TISAX® Certification: Label, Costs, Process, and Preparation

TISAX®: What is it?

The TISAX® standard defines the requirements for Information Security Management Systems (ISMS) in the automotive industry. It is an assessment based on the ISO 27001 standard. The goal is to ensure that no company-related data leaks externally and that it is protected as effectively as possible. The ENX Association, the association of the European automotive industry, has managed the TISAX® brand since 2000.

TISAX® certification is carried out using the ISA (Information Security Assessment) questionnaire, provided by the German Association of the Automotive Industry (VDA). As part of the TISAX® certification, the VDA-ISA questionnaire covers three areas: information security, data protection, and prototype protection.

TISAX® and its Importance for Data Protection and Information Security

TISAX® (Trusted Information Security Assessment Exchange) enables representatives of the automotive industry to verify and ensure information security within their supply chains, thereby making a significant contribution to protecting their data.

Similar to ISO 27001, this standard ensures that companies in the industry adhere to the high security standards required by manufacturers and suppliers for collaboration. Certification demonstrates that a company has an effective Information Security Management System (ISMS) implemented and continuously monitors and improves it to manage and protect sensitive company information.

To learn about the differences between TISAX® and ISO 27001, see our comparison of the two security standards.

Why Does the Automotive Industry Need Its Own Label?

The automotive industry is one of the most innovative and dynamic sectors. Every new vehicle model and every new technology is developed by large teams that must meet high security standards to prevent data leaks and reputational damage. Therefore, information security and data protection are critical in the automotive industry. Companies handle a large amount of sensitive data, such as development plans and customer information. To protect this information, it is essential that companies meet strict requirements.

This is why the industry introduced TISAX® (Trusted Information Security Assessment Exchange) certification, which is based on the ISO 27001 standard. This European audit mechanism ensures that all partners and suppliers adhere to the highest security standards and that no sensitive data becomes public.

Companies certified according to TISAX® can therefore build a reputation as a secure partner and strengthen the trust of their business partners and customers in their business practices. At the same time, the certification provides them with the means to minimize IT and data protection risks.

Requirements for TISAX® Certification

Fundamentally, any company can meet the TISAX® standard – with adequate preparation. The effort required to meet TISAX® requirements also increases with company size. This is because the larger a company is, the more complex the processes that need to be optimized to comply with the specifications. Internal company processes must adapt to and fulfill the requirements of the intended ISMS. Often, the basic standards of ISO 27001 must be met, with more extensive requirements applying in some areas. Read more about TISAX® requirements here.

What are the TISAX® Levels?

The exact requirements that must be met primarily depend on which assessment level is to be achieved for TISAX® certification. The basis for all levels is the TISAX® questionnaire from the German Association of the Automotive Industry (VDA). The protection requirements are divided into 3 protection levels:

For Level 1, a self-assessment based on the questionnaire is sufficient. In Level 2, auditing service providers from the ENX Association are engaged to verify the information. This only occurs upon request regarding information provided in the self-assessment. The verification of information can take place both on-site and remotely. For high protection requirements in Level 3, the auditing service providers operate exclusively on-site and verify the information in all areas.

Learn more about the TISAX® questionnaire here.

Cost Overview: What effort is involved in TISAX® certification?

As in many other areas, the same applies to certification costs: The final investment amount depends on numerous factors. Since every company is unique, the implementation of measures before certification and the auditing process vary accordingly for each organization.

Generally, the following factors play a role in the costs of TISAX® certification:

• company size
• the scope of areas to be audited
• the duration of the TISAX® process
• the auditing service provider 

For small companies, costs are generally lower, as their scope is usually limited compared to large corporations. Large companies, however, have to dig deeper into their pockets, as they often include multiple locations and more extensive IT systems in the audit. Various sources indicate a rough cost range of an average of 10,000 to over 200,000 Euros.

TISAX® Costs in Detail

Whether a large corporation or an SME: Companies must anticipate various expenses for preparing for and passing the TISAX® audit, specifically for

• internal resources
• external consulting
• Audit Fees

Internal costs arise, for example, from the resources required for audit preparation, such as internal assessments, employee training, the implementation of security measures, a self-assessment, GAP analyses to identify existing security vulnerabilities, the introduction and adherence to policies, or measures to update internal processes. 

Good to know: Self-assessment helps evaluate the current state of information security and plan necessary improvements.

Many companies rely on the expertise of external consultants for certification preparation, and their costs must also be factored in. When undergoing an audit by a certified service provider, for example, registration fees and fees for the individual audit steps must be paid. 

The costs for auditing services vary depending on the audit service provider and the scope of the audit, covering the actual audit and the issuance of the TISAX® label. They also depend on how many locations are involved in the audit.

Costs you save with TISAX®

However, companies should be aware that certification not only incurs costs but can also lead to savings. These include, for example, premiums for cyber insurance, which protects companies against threats from cyberspace protects them. Furthermore, an ISMS can close security gaps and reduce associated financial risks.

