code
Q
ISO/IEC 27001:2022 – Certification of information security management systems
The current landscape of threats facing organisations is characterised by cyberattacks, data breaches and abuses of data protection. Are you equipped to deal with these threats? Be ready for any situation and strengthen your information security with ISO/IEC 27001:2022. This internationally recognised norm offers a systematic framework for guaranteeing and continually improving information security. It minimises risks, improves an organisation’s approach to security incidents and increases the trust of your customers and partners. An SQS-certified information security management system (ISMS) compliant with ISO/IEC 27001:2022 underscores your commitment to the confidential handling of sensitive data. A robust security infrastructure not only fulfils compliance requirements, but strengthens your brand too.
ISO/IEC 27001 Product Manager
Simon Maurer
Accreditation by the Swiss Accreditation Service (SAS)
Our certificates are valid and recognised internationally
We have been certifying management systems since 1983
More than 9 000 customers trust our services
Information security management in accordance with ISO/IEC 27001:2022
ISO/IEC 27001:2022 is the global norm for information security management systems. Its comprehensive catalogue of requirements enables your organisation to keep processes and workflows in line with the latest technical specifications at all times. By the way: the number «2022» refers to the year the standard was last revised. Like all ISO norms, ISO/IEC 27001 is regularly reviewed and developed to ensure it consistently aligns with the current requirements of information security.
Certification by the SQS
The SQS ISO/IEC 27001:2022 certificate is an assurance to customers and other stakeholders that your organisation complies with the highest of information security standards. The certificate is valid for three years. Following initial certification, a maintenance audit takes place in the two subsequent years. These audits check compliance with the standard requirements and the further development of the management system. However, they are more than just monitoring visits: the experienced SQS auditors offer valuable insights and information on how to achieve continual improvement for your organisation.
Recognition and accreditation
Not every ISO certificate is of equal value. In terms of a certificate’s recognition on the market, the competence and reputation of the certification body is crucial.
SQS is Switzerland’s leading provider of management system certificates by some distance. It was the first body to be licensed by the Swiss Accreditation Service (SAS). This federal authority monitors the certification bodies, examining the aptitude and compliance of their auditors. What is more, SQS is part of an international network.
For this reason, SQS certificates for management systems in accordance with ISO/IEC 27001 and many other ISO norms are recognised on all continents. They are your key to unlocking new markets.
Combination of certificates
Many of our customers who work with ISO/IEC 27001 combine their certifications. In doing so, ISO 9001 for quality management serves as the basic norm. Other subject matters and norms can be integrated – for example, ISO 14001 on environmental management, ISO 45001 on occupational health and safety, ISO 26000 on social responsibility, ISO 31000 on risk management and ISO 50001 on energy management. This creates important channels of cooperation.
The harmonised structure of ISO norms simplifies such integrated management systems, as the different norms feature the same topics and core texts. This way, you can avoid duplications, make the most of synergies and improve and certify your organisation with respect to different objectives.
Hello, I am Simon Maurer
Would you like to improve information security in your organisation or certify your existing measures? Our Account Management team, our auditors and myself as Product Manager would be happy to support you. At a time when cyber threats and data protection requirements are constantly increasing, it is strategically vital to maintain your information security operations at the highest level. Our goal is to make the certification process as easy and beneficial for you as possible.
Please let us know how we can help. We look forward to hearing from you!
Kind regards,
Simon Maurer
Protection and risk minimisation
ISO/IEC 27001:2022 allows you to protect critical data, minimise security risks and promote effective risk management – all essential in the face of increasing cyberattacks and data leaks. A certified ISMS supports the productivity and quality of your services by creating a secure environment.
Reputation and credibility
ISO/IEC 27001:2022 certificates are recognised worldwide and elevate the credibility of your company. This international recognition in combination with the 'Swissness' of SQS certificates reinforces the trust of customers, authorities and other stakeholders on a fundamental level.
Compliance and legal certainty
The norm promotes security-oriented management that regulates, monitors and improves a company’s internal processes, in turn ensuring that legal requirements are more effectively fulfilled and that legal certainty is increased.
Continual improvement
ISO/IEC 27001 places great value on continual improvement. As part of the annual audits, SQS experts provide you with valuable information on how to eradicate weak points and further develop strengths. There is always room for improvement; after all, the threat situation is always changing!
