{"id":1259,"date":"2023-06-08T08:59:39","date_gmt":"2023-06-08T08:59:39","guid":{"rendered":"https:\/\/inprotech.es\/?p=1259"},"modified":"2025-02-17T10:32:35","modified_gmt":"2025-02-17T10:32:35","slug":"tisax","status":"publish","type":"post","link":"https:\/\/inprotech.es\/en\/tisax\/","title":{"rendered":"TISAX: Information Security in the Automotive Industry"},"content":{"rendered":"

Abstract– TISAX is an information security standard developed by the Association of the German Automotive Industry (VDA) for the evaluation and secure exchange of information between companies in the automotive industry.\u00a0<\/i><\/b><\/p>\n

The objective of this technical article is to deepen in the objective, scope and benefits that TISAX brings to the industry, to synthesize the main points to consider of the TISAX handbook (reference and structured framework for the assessment and audit of information security in this field), as well as to establish a comparison between the information security management system proposed by TISAX versus ISO 27001.<\/i><\/b><\/p>\n\n

Introduction<\/span><\/h2>\n

The VDA (Verband der Automobilindustrie) [1] is the Association of the German Automotive Industry<\/strong>. It is an organization that represents the interests of the sector in the country, and is dedicated to promoting the development and competitiveness of its automotive industry, as well as fostering cooperation between automakers, suppliers and other related players. The association also facilitates collaboration and knowledge sharing among its members through working groups, committees and events.<\/span><\/p>\n

The TISAX<\/strong> (Trusted Information Security Assessment Exchange) standard [2] was launched by the VDA in May 2017. It was created as a framework for assessing and ensuring information security in the automotive industry.\u00a0<\/span><\/p>\n

For the implementation of TISAX, the VDA relied on ENX (European Network Exchange) [3]. This was founded in 2000 as a non-profit organization by several European car manufacturers, including BMW, DaimlerChrysler, Renault and Volkswagen. Its main objective was to establish a secure communication platform for the exchange of confidential information in the automotive supply chain.\u00a0<\/strong><\/span><\/p>\n

Thus, TISAX is an information security standard developed by VDA for the automotive industry. VDA-ISA (“VDA Information Security Assessment”) is their assessment framework used, and ENX is an organization that facilitates the secure exchange of information associated with assessments (among other things) in the automotive supply chain.<\/span><\/p>\n

Benefits<\/h2>\n

TISAX (Trusted Information Security Assessment Exchange) assessments offer several advantages and benefits for both the organizations that perform them and the automotive industry in general. Some of these advantages are:<\/span><\/p>\n

    \n
  1. Requirements compliance<\/strong>: TISAX assessments help organizations comply with the information security requirements established by the automotive industry. By obtaining TISAX certification, companies demonstrate their commitment to protecting confidential information and meet the security standards required by automakers and other business partners.<\/span><\/li>\n
  2. Trust and credibility<\/strong>: TISAX is recognized and endorsed by the Association of the German Automotive Industry (VDA), which provides greater trust and credibility to certified organizations. TISAX certification indicates that an organization has been independently assessed and has met the required information security standards.<\/li>\n
  3. Improved information security<\/strong>: TISAX assessments help organizations identify and address information security vulnerabilities and risks. This enables them to implement more robust security measures and controls, which in turn improves the protection of sensitive information and reduces the risk of security breaches.<\/li>\n
  4. Collaboration and supply chain access<\/strong>: TISAX certification enables organizations to access and collaborate with automakers and other business partners in the automotive industry. Many automakers now require their suppliers to demonstrate TISAX compliance to ensure the secure exchange of confidential information and guarantee data protection.<\/li>\n
  5. Internationally recognized standard<\/strong>: TISAX is based on ISO\/IEC 27001 [4], which makes it widely recognized and accepted in the global information security community. This facilitates interoperability and cooperation between organizations in different countries and strengthens security throughout the automotive supply chain.<\/li>\n<\/ol>\n

    Summing up, TISAX increases security, standardization and trust between partners. In addition, it reduces costs by avoiding duplicate assessments by different actors, as the result of assessment audits can be made public on the ENX portal.<\/span><\/p>\n

    TISAX Handbook<\/span><\/h2>\n

    The Handbook is the guide of reference for managing TISAX assessments<\/strong>. It describes the steps an entity must follow to pass the TISAX assessment and to share the assessment result with its partners.<\/span><\/p>\n

    The current version of the document is 2.3 as of January 2021, and is available in English, French, German and Chinese, as well as Spanish, in PDF and downloadable HTML.<\/span><\/p>\n

    If a partner requests us to demonstrate a predefined level of information security in accordance with the requirements of the VDA Information Security Assessment (ISA), the 3-step TISAX process must be followed to respond to such a request:<\/span><\/p>\n

    Registration<\/span><\/h3>\n

    This involves registering as a participant in the ENX portal<\/strong>, either as an active participant (assessed) or passive participant (receives the result of the assessment). An organization can play both roles simultaneously.<\/span><\/p>\n

    Subsequently, the contractual documentation of the ENX portal and with the authorized audit provider is signed.<\/span><\/p>\n

