Why TISAX?

TISAX stands for “Trusted Information Security Assessment Exchange”. The so-called “TISAX Label” of the ENX Association, an association of European automotive manufacturers, suppliers and associations at European level, was introduced in 2017.

• The label serves as proof to the automotive industry that a supplier has a certain level of security.
• It must be renewed every three years.
• It is required by automotive manufacturers (OEMs) on a contractual basis from their suppliers.
• The TISAX label is based on a common, standardized assessment process implemented through accredited auditors.

In new service tenders, for example, suppliers are required to submit certificates in accordance with certain standards if they are awarded a contract. Often, suppliers then have a “grace period” of twelve months. If a supplier then fails to provide the required evidence, the OEM has the right to discontinue the contracts. Some OEMs also require further information security certifications, for example based on ISO 27001, the global standard for information security management.

ISO/SAE 21434 “Road vehicles – Cybersecurity engineering” is a new standard on the horizon that may become relevant for suppliers in the future.

The auditing

To obtain the TISAX label, the company must submit a self-disclosure in the form of a comprehensive questionnaire to a recognized auditing service provider. This self-disclosure is then reviewed by the auditors. For the highest level of the label, auditors will conduct interviews and on-site visits. The underlying VDA-ISA requirements catalog is based on the ISO 27001 and ISO 27002 security standards, but is more detailed in individual requirement specifications.

Five recommendations for a successful audit

1. Use the TISAX audit to implement an information security management system (ISMS):

Although a TISAX audit can be set up as a project, it must result in an ongoing security process. The company must constantly improve this and respond dynamically to changes in the environment. This includes, for example, new technologies, threats, vulnerabilities, or changes in the organization's activities such as new business areas. Companies that rest on their laurels after a successful initial certification will struggle to renew the TISAX label after three years. Companies with an existing ISMS, possibly even with ISO 27001 certification, can obtain and renew the TISAX label with manageable additional effort.

2. Receive support at all levels of management.

Significant personnel resources may be required for audit preparation and implementation. In addition, various specialist areas, central departments and managers must be involved in the auditing process. It is important that those responsible for information security secure the support of top management in advance and obtain the necessary resources.

3. Define the planned scope with care.

The TISAX label always applies to a specific company site. It is usually more efficient to audit several sites at once. Therefore, the current and potential auditing requirements for all sites must be carefully analyzed in advance. But a word of caution: An overall label can be jeopardized by the failure of a single site!

4. Avoid “mothware”.

Some people think that it is sufficient to fill in a large number of templates for security policies and concepts for an audit. This is by no means the case. Auditors attach great importance to verifying that information security is lived as a process. This evidence can be supported, for example, by meaningful KPIs and by fully maintained lists of risks, measures and security incidents.

5. Prepare the audit carefully.

This process starts with the detailed completion of the ISA questionnaire. It has proven useful to briefly and precisely summarize the implementation description and document references under a control question, especially for each MUST or SHOULD individual requirement. In the audit itself, the participants must have this information at hand and be able to present it without a long search. The external audit must be preceded by an internal audit to identify potential “open flanks”. Information security officers should conduct appropriate briefings in advance for all colleagues involved in the audit.

msg supports companies in achieving certification readiness for TISAX as well as for other common information security management standards and, at the same time, is itself audited according to TISAX in individual business units or locations as a supplier to the automotive industry.