Long-term Costs and Recertification

Even after passing the audit, companies must expect ongoing costs. To maintain the certification and renew it with as little effort as possible, companies must regularly check their ISMS for vulnerabilities and continuously improve it. 

TISAX® certificates are valid for three years. Recertification is necessary to ensure that security standards continue to be met. The effort required for recertification can vary depending on changes in the company's structure or IT landscape.

TISAX® Certification Process

TISAX® certification follows a clearly structured process, which is described in detail in the TISAX® Participant Handbook of the ENX Association. This association of European automotive manufacturers manages the TISAX® standard and is, among other things, responsible for accrediting audit service providers.

By the way: There is no such thing as a "TISAX® certificate"; the term is therefore somewhat misleading at first. Instead, after fulfilling all requirements, companies receive an assessment report and a label that they can use for promotional purposes. Companies are also entered into a database maintained by the ENX Association, which all participants can access.

The three essential steps of the certification process are described below.

1. Registration

In the first step, you register your company for the audit. You can conveniently complete the paid registration via the ENX Association's online portal. Company details are required for this. 

You must also define a scope for the audit and determine how extensive the information security audit should be. Companies must select at least one audit objective.

2. Assessment

In the next step, you prepare your company for the assessment. This includes, among other things, a self-assessment to evaluate the current state of information security and, if necessary, plan measures to close gaps. The basis for this is the ISA (Information Security Assessment) – the VDA's catalog of criteria.

During the preparation for the audit, the identified gaps are then closed and necessary documentation is created. Subsequently, you select an ENX-recognized audit service provider who conducts an initial assessment. The service provider assesses the implemented security measures on-site and evaluates them.

There are three different types of assessment:

• Initial Assessment
• Action Plan Assessment
• Follow-up Assessment

Following the initial assessment, the auditor prepares a report summarizing the audit results. The goal of the TISAX® assessment is to confirm that your Information Security Management System meets all defined requirements.

If there are deviations, you must make improvements and go through further assessment steps. The necessary plan for this is the action plan. An action plan assessment ensures that your plan meets the TISAX® requirements.

During the follow-up assessment, it is then determined whether the deviations have been resolved by your defined measures. You have nine months to resolve them. If this period expires, you must undergo another initial assessment.

3. Sharing

Upon successful completion of the audit, the TISAX® label is issued. It certifies that your organization meets the required security standards and can be shared with your partners. You also receive a "TISAX® Assessment Report," which the auditor coordinates with you.

The assessment result is valid for three years and must then be proactively renewed. ENX recommends starting the new process at least one year before the label expires. This is because all three certification steps must be completed again for re-certification. This also means that new costs will be incurred.

How long does the TISAX® assessment take?

The duration of the TISAX® certification process varies depending on the size of the company and the scope of the assessment. On average, the process from preparation to certification takes about six to 18 months. Depending on the company size, the costs for TISAX® certification vary. The decisive factor is what has already been implemented in the company and what is still missing. 

The longer the certification process takes, the higher the final costs will be. Therefore, companies should aim for the most efficient certification process possible and prepare thoroughly for the assessment.

Preparing for the TISAX® Assessment: Your Opportunity to Save Costs

To minimize the costs of TISAX® certification, companies should focus on thoroughly preparing for the assessment. This includes, among other things, starting the self-assessment early to identify potential security gaps.

Here's how to prepare optimally:

• Inform yourself thoroughly about your rights and obligations in the TISAX® process.
• Register your company for the TISAX® assessment.
• Complete the VDA self-assessment questionnaire and select an audit service provider.
• Address identified weaknesses as needed

Upon successful completion of the audit, you will receive the TISAX® label and be entered into the ENX Association's TISAX® database.

It is advisable to form internal working groups and define clear responsibilities. The use of checklists and standardized processes can also help reduce the effort.

Exchanging ideas with other certified companies can also provide valuable insights and best practices. Furthermore, for many companies, collaboration with specialized experts has proven helpful.

Implement TISAX® certification correctly with our help

At proliance.ai, as a candidate for TISAX® certification, you receive the necessary expertise and support to efficiently navigate the path to robust information security management. A personal ISMS consultant helps you stay focused and efficiently prepares your company for TISAX® certification.

Even after successful certification, the ISMS solution remains a helpful companion, proactively informing you about legal changes and providing concrete recommendations for action.

Learn more about InfoSec – the efficient solution for anyone looking to save time and money on the way to the TISAX® label.

{{infobox}}

Conclusion: Good preparation leads to audit success

TISAX® certification ensures uniform standards in information security and data protection within the automotive industry. Although not legally mandated, it is expected by most companies and is crucial for market acceptance and collaboration within the industry. Every company, regardless of its size, should be aware of the importance of TISAX® for its own data security and economic viability.

TISAX® certification is a complex process. Through careful planning and efficient preparation, you can keep costs under control and sustainably improve information security in your company.

The ISMS professionals at proliance.ai can help you with this, keeping an eye on your data protection in addition to information security.