Proactive and forward-looking management
ISO/IEC 27001 requires organisations to monitor context in order to recognise risks and opportunities at an early stage, resulting in proactive action and improved strategic planning. This helps ensure you do not miss relevant developments and allows you to take a forward-looking approach.
Tool for information security
A certified ISMS contributes to information security by guaranteeing that data security processes correspond to the growing expectations of stakeholders for a responsible approach to data.
If you feel well versed in all things ISMS, you can register for certification using the above form. Otherwise, your path to ISO certification could appear as follows:
#1 – Training/establishing a ISMS
Our experienced auditors share their specialist knowledge as part of practice-based tutorials on ISO/IEC 27001. Ensure optimal preparation for the implementation of the ISMS and the certification of your company.
#2 – Register for certification
After you have registered for certification, you may benefit from a preliminary meeting or preliminary audit. The preliminary audit identifies system-relevant gaps and enables efficient certification.
#3 – Auditing
First we review your system documentation, assess your readiness for certification and create a detailed audit plan together with you. Then our auditors visit your company to review the relevant audit items and prepare a report.
#4 – Certificate valid for three years
If the report is positive, you will receive a digital and printed copy of your ISO/IEC 27001 certificate. You can communicate this both internally and externally for three years. Annual inspections ensure compliance with the norm and facilitate continual improvement. After three years, a comprehensive recertification process is carried out.
Endress+Hauser
17 000 employees – measurement and automation technology sector
The challenge
«Information security is a key success factor when it comes to digital transformation. As a leading provider of measuring devices and automation solutions, Endress+Hauser is required to ensure the security and confidentiality of customer data. The increasing digitalisation of our products and services as well as the focus on the ‘industrial internet of things’ broaden the requirements for the protection of sensitive data and systems.»
Solution
«By introducing an information security management system (ISMS) in accordance with ISO/IEC 27001, we have created a solid foundation to systematically identify and minimise risks. The norm provides us with clear specifications for technical and organisational protective measures, which are supplemented by ISO/IEC 27017 specifically for our Netilion cloud. Our SQS certification ensures that our security standards are continually reviewed and improved. This enables us to guarantee the security of our devices, cloud services and the entire organisation, which not only strengthens the trust of our customers, but also gives us a decisive competitive advantage.»
Steve North, Information Security Manager
How long does it take to obtain an ISO/IEC 27001 certificate?
+
The length of the ISO/IEC 27001 certification process depends on various factors: for example, the size and complexity of the company, the competence of the employees involved, the software solution and the time available to develop the system. It typically takes between six and twelve months to work through the processes and applicable documents and prepare for the certification audit. The audit lasts at least a day, while for larger companies, it can take several days.
How often does an ISO/IEC 27001 certificate need to be renewed?
+
After successful initial certification, the company receives a certificate valid for three years. In each of the two subsequent years, a maintenance audit is carried out, which is smaller in scope. This audit ensures that the requirements of the norm are being met on an ongoing basis and that the company is continuing to develop. Before the certificate expires, a recertification audit is carried out, and a new cycle begins.
What costs are associated with ISO/IEC 27001 certification?
+
The costs depend on various factors: for example, the size and complexity of the company, the number of full-time employees and the number of sites that are to be certified. One-off or recurring costs for developing and operating the system should be taken into account, for example internal human resource expenditure, training for staff, consultation fees and licences for process management software. We recommend preparing a statement of costs in advance. IOS/IEC 27001 certification is of strategic importance and represents an investment in the future of the company.
Does SQS also offer consultation services?
+
SQS is a certification body licensed by the Swiss Accreditation Service (SAS). Consequently, we are prohibited from advising you when developing an ISMS. The separation between advice and certification is critical to our independence and hence for the credibility of our certificates. Despite this, we do offer tutorials on designing and further developing management systems. These tutorials are conducted by our auditors, all of whom have the necessary practical experience.
What role does the certification body play in ISO/IEC 27001 certification?
+
The certification body is responsible for carrying out the certification audit in accordance with regulatory provisions and for examining the company for compliance with the requirements of ISO/IEC 27001. It is important to opt for a certification body like SQS, which is recognised by a national accreditation service. This is the only way to ensure that your certificate will enjoy widespread (including international) recognition.
