TISAX

Requirements and controls

• IS Information Security

  Core ISA module assessed for every TISAX label, covering security governance, people, physical security, identity and access, IT and cyber security, suppliers and compliance.

  • 1 Security policies and organization

    • 1.1 Information security policies

      • 1.1.1 Availability of security policies

        Management approves at least one information security policy suited to the organization, keeps it current and makes it easy for staff to find and read.

        • Information Security & Privacy Policies
        • Security Governance Program
        • Management Review of Policies
        • Publishing Security & Privacy Documentation

    • 1.2 Organization of information security

      • 1.2.1 Managing information security

        Run information security as a management system steered by leadership, with a defined scope, clear objectives and regular review of how well it works.

        • ISMS Scope Document
        • ISMS Manual
        • Assigned Security & Privacy Responsibilities
        • Security & Privacy Program Review

      • 1.2.2 Security responsibilities

        Assign and document who is responsible for which security tasks, and keep conflicting duties apart.

        • Assigned Security & Privacy Responsibilities
        • Organizational Structure
        • Roles & Responsibilities
        • Cybersecurity Responsibilities
        • Segregation of Duties
        • Compliance Program Manager

      • 1.2.3 Security in projects

        Identify and handle security requirements in every project, whatever its type, as part of normal project management.

        • Risk Framing
        • Risk Assessment
        • Change Management Policy & Procedure

    • 1.3 Asset management

      • 1.3.1 Inventory of information assets

        Identify the information that matters to the business and the systems, services and people that support it, and keep a current inventory with owners.

        • Inventory of Infrastructure Assets
        • Inventory of Endpoint Assets
        • Asset Inventory Updates
        • Asset Ownership Assignment

      • 1.3.2 Classification of information assets

        Rate each information asset by its confidentiality, integrity and availability needs and apply matching handling rules.

        • Data Classification Policy
        • Data Classification Labels
        • Rules of Behavior
        • Data Retention Policy

      • 1.3.3 Approval of external IT services

        Use only external IT services, such as cloud or online tools, that have been assessed for security and approved before company information goes into them.

        • Vendor Management Policy & Procedure
        • Third-Party Criticality Assessments

      • 1.3.4 Approval of software

        Use only software that has been assessed and approved for handling company information, and control what staff can install.

        • Third-Party Criticality Assessments
        • Vendor Management Policy & Procedure
        • Rules of Behavior
        • Endpoint Security Policy

    • 1.4 Information security risk management

      • 1.4.1 Managing security risks

        Identify, assess and treat information security risks on a regular cycle and when things change, with an owner for each risk.

        • Risk Framing
        • Risk Assessment
        • Management Review of Risks
        • Risk Assessment Policy & Procedure

    • 1.5 Assessments

      • 1.5.1 Compliance checks on security processes

        Check regularly that security policies and procedures are followed in practice and are effective, and act on what is found.

        • Internal Audit
        • Security & Privacy Program Review

      • 1.5.2 Independent review of the ISMS

        Have someone independent review the security management system at planned intervals and after major changes.

        • Internal Audit
        • Security & Privacy Program Review

    • 1.6 Incident and crisis management

      • 1.6.1 Reporting security events

        Make sure everyone knows how and where to report anything that could affect security, and that reports reach the people who assess them.

        • Automated Incident Reporting
        • Incident Reporting Assistance
        • Incident Management Policy & Procedure

      • 1.6.2 Handling reported security events

        Classify each reported event, route it to the right people, coordinate the response and communication, and learn from the outcome.

        • Incident Management Policy & Procedure
        • Incident Tracking
        • Anomalous Behavior Detection
        • Centralized Security Logging

      • 1.6.3 Crisis preparedness

        Prepare in advance for severe disruptions such as disasters or major cyber attacks so that key business operations can continue and recover quickly.

        • Business Continuity Policy & Procedure
        • Disaster Recovery Policy
        • Disaster Recovery Testing

  • 2 Human resources

    • 2.1.1 Qualification of staff in sensitive roles

      Check the competence and trustworthiness of candidates for sensitive work in proportion to the role and to what the law allows.

      • Personnel Screening
      • Competency Screening

    • 2.1.2 Contractual commitment to security policies

      Bind all staff contractually to follow security policies, including the consequences of breaking them and the duties that continue after they leave.

      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Code of Business Conduct
      • Human Resources Policy & Procedure

    • 2.1.3 Security awareness and training

      Train staff, senior management included, on the security risks of handling information and refresh that training regularly.

      • Security & Privacy Awareness
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • 2.1.4 Mobile working

      Set rules and safeguards for working outside the organization's secured premises, such as from home or while travelling.

