TISAX Certification: All-in-One Guide to the Automotive Compliance Standard

TISAX, short for Trusted Information Security Assessment Exchange, is an IT security certification scheme developed by the German Association of the Automotive Industry (VDA). Suppliers and service providers need to be TISAX certified in order to work with German car manufacturers. The adoption of TISAX as a unified compliance platform means that businesses only need one certification to be able to work with many different companies in the automotive sector.

TISAX is based on the ISO 27001 security standard and requires organizations to implement an information security management system (ISMS). In essence, an ISMS is a set of policies and guidelines that define security requirements and who is responsible for implementing them. However, in addition to the normal demands of ISO 27001, TISAX includes additional requirements for protecting vehicle information and prototypes.

Important TISAX resources:

TISAX is not mandatory, but it is a contractual obligation for anyone who wants to work with car manufacturers that participate in the compliance program. In other words, there is no way around TISAX for companies that want to win OEM contracts or maintain their existing business relationships.

Whether suppliers on deeper levels of the supply chain, such as Tier 2 and Tier 3 suppliers, need to comply with TISAX depends on if they process sensitive data. As part of their TISAX certification, Tier 1 suppliers do need to prove that their business partners maintain an adequate level of IT security.

To meet this requirement, TISAX-certified suppliers need to conduct risk assessments for their own business partners and pass contractual obligations on to their subcontractors. As a result, Tier 2 and Tier 3 suppliers are now often expected to comply with TISAX.

TISAX is based on ISO 27001 and draws most of its requirements from the widely known security standard. However, there are a few important differences: In addition to the information security demands of ISO 27001, TISAX includes additional sections for prototype protection and data protection (privacy). While ISO 27001 can be flexibly scoped based on an organization’s needs, TISAX works off of a predefined assessment scope.

Differences between TISAX vs. ISO 27001:

In order to successfully prepare for your TISAX certification, there are a few important terms you need to familiarize yourself with.

A successful TISAX audit allows automotive suppliers to prove that they meet the requirements outlined in the VDA information security assessment catalogue (download link to latest version, VDA ISA 6.0). In order to achieve TISAX certification, however, companies must first choose their assessment objective(s), implement the necessary safeguards, prepare all relevant documents and self-assessments and finally book an independent auditor to conduct the final assessment.

Once an organization has completed the audit process, they can use the TISAX exchange platform to share their result with participating manufacturers in order to show that they are TISAX-compliant. You will learn more about the audit process and the exact security requirements below.

There are many steps on the road to TISAX certification and it’s important to be aware of where you are in this journey. Here is an outline of the road towards TISAX:

To help you prepare and track your TISAX certification, we have prepared a TISAX checklist with all major steps on the road to your successful audit, as well as frequently asked questions about TISAX. The TISAX checklist is available as a free download below.

The biggest variable in how long it takes to achieve TISAX compliance is how much time a company needs to implement the required safeguards. For organizations that are already certified under ISO 27001, not much additional work is required. However, if TISAX is your first IT security audit, it may take longer to cover every necessary topic.

After the initial document audit, the final TISAX assessment must be completed within 9 months. Both the official audit and any follow-up fixes must be finished in this timeframe. If a company passes TISAX certification, it remains valid for three years. Unlike ISO 27001, there are no yearly surveillance audits.

The total costs of TISAX certification include the cost of an official auditor, the cost of implementing the required controls, as well as fees for any compliance experts you may want to consult. The audit itself, which costs around 400€ according to the ENX price list, is generally the smallest part of your TISAX budget.

If your company has no information security management system in place or if your ISMS needs significant updates, it can cost around 20,000€ to 50,000€ to make the necessary changes. Especially if you want to speed up the process by bringing in specialized compliance consultants. On the other hand, if your organization has already been certified under ISO 27001 or similar standards like NIST CSF, it will take less work to comply with the additional requirements of TISAX, making the process much cheaper.

The exact requirements for the different TISAX assessment objectives/labels are documented in the official Information Security Assessment catalogue (VDA ISA). Companies need to identify relevant requirements and ensure that their own controls meet the minimum maturity level. In order to pass a TISAX audit, an organization needs to achieve a maturity level of 3 or higher in every required control.

Maturity Level 3 (Established): “A standard process integrated into the overall system is followed. Dependencies on other processes are documented and suitable interfaces are created. Evidence exists that the process has been used sustainably and actively over an extended period.”

TISAX certification is designed to ensure that car manufacturers can safely share proprietary information and be certain that suppliers and subcontractors are protecting data from unauthorized access. There are many different security controls that organizations need to implement in order to achieve TISAX compliance. But the central question remains the same: Who has access to mission-critical data?

To prevent technical specs, vehicle data and manufacturing details from falling into the wrong hands, suppliers need to safeguard against outside attacks as well as insider threats such as employee data theft. And they need to be able to prove that access to sensitive data was restricted at all times.

Which is exactly why automotive companies need identity and access management. IAM solutions make it easy to implement access management best practices like the principle of least privilege. Users receive all permissions intended for their role through automated lifecycle management. Additional access can be requested and approved through a self-service platform. Meanwhile, automatic deprovisioning and regular audits ensure that appropriate access is maintained at all times.

In order to establish an information security management system (ISMS) that satisfies the requirements for TISAX, organizations need to address a wide range of topics, from risk assessments to malware protection and even the physical security of IT systems. Restricting access to sensitive data and safely managing IT accounts are key requirements of TISAX.

This makes identity and access management a must-have for any organization that wants to comply with TISAX. Without an automated system to manage hundreds of accounts and thousands of permissions across various IT systems, it is simply not feasible to enforce appropriate safeguards, let alone document who has access to sensitive data.

tenfold helps you get started on the path towards TISAX compliance! Our IAM solution covers all relevant requirements in the automotive security standard. See our breakdown below for an overview of how it works. You can find the exact language in sections 4.1 and 4.2 of the information security chapter.

From cyberattacks to compliance needs, identity & access management has become a must-have for organizations of all sizes. The only problem? Conventional IAM solutions are built for large enterprises, which makes them too unwieldy to use effectively in mid-market companies. The need to script integrations and workflows from scratch often leads to multi-year setup phases.

But there is an easier path to secure, efficient and compliant access management: tenfold‘s revolutionary no-code IAM platform can be set up in a matter of weeks thanks to its suite of prebuilt plugins. Connecting tenfold to other applications is a breeze, you just activate the plugin and tweak a few settings through the GUI – no scripting or custom code required!

tenfold allows you to achieve TISAX-compliant access management in record time. Sign up for a free trial and see for yourself.