VDA ISA Berater

With TISAX NIS-2 fulfill

Eva Claas — Tue, 29 Jul 2025 08:40:41 +0000

TISAX® Portal Update 2025

Eva Claas — Thu, 26 Jun 2025 07:28:33 +0000

Certificate or label?

Eva Claas — Tue, 14 Jan 2025 09:50:38 +0000

Connection between NIS-2 and TISAX®: Does NIS-2 also affect companies with TISAX® certification?

Eva Claas — Mon, 01 Jul 2024 09:47:35 +0000

The topics of NIS-2 and TISAX are of great importance for companies dealing with IT security and data protection. Although both terms are relevant in different areas of IT security, there are some connections and potential overlaps.

What is TISAX®?

TISAX® (Trusted Information Security Assessment Exchange) is an information security standard specifically for the automotive industry. Developed by the ENX Association, TISAX is designed to meet the requirements of ISO/IEC 27001 and ensure that suppliers and service providers in the automotive industry maintain a high level of information security. A TISAX® label, often referred to in common parlance as a TISAX® certificate, is therefore an important seal of quality for companies in this sector to prove their information security measures.

What is NIS-2?

NIS-2(Networkand Information SecurityDirective 2) is the revised version of the European Union’s NIS Directive. It aims to strengthen cyber security in the EU member states. NIS-2 primarily affects operators of critical infrastructures and important service providers that are essential for maintaining essential social and economic activities. The directive requires these companies to take strict security precautions and report cyber incidents.

Does NIS-2 also affect companies with a TISAX® label?

Although the NIS 2 directive and the TISAX® standard do not overlap directly, there are points of contact that are relevant for companies that have to comply with both standards. If a company in the automotive industry operates both critical infrastructures and has a TISAX® certificate, it must take the requirements of both directives into account.

Connections and synergies between NIS-2 and TISAX®:

Increased security requirements: Both directives require high standards of information security. Companies that have the TISAX® assessment have already implemented many security measures that can also be helpful for NIS-2 compliance.
Risk management: Both TISAX® and NIS-2 attach great importance to effective risk management. Companies that have a TISAX® label usually already have robust risk assessment and mitigation processes in place that can also meet the requirements of NIS-2.
Reporting of security incidents: NIS-2 requires the reporting of cyber incidents to the relevant authorities. Companies that are TISAX® audited have already implemented procedures for detecting and reporting security incidents, which facilitates compliance with this NIS 2 requirement.

Conclusion:

While TISAX® and NIS-2 address different contexts of information security, there are overlaps that companies should be aware of. Especially for companies in the automotive industry that have a TISAX® label and are also covered by the NIS-2 directive, it is important to integrate both standards and utilize synergies in order to design their security strategies effectively and efficiently.

Companies should therefore carefully review the requirements of both sets of regulations and ensure that they are fully prepared to comply with both TISAX® and NIS-2. An integrated approach to information security can help to meet legal requirements while maximizing the security of information systems.

Further information on NIS-2 and KRITIS can be found on our topic page.

How companies can demonstrate their successful TISAX® assessment

Eva Claas — Thu, 06 Jun 2024 10:10:13 +0000

Companies that have successfully completed the TISAX® assessment can be proud of this achievement. Meeting the TISAX® requirements is a significant achievement that demonstrates that a company meets high standards in terms of information security. However, unlike ISO 27001, companies do not receive a certificate after a TISAX® assessment. The conformity is not immediately recognizable to the outside world and it is not permitted to advertise it publicly. Nevertheless, there are ways to communicate the successful evaluation.

The new decorative TISAX®assessment document

ENX, the operator of the TISAX® system, now offers a decorative TISAX® assessment document. This automatically generated document can be accessed by TISAX® participants and fulfills the terms of use of the TISAX® trademarks. It contains important information about the scope, the assessment and the corresponding objectives.

This document can be retrieved for all completed scopes and displayed as a decorative element at each tested location. This allows companies to make their success visible without violating the TISAX® terms of use.

How to generate the TISAX®assessment document

To create the decorative TISAX® assessment document, follow these steps:

Visit the ENX portal: Log in to the ENX portal and go to the “Scopes and checks” section.
Select the desired scope: Click on the drop-down menu to the right of the corresponding scope.
Generate the document: Select the option “Generate decorative assessment document”. The document is created automatically and is available for you to download.

This document is purely decorative and may not be passed on to customers or business partners.

