TISAX Information Security Assessment Consultancy

What TISAX is usually taken with

Few organisations stop at one standard, and the second costs far less than the first — the clauses that take longest are the ones they share. Where TISAX sits next to something else, this is what carries over.

• IATF 16949 consultancy — shares clauses 4 to 10 with this standard, so context, leadership, competence, internal audit and management review are built once and audited together.

Certified to more than one, you hold a single management system with one set of objectives, one internal audit programme and one management review — audited in one visit. Run as separate systems they cost roughly twice as much to keep, which is the usual reason a second certificate feels harder than it was.

How the German automotive industry checks information security

TISAX is the mechanism the German automotive industry uses to assess information security and share the result between companies. Assessment is against the VDA Information Security Assessment catalogue, which covers information security, prototype protection and data protection. It is not a certification. Audit providers registered with ENX perform the assessment, results are published as labels on the ENX exchange, and a partner you nominate can view them instead of auditing you all over again.

You will be asked for it by German vehicle manufacturers and their tier ones, and by engineering, design, software, testing, tooling, logistics and marketing suppliers working on their behalf. The trigger is usually receipt of confidential information or physical prototypes. Assessment levels rise with the sensitivity involved, from a self assessment with plausibility check through to an on site audit with unannounced elements at the highest level. Prototype protection pulls physical and site security into scope.

Assessment levels, the VDA catalogue and the shared exchange

Work starts by confirming which assessment objectives and which level your customer actually requires, because scoping too wide is expensive and scoping too narrow means doing the exercise twice. We then complete the VDA catalogue honestly, scoring current maturity against each control and separating what is documented from what is practised. The maturity model is unforgiving of policies without evidence, so a realistic starting score is far more useful than a flattering one.

Remediation follows the gaps: information security management with defined roles, asset and supplier management, identity and access, cryptography, physical security, development security, incident handling and business continuity. Where prototype protection applies we work on site zoning, visitor and photography control, transport and event security. Where data protection is in scope, the related objectives are addressed as well. Before the audit we run a readiness review in the format the audit provider will use.

Labels on the exchange and what they let you bid for

The outcome is a completed and evidenced assessment, a maturity improvement record, and after a successful audit by an ENX registered provider, labels published on the exchange with a defined validity period. You control which partners are allowed to see them. MSCi prepares you and runs the internal readiness audit, but the assessment itself is performed by the registered audit provider. Sharing on the exchange replaces the individual customer audits you would otherwise host.

The commercial effect is access. Without a valid label, projects involving confidential specifications or prototype parts are not released to you, and procurement will not argue the point. With one, onboarding is quick and repeat customer audits largely disappear. Internally, the prototype protection work tends to improve general site security, since visitor control and restricted areas apply to everything on the premises, not only to the parts under assessment.