      • Endpoint Security Policy
      • Full Device Encryption
      • Session Lock
      • Malware Protection
      • Multi-Factor Authentication

  • 3 Physical security

    • 3.1.1 Security zones

      Define physical security zones around sensitive information and equipment, with protection that increases with the sensitivity of what each zone holds.

      • Physical Protection Policy & Procedure

    • 3.1.3 Handling of supporting assets

      Protect equipment and other supporting assets against loss, theft and unauthorized viewing throughout their life, including disposal.

      • Rules of Behavior
      • Media Disposal Policy
      • Inventory of Endpoint Assets
      • Human Resources Policy & Procedure

    • 3.1.4 Mobile devices and portable storage

      Control how laptops, phones, tablets and removable storage are issued, protected and used, since they are often taken off site.

      • Endpoint Security Policy
      • Full Device Encryption
      • Endpoint Encryption
      • Session Lock
      • Media Disposal Policy

  • 4 Identity and access management

    • 4.1 Identity management

      • 4.1.1 Identification means

        Manage keys, badges, tokens and other means of identification through their whole life, including issue, return and loss.

        • Access Control Policy & Procedure
        • Termination of Employment
        • Physical Protection Policy & Procedure

      • 4.1.2 User authentication

        Allow access to IT systems and services only after users are reliably authenticated, using stronger methods where the risk is higher.

        • Multi-Factor Authentication
        • Access Control Policy & Procedure
        • Password Management Guidelines

      • 4.1.3 User accounts and login information

        Give each person a personal, validated account, protect passwords and other login secrets, and keep account activity traceable.

        • Identity Validation
        • Termination of Employment
        • User Access Reviews
        • Password Management Guidelines
        • Production Database Access Restriction

    • 4.2 Access management

      • 4.2.1 Assigning and managing access rights

        Grant access rights on a need-to-know basis through an approval process, review them regularly and remove them when they are no longer needed.

        • Access Control Policy & Procedure
        • Identity Validation
        • User Privilege Reviews
        • User Access Reviews
        • Production System Access Review
        • Termination of Employment

  • 5 IT and cyber security

    • 5.1 Cryptography

      • 5.1.1 Use of cryptography

        Set rules for which encryption methods and key strengths may be used and how keys are managed, so data stays protected and recoverable.

        • Encryption Policy & Procedure
        • Encryption of Data at Rest
        • Full Device Encryption

      • 5.1.2 Protecting information in transit

        Protect information sent over internal or public networks according to its protection needs, for example with encryption.

        • Transmission Confidentiality
        • Encryption Policy & Procedure

    • 5.2 Operations security

      • 5.2.1 Change management

        Assess and control changes to the organization, processes and IT systems so they do not weaken security.

        • Change Management Policy & Procedure
        • Secure System Modification
        • Approval of Changes
        • Deployment Notifications

      • 5.2.2 Separating development, test and production

        Keep development and test environments apart from production to protect live data and services.

        • Test Data Protection
        • Secure System Modification

      • 5.2.3 Malware protection

        Protect IT systems against malware with technical tools and supporting procedures.

        • Malware Protection
        • Endpoint Security Validation

      • 5.2.4 Event logging and analysis

        Record security-relevant events on IT systems, keep the logs safe and analyze them, within the limits set by applicable law.

        • Centralized Security Logging
        • Anomalous Behavior Detection
        • Clock Synchronization

      • 5.2.5 Vulnerability management

        Find technical vulnerabilities in IT systems, assess them and fix or mitigate them in good time.

        • Vulnerability Remediation Process
        • Centralized Flaw Remediation
        • Endpoint Security Validation
        • Vulnerability Management Policy & Procedure

      • 5.2.6 Technical system and service audits

        Test IT systems and services technically, for example with scans or penetration tests, to uncover weaknesses.

        • Penetration Testing
        • Vulnerability Remediation Process
        • Internal Audit

      • 5.2.7 Network management

        Divide networks into segments based on risk and protection needs, and control and monitor traffic between them.

        • External System Connections
        • Limit Network Connections
        • Network Security Policy & Procedure
        • Network & Data Flow Diagrams

      • 5.2.8 IT service continuity planning

        Plan how critical IT services will keep running or be restored after failures or attacks, and test those plans.

        • Disaster Recovery Policy
        • Business Continuity Policy & Procedure
        • Disaster Recovery Testing

      • 5.2.9 Backup and recovery

        Back up data and IT services according to defined requirements and confirm that they can be restored.

        • Data Backup Policy
        • Data Backups
        • Backup Restoration Testing

    • 5.3 System acquisition, requirements management and development

      • 5.3.1 Security in new or changed IT services

        Define and meet security requirements whenever IT services are developed, bought or significantly changed.

        • Change Management Policy & Procedure
        • Secure System Modification
        • Approval of Changes
        • Risk Framing

      • 5.3.2 Requirements for network services

        Define the security, quality and management requirements for each network service in use.