Share TISAX® test results with business partners

If you would like to share your TISAX assessment results with business partners, you can do so via the ENX portal. In the “Exchange” section of your scope, you have the option of specifying with whom you would like to share your results.

Go to the “Exchange” section: Log in to the ENX portal and navigate to your scope.
Select the business partner: Click on the drop-down menu to the right of the name of the business partner with whom you would like to share your results.
Generate the document: Select the option “Generate copy of information shared document”. This document can be provided to your business partner as proof of your TISAX assessment.

Conclusion

Although companies do not receive an official certificate after a successful TISAX assessment, there are still ways to make this achievement visible. The new decorative TISAX assessment document from ENX allows companies to show their compliance without violating the TISAX terms of use. In addition, test results can be shared securely and efficiently with business partners via the ENX portal. This enables companies to communicate their high information security standards transparently and professionally.

Mandatory: VDA ISA catalog version 6.0 for all those who order the TISAX® assessment now

Eva Claas — Tue, 23 Apr 2024 10:27:28 +0000

Version 6.0 is now mandatory for all those who wish to commission a TISAX® assessment.

The introduction of the new version 6 of the VDA ISA catalog on April 1, 2024 will have a significant impact on the TISAX® certification process. Until March 31, companies that commissioned a TISAX® assessment could still be audited according to version 5.1 of the VDA ISA.

Since April 1, 2024, companies that have already commissioned an assessment in accordance with ISA 5 have the option of switching to ISA 6 in consultation with the audit service provider. The transitional period for assessment procedures already in progress will last until September 30, 2024.

The introduction of the new version of the ISA catalog also affects the TISAX® assessment objectives and labels. Previously, there were two label levels for the “Information Security” criteria catalog: “Info High” and “Info Very High”. Version 6 now uses four labels: “Availability” and “Confidential”. The old “Info” labels are no longer available. This introduces a stricter distinction between confidentiality and availability. However, the distinction between the “high” and “very high” levels of protection remains.

First steps with TISAX®

lahntec — Wed, 22 Nov 2023 08:19:02 +0000

There it is: the requirement from your customer that you must provide evidence of the TISAX® label.

So that you can start the TISAX® assessment process well prepared, our colleague Eva Claas has summarized all the important basics for you in this video: – What do the preparations generally look like? – Who from the company should be involved? – What documents and resources do I need? We will show you the basics that will enable you to take a rapid and targeted approach to obtaining the TISAX® label and clarify the most important questions.

Please contact us:

TISAX® – our guide for companies

lahntec — Tue, 14 Nov 2023 08:05:43 +0000

Your customer asks you for proof of the TISAX® label. What now?

There it is, the information from your customer that you or your company should now please provide proof of a TISAX® label.

Now the question arises as to what exactly needs to be done, which departments need to be involved and how the process for a successful assessment according to TISAX® actually works in order to meet the customer’s requirements.

Here is a short guide for orientation:

What is TISAX® actually?

TISAX®, the standard for information security in the automotive industry, is a common assessment and exchange mechanism that makes the findings from information security assessments accessible to all manufacturers. The results of the tests are mapped in a maturity model. Recertification is generally carried out every three years or, for example, if the participating company wishes to demonstrate a further audit objective or if a major organizational change has taken place.

Is a TISAX® assessment really necessary?

To cut a long story short: If a customer requests proof of the TISAX® label, proof of TISAX is usually mandatory. However, if you do not receive customer data or do not have access to the customer’s systems, then in very rare cases the customer’s request may be unfounded.

You should also check at which locations the actual service provision that makes the TISAX® assessment necessary takes place. For example, if you have several locations in your company but do not produce/provide the service at all of these locations, then only those at which the service is provided for the OEM must provide evidence of the TISAX® label.

How much time do I need to plan for the TISAX® label?

Depending on the size of the company and the assessment objectives, a time frame of at least 6 months should be planned for a successful TISAX® assessment. Depending on the resources available and day-to-day business, for example, this can of course take up to 18 months. TISAX® is therefore not “just done on the side”.

Who should become part of the TISAX® team in my company?

TISAX® is the standard for information security in the automotive industry. It therefore makes sense to integrate members into the team who have knowledge of your company’s IT and information security processes as well as employees who have expertise in internal project management areas and are characterized by strong communication skills. In other words, employees from all areas of your company in which values (information in digital or physical form, prototypes) are used and passed on.