    Another fundamental step at this stage will be to determine the scope<\/strong>, a concept defined in a similar way to ISO 27001. In this case, a standard (recommended) or customized (extended or reduced) scope is established. In addition, it is necessary to indicate which locations are subject to assessment. There are advantages and disadvantages of a multi-site assessment: on the one hand, resources and costs are saved, and a single due date is obtained by aggregating locations; but in the event of a partial negative result, it will affect the entire exercise, and it will have to be repeated in its entirety.<\/span><\/p>\n

    The assessment objective<\/strong> is also defined at this point, which determines the applicable requirements to be met by the information security management system (ISMS). This is the so-called “TISAX label”, once the audit is passed.\u00a0<\/span><\/p>\n

    One, or more than one, can be selected:<\/span><\/p>\n

    \"\"
    Fig. 1. Assessment objectives TISAX<\/figcaption><\/figure>\n

     <\/p>\n

    The evaluation objectives have dependencies among themselves. In addition, if several types of information are handled, different levels of protection may be required<\/strong> in each case (normal, high or very high):<\/span><\/p>\n

    \"\"
    Fig. 2. Mapping of ISA criteria catalogs and protection needs to TISAX assessment targets<\/figcaption><\/figure>\n

     <\/p>\n

    On the other hand, the higher the level of protection required, the more demanding the level of evaluation:<\/span><\/p>\n

    \"\"
    Fig. 3. Assessment objectives vs Assessment level (AL)<\/figcaption><\/figure>\n

     <\/p>\n

    The AL1<\/strong> level corresponds to a self-assessment, in which the auditor only reviews a template filled in by the active participant. They are not used in TISAX, since they do not award a label.<\/span><\/p>\n

    Level AL2<\/strong> requires exhaustive verification of the plausibility of the self-assessment: by collecting evidence, through interviews, etc., but without the need to go to the locations in person.<\/span><\/p>\n

    In AL3<\/strong>, the same is verified as in AL2 but more thoroughly, by conducting an on-site inspection and face-to-face interviews.<\/span><\/p>\n

    \"\"
    Fig. 4. Applicability of evaluation methods to different levels of assessment<\/figcaption><\/figure>\n

     <\/p>\n

    In addition and to close this stage, the TISAX handbook refers to the payment of the mandatory fees, and the process of registration and use of the ENX portal throughout the process.<\/span><\/p>\n

    Evaluation<\/span><\/h3>\n

    This is the core stage of the process. The handbook explains how to use the ISA self-assessment<\/strong> Excel template to check readiness for the formal audit (i.e. internal audit), how to choose an authorized audit provider for the external assessment leading to the TISAX label(s), and the outcome of the process.<\/span><\/p>\n

    The “Information Security Assessment” (ISA) is a catalog of criteria<\/strong> published by the German Association of the Automotive Industry (Verband der Automobilindustrie e.V., VDA). It is the automotive industry standard for information security assessments. Its current version is 5.0.3.<\/span><\/p>\n

    First of all, it must be understood that there are three criteria catalogs:<\/span><\/p>\n

    \"\"
    Fig. 5. ISA Criteria catalogs<\/figcaption><\/figure>\n

     <\/p>\n

    The evaluation objectives, in turn, are related to the criteria catalogs:<\/span><\/p>\n

    \"\"
    Fig. 6. Correspondence between the TISAX evaluation objectives and the ISA criteria catalogs<\/figcaption><\/figure>\n

     <\/p>\n

    And in the same way, there is another table that relates the applicable requirements of the Excel VDA-ISA to each assessment objective:<\/span><\/p>\n

    \"\"
    Fig. 7. Applicability of the requirements to the assessment objectives (excerpt from table 9, TISAX Handbook)<\/figcaption><\/figure>\n

     <\/p>\n

    In the Excel template, each criteria catalog groups the questions into chapters based on the different aspects of the information security management systems. The questions for each catalog of criteria or controls are found in the document itself, leaving blank fields for the auditor to carry out the assessment.<\/span><\/p>\n

    The requirements in the template are divided into mandatory, optional, necessary<\/strong> to achieve a high level of protection, or for a very high level of protection. Those necessary for the established assessment objective must be satisfied (see figure 2).<\/span><\/p>\n

    The ISMS aspects are evaluated in terms of maturity on a scale of 6 levels:\u00a0<\/span><\/p>\n

    \"\"
    Fig. 8. Informal description of the maturity levels<\/figcaption><\/figure>\n

     <\/p>\n

    In the self-assessment template, all the levels associated with the applicable requirements must be filled in. The overall maturity level is the average of all target maturity levels (at the question level), altered by the fact that requirements that do not apply do not compute, and that the actual maturity levels are reduced to the target if exceeded.<\/span><\/p>\n

    If the final score<\/strong> calculated by this algorithm is less than 3.0, the ISMS will most certainly need to be improved. If a score of less than 10% or 30% deviation from the maximum is obtained, the assessment will be non-compliant with minimal\/significant deviation, respectively.<\/span><\/p>\n

    Once the internal audit has been approved, an authorized supplier must be selected for the formal assessment. The cyclical process in 4 steps is as follows:<\/span><\/p>\n