ISO 27018 duration: from months to a few hours

It depends on the route. The classic route runs in phases, and each phase waits for the previous one: you prepare, you write documents, then you book two audits. Indicatively, that adds up to three to nine months for a small cloud provider.

The Zertify route has no phases of this kind. You complete an online self-assessment, SICE reviews it, and G6 Agency AG issues the certificate under licence from SICE. The time from the first question to the certificate is counted in hours, not in quarters.

• Start the free self-assessment

The figures for the classic route are indicative ranges for a small cloud provider. Your own timeline depends on company size, existing documentation and the calendar of the certification body.

• Certification without an on-site audit

Most of the elapsed time is not audit time. It is the work before the audit and the waiting between steps.

Preparation

You define the scope: which cloud services process personally identifiable information (PII) as a processor. Then you compare your current practice with the ISO 27018 controls and list the gaps.

Documentation

You write or update policies and procedures for purpose limitation, deletion and return of PII, sub-processor management and breach notification. This phase takes the longest when nothing exists yet.

Stage 1 audit

The auditor reviews your documents and judges whether you are ready for the full audit. Gaps found here go back to you for correction.

Stage 2 audit

The auditor visits and checks whether the controls work in daily operation. Expect questions about a real deletion request, your sub-processor contracts and the steps after a data breach.

• ISO 27001 certificate

Four points cause most of the slippage in a classic certification project.

1. 01

   No security management system yet

   If ISO 27001 style foundations are missing, you build them first. That alone can add weeks.

2. 02

   Unclear sub-processor chain

   You need to know every sub-processor that touches PII and have a contract that fits. Collecting this from suppliers often takes longer than the audit itself.

3. 03

   Deletion and return never tested

   Auditors want to see that PII can be returned and deleted on request. A procedure that exists only on paper gets sent back.

4. 04

   Auditor availability

   Stage 1 and stage 2 are booked into the auditor's calendar. A missed date can move the next slot by several weeks.

The self-assessment for ISO 27018 has 32 yes/no questions and takes about an hour. Eleven of them are mandatory requirements of the standard and must all be answered yes. Of the other 21, at least 14 must be yes to pass. Once you have passed and paid, the certificate arrives within 4 hours. It carries a number and a QR code that lead to a public verification page, so a customer or purchasing department can check it without contacting you.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years and confirmed each year by a short online re-audit. You do not need an account to buy.

If the assessment shows a mandatory gap, the time you need is the time to close that gap. The assessment tells you exactly where it is.

• ISO 27018 certificate
• Pricing
• Start the free self-assessment