Who is it for?

The TISAX information security assessment standard is intended for all companies in the automotive industry and their business partners. These include:

• car manufacturers,
• manufacturers of automotive components and parts,
• IT service providers,
• advertising agencies,
• companies providing industry training,
• research institutes.

Information about the standard

TISAX (Trusted Information Security Assessment Exchange) is an international standard for information security assessment in the automotive industry. It is based on the VDA ISA questionnaire, which was developed in accordance with the ISO 27001 standard. The TISAX model defines the conditions for maintaining the required level of confidentiality when exchanging information between entities involved in the automotive industry. TISAX guarantees a uniform level of data security.

Companies operating in the automotive sector must not only meet the highest standards of information security, but also need to continually demonstrate the quality of their standards when working with other companies. The basis for their assessment is the requirements developed by the German Association of the Automotive Industry (German: Verband der Automobilindustrie – VDA) and set out in the VDA ISA catalogue. These guidelines have long been the cornerstone of information security in the automotive industry. Until recently, however, VDA ISA audits were carried out at the request of a company interested in collaborating with a given entity. The consequence was that the entity was subjected to frequent inspections, which generated unnecessary time and financial costs. The TISAX standard, introduced by the VDA in 2018, was developed to standardise information security assessment mechanisms. This avoids a situation where each potential partner creates its own checklists. Currently, the TISAX model is used by hundreds of companies operating in the automotive industry across more than 40 countries.

The scope of the TISAX standard covers requirements relating to, amongst other things:

• database encryption,
• the use of two-factor authentication for systems processing sensitive data,
• the physical protection of prototypes (including, for example, procedures governing visitor access to secure areas),
• monitoring of KPIs in information security processes (e.g. access rights management),
• restrictions on the use of cloud solutions for data storage (e.g. technical documentation).

TISAX audits are conducted by bodies accredited by the ENX Association. The audit may take the form of a document-based audit or an on-site audit. It focuses on the assessment of objective evidence whilst taking risk factors into account. Should non-compliance with the VDA ISA standard be detected, the audited entity is obliged to implement corrective measures. A positive TISAX audit result demonstrates that the company maintains a level of security management in its operations that meets the requirements of potential partners. A TISAX audit may be conducted independently or as part of the implementation of an information security management system compliant with ISO 27001.

Benefits of implementation

Currently, all major automotive groups require compliance with the VDA ISA standard. A company that has implemented this standard and undergone a TISAX audit demonstrates its reliability to existing and potential partners, thereby avoiding additional checks before entering into a partnership.

A company that has passed the TISAX audit gains:

• a positive image in the eyes of business partners, customers and employees,
• the opportunity to build a lasting, positive relationship with them,
• a competitive advantage over other entities,
• an improvement in overall working conditions and better communication within the supply chain.