TISAX® Assessment

Specialists and experts often work for the automotive industry as sole contractors. They can be special designers, researchers, or specialized translation service providers.

When assessing these groups of companies, we focus on the proper regulations and verifications. Often, day-to-day business practices can explain the situation of the company in just a few words. We carefully consider whether the existing documentation is adequate for a small company.

A motor vehicle always needs physical parts, such as lamps, seats, trim and other components, which are often manufactured by SMEs.

At traditional manufacturing companies, information security is often not an integral part of the corporate culture. The absolute focus on production quality all too easily overshadows information security. With us, you partner with a testing service provider and auditors who come from the industry and understand the industry. Many issues sometimes have to be dealt with peripherally, and clear guidance during the assessment helps to identify key aspects.

The creation of attractive marketing materials or appealing commercials or other short films is a key factor in the sales of vehicles. Therefore, film studios and marketing companies are commissioned to properly convey the vehicles and the emotions associated with them even before their actual release.

This industry is characterized by creative processes and creative approaches. These companies are therefore quick to reject rigid standardized regulations, as these are not compatible with their corporate culture. But requirements can also be implemented in creative ways and regulations do not necessarily have to be 100-page documents. As a testing service provider, we know how to adapt to the corporate culture, and we always look at the proper implementation of requirements by considering the individual company being assessed.

Before the first part of a new vehicle can be produced, there always are the idea and the first drawings and designs. In development companies, the focus is primarily on the creation of design drawings and the interactive exchange with customers until a new vehicle or its individual parts are perfect.

In these companies particularly, an active exchange with the customers is necessary. A significant amount of data is being transferred in both directions and the requirements for individual pieces of information change over the course of the project. As a testing service provider, we understand the challenges and know that not every single email requires a very high level of protection and not every design drawing is critical for an OEM. Therefore, we can address your individual circumstances.

Cloud service providers are becoming increasingly more important. Almost every company uses external service providers or cloud providers. This work is not really comparable to that of any of the above-mentioned companies, as their focus is on providing computing capacity and services. In the end however, it is the customer who decides which data is to be transferred to the cloud.

Cloud service providers therefore have different critical business processes than conventional companies. We use our expertise to support you in mastering the challenges and establishing IT security in your company.

The TISAX® assessment catalog is based on the VDA ISA 5.0 assessment catalog. The catalog, which was developed by the VDA and ENX, contains the Information Security workbook, which serves as the basis for the assessment. The current assessment catalog can be found on the VDA and ENX websites.

The following assessment objectives are included in the TISAX® assessment catalog:

• Information with high protection needs
• Information with very high protection needs
• Protection of prototype parts and components
• Protection of prototype vehicles
• Handling of test vehicles
• Protection of prototypes during events and film or photo shootings
• Data protection
• Data protection with special categories of personal data

The TISAX® location is the physical site that processes the relevant information.

Not every location must have a TISAX® label. It is therefore important to consider in advance for the respective location, where and in which order an assessment is to be conducted. Group assessments are possible for ten or more locations.

The TISAX® assessment standard scope always includes entire locations and also the individual assessment objectives. A scope focuses primarily on the business processes of performing services as well as dependent supporting processes and departments.

The assessment level describes the assessment to be performed, which depends on the selected objectives. There are three assessment levels:

An AL2 assessments focuses on a plausibility check based on the submitted documentation, followed by a remote assessment by phone.

The AL2.5 assessment is similar to the AL2 assessment. After a plausibility check of the self-assessment by an auditor, a remote assessment is performed, which lasts several days. This is also conducted by phone, but is much more thorough. The AL2.5 assessment is particularly useful if a later upgrade to a higher assessment level is desired, but an on-site inspection of individual locations is currently not possible due to COVID-19.

The AL3 assessment also includes a plausibility check of the self-assessment but is continued on-site. The auditor conducts on-site interviews on at least two days and inspects the location.