Implement ISMS according to VDA ISA

The next step is a TISAX gap analysis. Our TISAX experts record and evaluate - through a mixture of document reviews and interview sessions with the respective departments - the status of your current implementation, based on the requirements of the VDA ISA test catalogue that are relevant for you.

This TISAX gap analysis gives you and us a clear picture and enables us to realistically estimate the implementation effort, to clearly structure the project and to define the individual work packages.

If you have already carried out a gap analysis, we work with this one and do not carry out a new one again.

After we have identified the fields of action, we work together with you to create the framework conditions and the basis for a functioning ISMS in accordance with VDA ISA / TISAX. This includes, among other things:

• The definition or concretisation of the scope, the audit objectives and the assessment level based on the requirements of your stakeholders (for example supplied OEMs).
• The definition and establishment of the security policy and objectives.
• The definition of the safety organisation including roles, committees and their responsibilities.
• The creation of the necessary project organisation for the establishment of a TISAX-compliant ISMS.

We can only achieve the defined information security goals by defining clear and precise rules. We define these "rules" in various guidelines, both for the entire workforce within the scope of the ISMS and for specific areas or target groups (e.g. IT admins, software or system development, R&D, purchasing, prototype development, human resources or facility management).

Of course, we do not reinvent the wheel, but use our numerous templates. These have been successfully tested in practice for several years and are regularly updated, so they are always state of the art.

These guidelines are subsequently coordinated with the necessary people in the departments and integrated into the relevant business areas. 

Information security risk management is at the heart of an effective ISMS, because it helps you to distinguish the important from the unimportant and to always proceed pragmatically. 

In this phase, we work together with you to create the necessary structural and procedural organisation to record, assess, deal with (meaning derive appropriate measures) and document all relevant information security risks in a structured and systematic way.

If you already have a risk management system or a comparable approach in your company, we will build on this and, if necessary, enrich it with missing relevant aspects of VDA ISA / TISAX.

Now it's time to implement the defined measures. In this phase, we provide very targeted coaching and also support you as required in the event of any resource shortages. It is important to us to prepare you or a member of your team as optimally as possible for your tasks as an information security officer.

When implementing measures, we attach great importance to practicable solutions, i.e. measures

• that help to achieve the desired level of security,
• are economical and feasible and
• still meet the VDA ISA requirements for your audit objective.

For certification maturity, you justifiably have to carry out internal ISMS audits on a regular basis. Again, we support you in planning and conducting your internal TISAX 'pre-audits'.

And to avoid auditing our own work - which could lead to a significant conflict of interest - the internal TISAX audit is carried out by an experienced TISAX auditor from our partner network who was not involved in setting up the ISMS in your company and is consequently neutral and independent. 

Such 'pre-audits' deliver a high benefit:

• You receive a realistic status of your status and progress.
• They fulfil the requirement of the TISAX standard to conduct internal audits.
• They prepare audit participants for the real TISAX audit sessions. If necessary, we coach the participants to confidently avoid "typical pitfalls" in the real TISAX audit.

The last formal step is the TISAX assessment. This must be carried out by an accredited certification authority. Since we have already accompanied you in setting up the ISMS, we unfortunately can no longer accompany you in this last step due to a conflict of interest. 

However, we would be happy to establish contact with the certification authority of our trust.