What exactly does the process for the TISAX® label look like?

If your company already has an integrated information security management system (ISMS for short) that is practiced by all employees, this greatly simplifies the implementation of the TISAX assessment. If no ISMS is in place, the required documentation must be prepared in accordance with the audit objectives.

We have outlined the actual process of the TISAX® assessment for you here:

What resources does TISAX® need?

The resources required are too individual to be generalized. As mentioned above, an existing ISMS, for example, simplifies the TISAX® assessment, as the necessary documentation is already provided in advance. In order to be able to estimate the effort required for the TISAX® label in advance, GAP analysis tools can be used to transparently present the status quo within the company in relation to the target status. The resulting strategic and operational gaps then provide information on the required resources in the evaluation.

Our TISAX® experts at OPTIQUM will be happy to advise you.

Do my suppliers also have to prove TISAX®?

TISAX® is basically aimed at all suppliers and service providers in the automotive industry who need to protect sensitive data and information – both their own and that of their customers – in the best possible way and regularly provide evidence of this by means of documentation.

The security of the exchange of information must be ensured throughout the entire supply chain and the scope of testing is based on the respective customer-specific requirements. The famous stone making waves in the water serves as an analogy: All participants who come into contact with the respective sensitive data are affected by the waves and must therefore guarantee the responsible and secure handling of the information in question.

However, the TISAX® certificate can also be seen as an added value for the partner companies in the supply chain: In an existing collaboration with external companies, for example, which access and use the internal data center, mutual information security is the highest priority for a strong, trusting cooperation.

Should I get support for TISAX®?

If you have little or no experience in the field of information security, it is advisable to consult an experienced TISAX® expert. A workshop is worthwhile here to clarify open questions in advance, gain insights into TISAX® and information security and define your own strategy for the TISAX® assessment. The customer-specific requirements and scopes must be precisely identified, evaluated, analyzed and brought together in both the IT and production areas – it is therefore worth getting a partner with the relevant TISAX® expertise on board to work efficiently and strategically towards the successful TISAX® label.

Please contact us:

Do I need TISAX if I already have ISO 9001 or ISO 27001?

lahntec — Wed, 08 Nov 2023 08:01:47 +0000

To provide an overview, the standards and mechanisms are briefly explained, including a comparison of ISO 9001 and 27001

TISAX®:

TISAX® (Trusted Information Security Assessment Exchange) is the automotive industry’s (VDA) response to the growing need for security among project partners regarding confidential information. It is a mechanism for testing and exchange to recognize results of information security tests in the automotive industry.

ISO 9001:

ISO 9001 is the international standard for quality management systems (QMS). QMS describes a collection of processes, guidelines, defined procedures and records. This collection of documentation defines a set of internal rules that determine how a company produces and delivers products or services to customers. The QMS should be tailored to the needs of your company and the products or services offered. The ISO 9001 standard provides a series of guidelines for this. These ensure that all the important features of a successful QMS are incorporated into your strategy.

ISO 27001:

The international standard ISO/IEC 27001 specifies the requirements for the establishment, implementation, maintenance and continuous improvement of a documented information security management system, taking into account the context of an organization. In addition, the standard contains requirements for the assessment and treatment of information security risks according to the individual needs of the company.

In short: ISO 27001 is an international and cross-industry standard in the field of information security.

And what exactly is the difference?

The most important aspect is that TISAX® is a specialized and automotive-specific standard for the exchange of information security assessment results. The tests are based on the VDA-ISA standard of the VDA, which in turn is based on parts of ISO 27001 and specifies areas in more detail. In addition, automotive industry-specific requirements, such as prototype protection, are amended. Its main use is to protect the information security systems of car manufacturers and their suppliers.

TISAX® or the VDA-ISA is an industry-specific standard, specifically for the automotive industry, and not, as with ISO 27001 and ISO 9001, an international, cross-industry standard.

However, ISO 9001 is a good starting point for TISAX®: once the basic principles, processes and regulations of the QMS have been defined, a quick and uncomplicated transition to the TISAX® assessmentcan take place. However, ISO 9001 cannot replace TISAX® under any circumstances.

Information security as the basis of the standard combines both ISO 27001 and TISAX®.

However, in contrast to the more general ISO/IEC 27001 standard, the VDA-ISA extends ISO 27001 to include industry-specific requirements for the automotive industry, such as prototype protection, third-party integration and data privacy.

