ISO 27001 without audit: the online certificate for your company

In the classic route, an auditor comes to your premises, reads your documents and interviews your staff. With Zertify, you carry out that check yourself, against a fixed set of questions based on ISO 27001:2022. The questions are the same for every company, so the result does not depend on who happens to be in the room.

1. 01

   Answer 48 yes/no questions

   Each question refers to a requirement or control of the standard. You answer from your own documents and practice.

2. 02

   Meet the 13 mandatory requirements

   These cover the core of the standard, such as risk assessment, security policy and Statement of Applicability. All 13 must be answered yes.

3. 03

   Reach 24 yes answers among the other 35

   The remaining questions allow some room. At least 24 of the 35 must be yes to pass.

4. 04

   SICE reviews the assessment

   Before any certificate is issued, SICE looks at your answers. Only then does G6 Agency AG issue the certificate.

• Start the free self-assessment
• See how it works

It confirms that your company has assessed itself against ISO 27001:2022, that the assessment met the pass criteria and that SICE reviewed it. It does not confirm that an auditor inspected your server room or interviewed your team. That is the difference to the classic route, and you should state it plainly when a customer asks.

Basis

The self-assessment against ISO 27001:2022, with the 13 mandatory requirements all answered yes.

Issuer

G6 Agency AG, under licence from SICE.

Verification

Every certificate carries a number and a QR code on the PDF. A purchasing department scans the code or enters the number on the public verification page.

Validity

Three years. Each year a short online re-audit confirms that your answers still hold.

The route fits small and medium businesses that are asked for proof of information security and have no reason to wait months for it. Typical cases are IT service providers and software companies, cloud service providers, e-commerce and online services, and firms in finance or healthcare that handle sensitive customer data.

The trigger is usually a document: a supplier questionnaire with a line on ISO 27001, a tender that asks for a certificate, or a customer that wants evidence before signing. A verifiable certificate answers that line directly. Whether a particular customer accepts a certificate without an on-site audit is worth asking before you buy, especially in regulated sectors.

The assessment also suits companies that already work with a security policy and a risk register but have never had them confirmed. If you have neither, the questions will show you the gaps before you spend anything.

• ISO for small and medium businesses
• Guide: certification without an on-site audit

The main differences are the way compliance is checked, the time it takes and what you pay. Figures for the classic route are indicative ranges and vary with company size, scope and certification body.

• Guide: what certification costs

You take the self-assessment on the website without registration. If you pass, you pay and the certificate is issued within 4 hours. You do not need an account to buy. The details of the standard are on the ISO 27001 page.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. It is an automatic yearly subscription. You cancel in your customer account at any time to the end of the current year, and the certificate then ends with the paid year. Customers in Switzerland and Liechtenstein pay prices that include 8.1% VAT.

If you certify to more than one standard, you get 20% off for two standards and 30% off for three or more. The discount also applies to the yearly fee.

• ISO 27001 certificate
• Prices and discounts
• Start the self-assessment

Choose the classic route if a customer contract or tender names an on-site audit by a certification body. In that case a certificate based on a self-assessment will not meet the requirement, however well your ISMS runs.

The same applies if you want an external auditor to test your controls in practice, for example before a major security investment. A self-assessment confirms your answers. It does not test them.

In every other case, the online route gives you a verifiable ISO 27001 certificate in hours instead of months, and the guide below shows how the two routes compare in detail.

• Compare the certification routes
• General questions and answers