wording of the requirement before you decide.
05: Zertify
How Zertify certifies companies in Winterthur
Zertify is an online platform with no office in Winterthur. The assessment, the review and the certificate all happen online, so nobody travels. The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education), and SICE reviews every assessment before the certificate is issued.
The price is CHF 849 in the first year, then CHF 569 per year including the yearly online re-audit. The certificate is valid for 3 years. If you certify more than one standard, you get 20% off for two standards and 30% off for three or more, also on the yearly fee.
06: Steps
The steps from first question to certificate
Six steps lead from the first question to a certificate you can attach to a quote.
Take the self-assessment
It has 48 yes/no questions. 13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 35, at least 24 need a yes.
Close the gaps
If you do not pass, you see which points are missing, for example a risk assessment, a security policy or a Statement of Applicability that has not been written yet.
Pay without opening an account
Once you have passed, you pay. No account is needed to buy.
Receive the certificate
SICE reviews your assessment, and the certificate is issued after that review.
Use it with your customers
Attach the PDF to quotes and supplier questionnaires. A purchasing department can enter the number on the verification page or scan the QR code.
Confirm it every year
A short online re-audit confirms the certificate each year.
07: FAQ
Questions about ISO 27001 in Winterthur
08: Guide
Related pages
Check where your company stands
Answer the 48 questions of the ISO 27001:2022 self-assessment and see whether you pass.
Free and without registration.