Compared to ISO 27001, TISAX® has more and more specific scopes – also in the area of ISMS.

For all OEM suppliers – and that includes media agencies, printers, marketing companies, stand builders, photographers etc. who work with clients within the automotive industry – TISAX® is the standard used and necessary for your Competitive ability. In many cases, a TISAX® label is already required in the tender procedures.

We are happy to advise you nonobligatory in an initial consultation if you have any questions or doubts as to whether TISAX® is necessary for your company.

Please contact us:

Understanding business processes and protecting information

lahntec — Wed, 01 Nov 2023 07:54:41 +0000

Understand business processes easily and protect information at the same time – Quam® and OPTIQUM make it possible!

Who does what, with what and according to what rules?

Workflows, processes and the associated rules in the company are often complex and highly interconnected – and therefore often difficult to understand. Quam® not only brings light into the darkness, the process management software also offers many other customizable and useful features in addition to the simple, user-friendly mapping of complex company structures.

And as a bonus, TISAX® is one of many norms and standards that can now be met even more quickly and easily thanks to the interaction between Quam® and OPTIQUM.

How does it work?

Your company consists of many different processes, structures, rules, systems and, of course, people who perform different roles and functions in your organization. In order to maintain the ability to act quickly and proactively and to improve the company, it is essential to have a holistic overview and understanding of these widely interlinked connections and networked process worlds. And almost impossible without software support.

Quam® maps the company in a simple and digital manner. It informs you and your employees about changes within the organization and manages their improvements. This makes Quam the digital twin and “operating system” of your company.

What are the advantages?

With the help of Quam® you can organize your company systematically along process lines. The user-friendly interface provides users with a simple process overview of your organization, making it easy for them to find their way around.

From this overview, you can access all relevant information with a maximum of 3 clicks, regardless of whether it concerns e.g. rules, applicable templates or IT systems to be use. Processes and interrelationships, cross-departmental connections and the involvement of roles and partners in individual process steps can also be accessed and visualized in an accessible manner.

You get an overview of all your relevant operational information, giving you the advantage of transparency and control. It also favors a flexible exchange of information and quick transfer of information, which are crucial for your competitive abilities.

Rapid troubleshooting thanks to digitalization

By interconnecting and digitizing process descriptions and regulations, it is much easier to find gaps or errors in the processes because you don’t have to tediously work your way through Excel files or even paper folders.

The sensible and, above all, secure management of regulations and documentation and the mapping of all processes, structures, rules and information in your company creates greater transparency and efficiency in the long term.

Quam® offers individual perspectives depending on the needs of the users, so that your entire organization can be mapped in a clear system and information do not have to be maintained redundantly.

Process consulting and process-integrated ISMS

Quam® and OPTIQUM work hand in hand to ensure the optimal, holistic setup and function of the processes. Our OPTIQUM experts provide you with comprehensive and individual advice on structuring and optimizing your processes. We not only design comprehensible, but also efficient, practical process landscapes that suit your company and your work-flows and support you in your day-to-day work.

We maintain these processes for you as the basis of your process management in Quam® and thus create the optimal starting point for user-friendly use of the software. In accordance with the characteristic requirements that your company places on the information security management system in terms of risk and hazard potential, we at OPTIQUM also ensure the development and implementation of an ISMS in your organization.

Quam® 6.0 also includes a GDPR module, which has an extended data model and provides standard GDPR content. This allows users to record the type of personal data and assign it to processes and processing systems. If required, these can be assessed so that data privacy management is conveniently set up digitally.

TISAX® - faster certification by Quam® and OPTIQUM

The requirements of new standards, guidelines or laws for your own company can be evaluated much more quickly thanks to OPTIQUM’s advice and the use of Quam® – this is made possible through the interaction of OPTIQUM’s on-site expertise and the digital support of the Quam® process management software.

It is also easier to identify the necessary adjustments required for implementing TISAX. These adaptations are designed and implemented by OPTIQUM so that the fulfillment of the requirements is ultimately documented. When implementing the adjustments, all existing processes, organizational structures, roles, resources and the compliance system already in place can be used.

Our partner Joinhttps://www.join.de/ is the implementation partner for Quam® 6.0 and specializes in adapting Quam to the individual needs of the customer. Join not only supports you with the implementation of Quam, but also enables technical and configurative customization and – if desired – live operation.

Together we will pave the way to digital, simple and efficient process management and to your TISAX® assessment!