TISAX consulting process for automotive information security

Information security is essential when automotive businesses exchange sensitive information with customers and partners. TISAX, the Trusted Information Security Assessment Exchange, provides a mechanism for assessing information security and sharing results using the VDA ISA catalogue. It is not a conventional management-system certification. Consulting helps an organisation understand the applicable assessment scope and implement suitable controls.

ITVC Global supports TISAX preparation through the following five-step consulting approach:

Step 1: Initial review and advice

Review current information-security practices, processes and controls; identify weaknesses and risks; and assess gaps against the applicable TISAX objectives and VDA ISA requirements.

VDA ISA - ENX catalogue and version information

Step 2: Implementation planning

Develop a practical implementation plan specifying the required actions, responsibilities, resources, schedule and progress-review milestones.

Step 3: Implement security controls

Implement controls such as risk management, access control, data and network protection, and staff awareness training. Controls should match the organisation's risks and agreed assessment objectives.

Step 4: Check effectiveness

Check whether the implemented controls operate effectively and meet the relevant requirements. Address gaps and verify corrective actions before the official assessment.

Step 5: Assessment, results and exchange

ITVC supports readiness for assessment by an ENX-approved audit provider. The provider conducts the assessment and records the results through the TISAX process. The organisation then controls sharing of its results with relevant partners on the ENX portal. TISAX does not issue a conventional certificate for public display.

The original article gives an indicative consulting timeframe of three to six months. Actual duration depends on the scope, locations, starting maturity, resources and corrective actions required; it should be agreed for the project.

ENX-approved TISAX audit providers

Current provider list: TISAX audit provider

Additional reference: TISAX assessment providers: archived Vietnam reference

When selecting an approved provider, consider its suitability for the assessment scope, availability in the relevant region, communication arrangements and travel costs.

Related TISAX information

TISAX consulting and training

TISAX assessment providers: archived Vietnam reference

TISAX frequently asked questions

TISAX consulting for automotive information security

ENX - TISAX Participant Handbook