TISAX Requirements - TISAX - solution

In addition to the information security module, data protection (order processors) and prototype protection must also be fulfilled, depending on customer requirements. For data protection, it is always the case that the company must fulfill this for its own company - this is checked in the information security module Compliance. The implementations must meet the requirements of VDA ISA maturity level 3 in order to pass the assessment positively. In most cases, a single missing implementation leads to the assessment being aborted.

It is astonishing what is published on the Internet. Even an employee of an auditing organization states that TISAX would cause less effort than ISO 27001. This is justified by the fact that ISO 27001 has 119 requirements and TISAX only 52. This is not correct because TISAX has 52 main requirements with a total of over 400 individual requirements. These are created by high and very high protection requirements and the + requirements.

As the process definition PA3.1 of VDA ISA 5 specifies, the sequence and interaction of the standard process with other processes must be determined for maturity level 3. This means that the interdependency between processes must be shown.

As can be seen from these examples, specific knowledge is needed to implement TISAX. This includes a knowledge and experience in the field:

Already from these points of requirement it is obvious that here a high requirement results in the conversion of TISAX in the organization conversion and the coworker integration.

The requirements of TISAX and VDA ISA are about processes, responsibilities, risk assessments, risks and risk countermeasures, regulations such as guidelines, procedural instructions, instruction of employees, legal obligations, training, and so on.

It is therefore surprising what solutions are advertised on the Internet for these TISAX requirements. The simplest category of solutions are form sets. We know almost all of them from many projects - because failed projects had started with these or customers who did not come to a solution with them - asked us for help. These templates were too superficial to meet the requirements of a TISAX assessment. They were mostly based on ISO 27001 and did not fully cover the TISAX specific documents. Often they were just "document shells" and the customers still did not know what they really had to document for TISAX. They also only support the documentation - but not the other requirements. On the Internet you can even find statements about form sets, that with this form solution the customer would be ready for TISAX in 14 days. This makes it clear that this provider has no idea about TISAX, because VDA ISA 5 describes the following requirement under maturity level 3: "A standard process is followed that is integrated into the overall system. Dependencies on other processes are documented and suitable interfaces have been created. Evidence exists that the process has been used sustainably and actively over a longer period of time."

This already gives the answer - a longer period of active use is required - this should be estimated at 2 - 3 months, and processes, interfaces and interactions cannot be fulfilled with sets of forms - it needs more. Important are above all the proofs for the active conversion of the processes and these can not be mapped in form sets also.

The second category of solutions are the offered software solutions. But in most cases, these also do not meet the full TISAX requirements, as they are usually "upgraded solutions" from data protection or ISO 27001 software solutions. However, the process-related requirements are not met by these software offerings. A simple question about the representation of the interaction of the processes quickly separates the "wheat from the chaff" here.

Third solution category are external consultants. Here, you are usually better off if you have a good consultant who covers the areas of competence described above. However, finding such a consultant is usually not easy, not even the auditing organizations can find enough TISAX auditors. It is also important to note that an ISO 27001 consultant is far from being a TISAX consultant. Many providers on the market "think" they have the competence - for example, as a system house they cover the IT topics or have basic knowledge of ISO 27001, but they have lack comprehensive TISAX knowledge.

A TISAX implementation is a complex project. Even small companies are required to fulfill all VDA ISA requirements. Exclusion of requirements is only possible in very rare cases. For a project implementation, 6 to 15 months should be calculated. Depending on complexity, locations, employees and IT implementation.

Interesting links: