ISO 27001 in Zug: certified online, without an audit visit

ISO 27001:2022 sets out how an information security management system (ISMS) is built. At its core is the risk assessment: it decides which Annex A controls you implement and why. The 2022 edition revised the controls and covers cloud services, data protection and cyber risks, among other topics.

The requirements are the same wherever your company is registered. A firm in Zug is measured against the same standard as one in Lausanne or Hamburg. These are the six requirements you work through:

Risk assessment

You identify and rate the information security risks that affect your business.

Policy and objectives

You write a security policy and set objectives that management signs off.

Annex A controls

You implement the controls your risk assessment calls for.

Statement of Applicability

You document which controls apply and why others do not.

Awareness and training

Employees know the rules and their own part in them.

Incident management

You record security incidents, deal with them and change what failed.

• ISO 27001 at Zertify

Zug is widely known as a base for financial services, technology companies, blockchain businesses and trading firms. Many of them handle data that belongs to someone else. That is usually the moment a customer asks for proof, in a supplier questionnaire, a tender or a contract review.

IT service providers and software companies

Your customers run their own systems on top of your service. They want to know how you protect them.

Cloud service providers

Hosting customer data makes your security controls part of your customers' risk.

Financial service providers and banks

Outsourcing partners and suppliers are examined by the institutions they work for.

Healthcare

Patient and health data call for documented protection.

E-commerce and online services

Customer accounts, addresses and payment-related data sit in your systems.

Companies handling sensitive customer data

Any firm that stores confidential client information can be asked to show a certificate.

The classic route with an on-site audit by a certification body means auditors come to your premises, read your documents and speak to your staff. Dates are agreed with the certification body, and costs are quoted individually. The online route replaces the visit with a structured self-assessment that SICE reviews.

• Compare the certification routes
• Certification without an on-site audit

Zertify is an online service. It has no office in Zug and no auditors stationed there, and none are needed: the assessment, the review and the delivery all happen online. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is released.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing runs as an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year.

Swiss customers pay prices that include 8.1% VAT. If you certify more than one standard, you get 20% off for two and 30% off for three or more, on the yearly fee as well. You do not need an account to buy.

• ISO 27001 certificate
• Prices and discounts
• Start the free self-assessment

Have your security policy, risk assessment and Statement of Applicability at hand before you begin. A no on a mandatory question shows you exactly which requirement is still missing.

1. 01

   Open the self-assessment

   It is free and needs no registration. You answer 48 yes/no questions about your ISMS.

2. 02

   Meet the pass rule

   13 of the questions are mandatory requirements of the standard and must all be answered yes. Of the other 35, at least 24 need a yes.

3. 03

   Pay and receive the certificate

   After passing and payment, the certificate arrives within 4 hours as a PDF. SICE has reviewed the assessment by then.

4. 04

   Confirm it every year

   A short online re-audit is part of the yearly fee. No one comes to your office for it either.

• How it works

Every Zertify certificate carries a number and a QR code on the PDF. Anyone can enter the number or scan the code and land on a public verification page. A purchasing department or an auditor in Zug can confirm in seconds that the certificate exists and is valid.

You can put the PDF into a quote, attach it to a supplier questionnaire or send the verification link with a tender. The yearly re-audit keeps the entry current.

• Guide on certification cost
• ISO for small and medium businesses