        • Network Security Policy & Procedure
        • Subservice Organization Evaluation
        • Capacity & Performance Management

      • 5.3.3 Return and removal of data from external IT services

        Make sure company information can be returned and securely deleted when an external IT service ends.

        • Vendor Management Policy & Procedure
        • Data Retention Policy

      • 5.3.4 Protection in shared external IT services

        Make sure information held in shared cloud or hosted services is kept separate from other tenants and protected from their access.

        • Subservice Organization Evaluation
        • Shared Responsibility Model
        • Vendor Management Policy & Procedure

  • 6 Supplier relationships

    • 6.1.1 Security with contractors and partners

      Agree security requirements with contractors and cooperation partners and verify that they keep to them.

      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Subservice Organization Evaluation
      • Vendor Management Policy & Procedure

    • 6.1.2 Non-disclosure agreements

      Put non-disclosure agreements in place before sensitive information is shared outside the organization.

      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Vendor Management Policy & Procedure
      • Contractual Obligations Register

    • 6.1.3 Responsibilities with external IT service providers

      Document how security responsibilities are split between the organization and each external IT service provider.

      • Shared Responsibility Model
      • Vendor Management Policy & Procedure
      • Subservice Organization Evaluation

  • 7 Compliance

    • 7.1.1 Legal, regulatory and contractual requirements

      Identify the legal, regulatory and contractual provisions that affect information security and make sure they are met.

      • Data Governance
      • Statutory, Regulatory & Contractual Compliance
      • Contractual Obligations Register
      • Policy Documentation Retention

    • 7.1.2 Personal data protection in information security

      Take the protection of personal data into account when implementing security measures, as the relevant law requires.

      • Data Protection Policy & Procedure
      • Privacy by Design Policy
      • Privacy Officer

• PP Prototype Protection

  Additional module for organizations that build, test, store or transport vehicles, components or parts that a client has classified as needing protection.

  • 8 Prototype protection

    • 8.1 Organizational requirements

      • 8.1.1 Prototype protection policy and responsibilities

        Adopt an approved policy for protecting prototypes, review it regularly and name qualified people who are responsible for it.

        • Prototype Protection Policy & Responsibilities

      • 8.1.2 Order-specific prototype requirements

        Agree with each client how the prototypes in an order must be handled, such as classification, camouflage and transport, and make sure the staff involved know the rules.

        • Client-Specific Prototype Requirements
        • Contractual Obligations Register

      • 8.1.3 Prototype handling training

        Train everyone who works with prototypes when a project starts and at least once a year, and keep records of who attended.

        • Prototype Handling Training
        • New Hire Security & Privacy Training
        • Periodic Security & Privacy Training

      • 8.1.4 Qualification of staff in prototype areas

        Define the sensitive roles in prototype work, check that candidates meet their requirements and verify their identity before they start.

        • Personnel Screening
        • Competency Screening
        • Roles & Responsibilities

      • 8.1.5 Non-disclosure obligations

        Have non-disclosure agreements with clients and with every employee and project member who works on prototypes, in line with applicable law.

        • New Hire Policy Acknowledgement
        • Periodic Policy Acknowledgement
        • Contractual Obligations Register

      • 8.1.6 Use of subcontractors

        Involve subcontractors in prototype work only with the client's approval, under binding confidentiality terms and with proof that they meet the client's requirements.

        • Client-Specific Prototype Requirements
        • Third-Party Criticality Assessments
        • Vendor Management Policy & Procedure
        • Subservice Organization Evaluation

      • 8.1.7 Access to security areas

        Run a defined process to grant, change and revoke access to areas where protected prototypes are built, worked on or stored, including what to do when a key or card is lost.

        • Security Area Access & Visitor Control
        • Physical Protection Policy & Procedure
        • Termination of Employment

      • 8.1.8 Visitor management

        Register visitors to prototype areas, have them accept confidentiality terms before entry and keep traceable records of their visits.

        • Security Area Access & Visitor Control
        • Physical Protection Policy & Procedure

      • 8.1.9 Cameras and recording devices in security areas

        Set rules for bringing in and using phones and other devices that can take pictures or record sound in prototype areas.

        • Recording Devices & Image Material

      • 8.1.10 Image recording and handling

        Allow images of protected prototypes only with client approval through a defined process, and control how the resulting material is stored and shared.

        • Recording Devices & Image Material

      • 8.1.11 Prototype incident handling

        Agree with each client how incidents such as theft, break-ins, accidents or confidentiality breaches involving prototypes are handled, and make sure staff know the steps.

        • Client-Specific Prototype Requirements
        • Incident Management Policy & Procedure
        • Incident Tracking

      • 8.1.12 Prototype traceability

        Keep up-to-date records of every protected vehicle, component and part, showing where it is and who is responsible for it at all times.

