ISO 27018:2019 Cloud Privacy
ISO 27018 without audit: certificate by online self-assessment
You can get an ISO 27018 certificate without an auditor visiting your premises. You answer 32 yes/no questions online, SICE reviews the assessment, and G6 Agency AG issues the certificate within 4 hours of passing and payment.
01: Short answer
Is ISO 27018 possible without an on-site audit?
Yes. The Zertify certificate is based on an online self-assessment. Nobody comes to your office, and you do not have to block days in the calendar for interviews and document walk-throughs.
The certificate is not self-declared. G6 Agency AG issues it under licence from SICE, and SICE reviews every assessment before the certificate is released. Each certificate can be checked publicly by number and QR code.
The alternative is the classic route with an on-site audit by a certification body. It exists, and some customers ask for it. For many cloud providers, though, a supplier questionnaire or a tender only needs a certificate that the purchasing department can verify.
02: Self-assessment
How the self-assessment replaces the on-site visit
An on-site audit checks in person whether your processes match the standard. The self-assessment puts the same topics to you as direct questions: does the control exist, and can you stand behind the answer? There are 32 questions for ISO 27018, each answered with yes or no.
Answer the 32 questions
Eleven of them are mandatory requirements of the standard and must all be answered yes. Of the other 21 questions, at least 14 must be yes. The assessment is free and needs no registration.
SICE reviews your answers
The review happens before any certificate is issued. If you have not passed, you see where answers are missing.
Pay and receive the certificate
You buy without opening an account. The certificate arrives as a PDF with a certificate number and a QR code that leads to the public verification page.
Confirm it each year
A short online re-audit repeats the check every year. The certificate itself is valid for 3 years.
03: Scope
What the ISO 27018 certificate confirms
ISO 27018:2019 covers cloud providers that act as processors of personally identifiable information (PII) in the public cloud. It extends ISO 27001 with privacy controls and supports your obligations under the GDPR and the Swiss FADP.
The certificate confirms that your answers meet these requirements of the standard:
- Transparency
- Customers can see how their data is processed.
- Purpose limitation
- PII is processed only for the purposes the customer has instructed.
- Deletion and return
- Customers can have their PII deleted or handed back.
- Sub-processors
- Third parties are engaged in a privacy-compliant way.
- Impact assessments
- Data protection impact assessments are carried out.
- Breach notification
- Data breaches are reported as agreed with the customer.
It does not replace legal advice, and it does not certify your whole information security system. If you also need that, look at ISO 27001.
04: Suitable for
Which companies the online route suits best
The route fits small and medium cloud providers that process customer data and are asked to prove it. Typical cases are B2B and B2C SaaS vendors, HR and payroll software providers, e-commerce platforms and cloud providers in healthcare. If a customer's data protection officer sends you a questionnaire about sub-processors and deletion, this is your situation.
It suits you less if a contract or a tender names an on-site audit by a certification body as a condition. Read that clause before you decide. The guide on certification routes shows how the two paths differ.
05: Comparison
Online self-assessment or classic audit: time and cost
The figures for the classic route are indicative ranges. Quotes differ by certification body, company size and preparation effort.
| Criterion | Zertify online | Classic route with on-site audit |
|---|---|---|
| Format | 32 yes/no questions online, reviewed by SICE | Audit days on site with an auditor, plus preparation |
| Time to certificate | Within 4 hours of passing and payment | Indicatively several weeks to a few months |
| Cost | CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit | Indicatively several thousand francs for audit days, often more with consultancy |
| Yearly follow-up | Short online re-audit, included in the yearly fee | Surveillance audits, usually on site |
| Verification | Public page by number and QR code | Depends on the certification body |
06: Zertify
How Zertify fits in
Zertify issues ISO certificates based on a self-assessment, for small and medium businesses in Switzerland, Germany, Austria and France. The page for the standard lists all requirements and the scope in full.
The fee is an automatic yearly subscription. You can cancel at any time in the customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. Prices for Switzerland and Liechtenstein include 8.1% VAT.
If you certify several standards, you get 20% off for two and 30% off for three or more, on the yearly fee as well. A provider that already holds ISO 27001 can add ISO 27018 on this basis.
07: FAQ
Questions about ISO 27018 without audit
08: Guide
Related pages
Check your ISO 27018 readiness today
Answer the 32 questions online and see straight away whether you pass.
Free and without registration.