How can a company check the validity of an ISO/IEC 27001 certificate?
+
All valid certificates issued by SQS can be found on our website under Certified organisations. To search for a company, enter the registration number.
Can a company have several certifications at the same time?
+
Yes, a company can have multiple certifications simultaneously, for management systems in accordance with ISO 9001 (quality management), ISO 14001 (environmental management), ISO 45001 (occupational health and safety), ISO/IEC 27001 (information security) and others. These norms complement one another and enable companies to create an integrated management system that takes into account the different requirements of customers, employees and other stakeholders.
What happens if a company does not fulfil the requirements of ISO/IEC 27001?
+
If the requirements of the norm are not fulfilled and the lead auditor raises so-called major or minor nonconformities, the company must remedy these within a pre-defined period. If the company is not able to do this, the certification body may impose a suspension of a maximum of six months or abandon the certification process. However, these cases are extremely rare.
The company should ensure that all employees understand the requirements of the norm and are able to implement them in their daily operations. Tutorials and training programmes can help to raise awareness of the norm and its benefits and, in this way, to ensure the ISMS is operated effectively and efficiently.
How does an ISMS help me comply with GDPR requirements?
+
The European Union General Data Protection Regulation (GDPR) is also relevant for many organisations in Switzerland. An information security management system (ISMS) in accordance with ISO/IEC 27001 supports compliance with GDPR requirements in a variety of ways. It implements robust security measures that protect personal data against unauthorised access and loss. A structured risk management system enables companies to identify and systematically minimise potential risks when handling data. An ISMS is designed to aid compliance with legal and regulatory requirements by continually monitoring and improving relevant processes. In addition, it supports comprehensive documentation and transparency in data processing, which is essential when it comes to meeting GDPR provisions.
How is ISO/IEC 27001:2022 different to ISO/IEC 27001:2013?
+
ISO/IEC 27001:2022 contains multiple important changes compared to ISO/IEC 27001:2013. The main changes include updating the controls in Annex A to align with the changing technological and threat landscapes, the introduction of new controls to mitigate cloud security risks and improvements to the risk management process. Furthermore, clarifications and improvements were made to simplify the implementation and use of the norm. These changes are designed to make information security more effective and in keeping with the times. A transition phase of 36 months was specified to convert the ISMS according to the adapted norm.
How can an ISMS in accordance with ISO/IEC 27001 help small and medium-sized businesses (SMEs) in particular?
+
An ISMS in accordance with ISO/IEC 27001 is particularly valuable for SMEs, which often do not have the same IT resources as large companies. It provides a structured approach to information security, incorporating tailored and cost-effective SME solutions. This norm helps companies systematically and efficiently identify and minimise risks, whereby data integrity and confidentiality are guaranteed. By implementing clear security guidelines and undergoing regular audits, compliance with legal requirements is ensured, the trust of customers and partners is strengthened and operational efficiency is improved. An ISMS enables SMEs to achieve a high level of security and protect themselves against various cyber threats, even with limited resources.
How does ISO/IEC 27001 support companies with implementing security guidelines and protocols in the cloud?
+
ISO/IEC 27001 provides a comprehensive framework into which security requirements of cloud environments can also be integrated. The norm contains updated controls that address risks such as unauthorised access, data loss and security breaches in the cloud. Organisations are called on to develop and implement clear security guidelines and protocols which conform to the highest security standards, including for cloud services. Regular audits help improve these measures continually and adapt them to new threats. This ensures that sensitive data in the cloud remains protected and compliance with the relevant security standards and legal requirements is guaranteed.
How do ISO/IEC 27001 on information security and ISO/IEC 42001 on artificial intelligence complement one another?
+
ISO/IEC 27001 and ISO/IEC 42001 complement one another and provide comprehensive protection and principles for information and AI systems. By implementing both standards, companies can ensure that their AI systems are not only secure, but also ethically sound and therefore responsible. While ISO/IEC 27001 covers general information security and protection against cyber threats, ISO/IEC 42001 focuses on the specific challenges of AI, such as transparency, fairness and ethics. This combination strengthens the trust of customers and partners alike and ensures compliance with legal and regulatory requirements, resulting in a more robust and more responsible use of information and AI technologies.