        • Prototype Register & Traceability

      • 8.1.13 Disposal and return of prototypes

        Dispose of, recycle or return protected prototypes and related tools that are no longer needed as the client specifies, never as ordinary waste.

        • Prototype Disposal & Return
        • Media Disposal Policy

    • 8.2 Physical and environmental security

      • 8.2.1 Security concept for prototype sites

        Document a security concept for each site that handles prototypes, setting the minimum physical and environmental protections.

        • Prototype Site Security Concept
        • Physical Protection Policy & Procedure

      • 8.2.2 Perimeter security

        Secure the site perimeter so that unauthorized people cannot reach the buildings where protected prototypes are kept.

        • Perimeter & Building Shell Protection
        • Physical Protection Policy & Procedure

      • 8.2.3 Robust building shell

        Build or reinforce the walls, doors and windows of prototype areas so they cannot easily be opened or removed with common tools.

        • Perimeter & Building Shell Protection

      • 8.2.4 Sight protection

        Prevent unauthorized people from seeing protected prototypes, whether inside the security area or from outside it.

        • Sight Protection & Client Segregation

      • 8.2.5 Access control to security areas

        Protect every entrance to prototype areas with effective access control, such as documented key issue, electronic access or staffed entry checks.

        • Security Area Access & Visitor Control
        • Physical Protection Policy & Procedure

      • 8.2.6 Intrusion monitoring

        Monitor prototype premises for intrusion with an alarm system linked to a qualified response service, or with round-the-clock guarding, and keep alarm plans in place.

        • Intrusion Detection & Alarm Response

      • 8.2.7 Client segregation

        Separate the prototypes and work areas of different clients or projects, unless the client has explicitly agreed otherwise.

        • Sight Protection & Client Segregation

• DP Data Protection

  Additional module for organizations that process personal data on behalf of clients. It is assessed together with the Information Security module and is built around the GDPR.

  • 9 Data protection

    • 9.1 Data protection policies

      • 9.1.1 Data protection policy

        Have a data protection policy that management approves and keeps up to date.

        • Data Protection Policy & Procedure
        • Privacy by Design Policy
        • Information Security & Privacy Policies

    • 9.2 Organization of data protection

      • 9.2.1 Data protection responsibilities

        Appoint a data protection officer where the law requires one, or otherwise a person or function responsible for data protection, and publish how to contact them.

        • Privacy Officer

    • 9.3 Record of processing activities

      • 9.3.1 Record of processing activities

        Keep an up-to-date record of the processing carried out for clients where the law requires one, together with the security measures applied to it.

        • Personal Data Inventory

    • 9.4 Data protection impact assessment

      • 9.4.1 Handling high-risk processing

        Know which processing activities need a data protection impact assessment, carry those assessments out and support clients with theirs.

        • Data Protection Impact Assessments

    • 9.5 Data transfers

      • 9.5.1 Managing data transfers

        Base every transfer of personal data on a valid contract or transfer mechanism, and respect the client's right to approve or object to subcontracting.

        • Cross-Border Data Transfers
        • Processor Data Protection Agreements

      • 9.5.2 Obligations passed to subcontractors

        Pass client data protection obligations on to subcontractors and cooperation partners and check that they comply.

        • Processor Data Protection Agreements
        • Third-Party Criticality Assessments

      • 9.5.3 Transfers to third countries

        Record transfers of personal data to countries outside the EU and back each one with adequate safeguards, such as standard contractual clauses and a transfer impact assessment.

        • Cross-Border Data Transfers

    • 9.6 Handling requests and incidents

      • 9.6.1 Data subject requests

        Handle requests from individuals about their personal data promptly and help the client respond to them.

        • Data Subject Requests

      • 9.6.2 Data protection incidents

        Handle personal data breaches promptly, document them, limit harm to the people affected and support any notification the law requires.

        • Breach Risk Assessment & Notification
        • Data Breach Notification Policy
        • PII Breach Notification Guidelines

    • 9.7 Human resources

      • 9.7.1 Confidentiality commitment of staff

        Commit staff who handle personal data in writing to confidentiality and data protection, including after their employment ends.

        • New Hire Policy Acknowledgement
        • Periodic Policy Acknowledgement

      • 9.7.2 Data protection training

        Train staff on data protection in proportion to the data they handle, with role-specific training for people such as IT administrators.

        • New Hire Security & Privacy Training
        • Periodic Security & Privacy Training

    • 9.8 Instructions

      • 9.8.1 Handling client instructions

        Document and carry out the client's processing instructions, including corrections and deletions, and keep each client's data separate.

        • Processor Data Protection Agreements
        • Data Protection Policy & Procedure