ISO 27001 in Zurich: certified online, without an on-site audit

Yes. Zertify is an online service and has no office in Zurich. Everything happens in the browser: the self-assessment, the payment and the delivery of the certificate as a PDF. Your team stays at its desks. There are no site visits, no travel days and no appointments to coordinate with an auditor.

ISO 27001:2022 describes how an information security management system (ISMS) is built. At its core is the risk assessment. It decides which Annex A controls you implement and why. The certificate you receive from Zertify is based on your online self-assessment, not on an on-site audit.

• ISO 27001 at Zertify
• Certification without an on-site audit

Zurich is a financial centre and home to many software and IT companies. Requests for ISO 27001 follow the data you handle, not your postcode. The following groups meet the requirement most often.

IT service providers and software companies

Larger customers ask for proof of an ISMS in supplier questionnaires and tenders.

Cloud service providers

Customers want to know how you protect data that sits on your infrastructure.

Financial service providers and banks

Their own suppliers are often asked to show how they manage information security.

Healthcare

Patient data is sensitive, and partners expect documented protection.

E-commerce and online services

Customer accounts and payment-related data make security a purchasing criterion.

Companies handling sensitive customer data

Any business that holds confidential customer files can be asked to prove it manages the risk.

The classic route with an on-site audit by a certification body means auditors come to your premises and examine your ISMS in person. The online route replaces that visit with a structured self-assessment. The table shows the practical differences.

• Compare the certification routes
• Certification cost explained

The standard follows the high level structure: context (clause 4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). The risk assessment sits in planning and drives everything after it. These are the key requirements.

Risk assessment

You identify information security risks, rate them and decide how to treat them.

Policy and objectives

Management approves a written security policy with objectives you can check.

Annex A controls

You implement the controls your risks call for. The 2022 edition covers cloud services, data protection and cyber risks, among others.

Statement of Applicability

This document lists the controls you apply, why you apply them, and which ones you leave out.

Awareness and training

Employees know the policy and their own part in protecting information.

Incident management

Security incidents are recorded, handled and analysed so that you learn from them.

The process is the same for every company, wherever it is based.

1. 01

   Prepare your documents

   Have your security policy, risk assessment, Statement of Applicability, training records and incident log at hand.

2. 02

   Start the self-assessment

   It is free, and you need no account to begin. You answer 48 yes/no questions for ISO 27001:2022.

3. 03

   Pass the assessment

   13 of the questions are mandatory requirements of the standard and must all be answered yes. Among the other 35, at least 24 must be yes.

4. 04

   Pay and receive the certificate

   Within 4 hours after passing and payment, you receive the certificate as a PDF with a certificate number and a QR code.

5. 05

   Confirm it every year

   A short online re-audit keeps the certificate current. The certificate is valid for 3 years.

• How it works

The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). SICE reviews every assessment before the certificate is issued. Anyone, such as your purchasing contact or a customer running an audit, can check the certificate on the public verification page by number or by scanning the QR code on the PDF.

The price is CHF 849 in the first year, then CHF 569 per year including the yearly online re-audit. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. If you certify against two standards you receive 20% off, and 30% off for three or more, also on the yearly fee.

• ISO 27001 standard page
• Pricing
• Start the free self-assessment