TISAX Participant Handbook

The scope description defines the assessment scope. For the scope description, you have to choose one of two scope types:

We discuss the standard scope in the following section. The standard scope is the right choice for well over 99% of all participants. Therefore, we only discuss the custom scopes in Section 7.8, “Annex: Custom scopes”.

The standard scope description is the basis for a TISAX assessment. Other TISAX participants only accept assessment results based on the standard scope description.

The standard scope description is predefined and you can’t change it.

A major benefit of having a standard scope is that you don’t have to come up with your own definition.

This is the standard scope description (version 2.0):

We strongly recommend choosing the standard scope. All TISAX participants accept information security assessment results based on the standard scope.

Your next task after defining the scope type is to decide which locations belong to the assessment scope.

If your company is small (one location), this is an easy task. You simply add your location to the assessment scope.

If your company is large, you can consider registering more than one assessment scope.

Having a single scope that contains all your locations has advantages:

But a single scope may have disadvantages such as:

The question whether to have just one scope or several scopes is one that only you can answer. But answering the questions in the following diagram may help you decide.

Now that you have decided which locations are part of your assessment scope, you can continue gathering some location-specific information.

For each location we ask for information like company name and address. We also ask for some additional information that allows our TISAX audit providers to get a better idea of your company structure. Your answers will be the basis of their effort estimations.

Please prepare yourself to provide the following details for each of your locations (the red asterisk * indicates mandatory information in the online process):

For each location you have to specify a “location name”. The purpose of the location name is to make it easier to refer to the location when you assign them to an assessment scope.

We recommend assigning location names based on the following pattern:

For each scope, you have to specify a “scope name”. The main purpose of the scope name is to make it easy for you to identify a scope in the overview list of scopes in the ENX portal. You should assign a name that is helpful to the reader and your colleagues. For external communication, you should use the Scope ID.

You can specify any name you want. But you shouldn’t assign the same scope name for more than one scope.

When you later want to renew your TISAX assessment, you need to create a new scope (possibly identical to the current scope). We therefore recommend adding the year of the assessment to the scope name.

We recommend assigning scope names based on the following pattern:

In order to communicate with you, we collect information about contacts at your company.

We ask for at least one contact for your company as TISAX participant in general and one for each assessment scope. You have the option to provide additional contacts.

During your registration preparations, you should decide who at your company will be a contact.

We ask for the following contact details:

The main purpose of TISAX is to publish your assessment result to other TISAX participants and to share your assessment result with your partner(s).

You can decide about the publication and sharing of your assessment result either during the registration process or at any time later.

If you are going through the TISAX process as a pre-emptive step, you can already decide to publish your assessment result to the community of TISAX participants. Otherwise, there is nothing to prepare for at this stage.

If your partner requested that you to go through the TISAX process, you need to share your assessment result sooner or later. You can already share status information with your partner during the registration. Once your assessment result is available, your partner will then automatically have the permission to access it^[6].

There are two things you need to share status information:

So you may want to make sure you have this information.

For more information on publishing and sharing your assessment result, please refer to Section 6, “Exchange (Step 3)”.

There are currently twelve TISAX assessment objectives. You have to select at least one assessment objective. You may select more than one.

Consider your assessment objective the benchmark for your information security management system. The assessment objective is a key input for the TISAX process. All TISAX audit providers base their assessment strategy mainly on the assessment objective.

The current TISAX assessment objectives are:

Example: If you are conducting test drives on public roads, then the assessment objective “Test vehicles” is one of your assessment objectives.

The ISA contains three criteria catalogues (information security, prototype protection, data protection). Each criteria catalogue is composed of so-called “control questions” and associated requirements.

Each assessment objective defines:

For some assessment objectives only a subset of the control questions and requirements are applicable.

For further background information on the TISAX assessment objectives and the applicable control questions and requirements, please refer to Section 5.2.2, “Understand the ISA document”.

Your partner may speak of “TISAX labels”. “Assessment objectives” and “TISAX labels” are almost the same. The difference is that you start into the assessment process with the “assessment objectives” and if you pass the assessment you receive the corresponding “TISAX labels”.

Example: Your partner requires you to get the TISAX label “Info high”. Then you select “Info high” as your assessment objective.

The figure below shows you the input and output of the TISAX process:

For more information on TISAX labels, please refer to Section 5.4.14, “TISAX labels”.

Ideally, your partner tells you precisely which assessment objectives you have to achieve.

You have to select the assessment objective based on your own judgement if:

If you have to select the assessment objective based on your own judgement, you may find it helpful to consider the following aspects:

Further explanations:

Your partner has various types of information, of which some may deserve a higher level of protection than others. The ISA accommodates this by differentiating three “protection needs”: normal, high and very high. Your partner classifies his information and usually assigns protection needs.

The higher the protection needs, the more your partner is interested in making sure that it is safe to let you handle their information. Therefore, TISAX differentiates three “assessment levels” (AL). The assessment level defines which assessment method the audit provider has to apply. A higher assessment level increases the effort that goes into the assessment. This results in greater care and accuracy in the assessment.

The table below shows you the assessment levels that apply to the TISAX assessment objectives:

Assessment level 1 (AL 1):

Assessments in assessment level 1 are mainly for internal purposes in the true sense of a self-assessment.

For an assessment in assessment level 1, an auditor checks for the existence of a completed self-assessment. He does not assess the content of the self-assessment. He does not require further evidence.

Results of assessments in assessment level 1 have a low trust level and are thus not used in TISAX. But it is of course possible that your partner may request such a self-assessment outside of TISAX.

Assessment level 2 (AL 2):

For an assessment in assessment level 2, the audit provider does a plausibility check on your self-assessment (for all locations within the assessment scope). He supports this by checking evidence^[8] and conducting an interview with the person in charge information security.

The audit provider does the interview generally via web conference. At your request, he can conduct the interview in person.

If you have evidence you don’t want to send to the audit provider, you can request an on-site inspection. In this way, the audit provider can still check your “for your eyes only” evidence.

Assessment level 3 (AL 3):

For an assessment in assessment level 3, the audit provider does a comprehensive verification of your company’s compliance with the applicable requirements. The auditor uses your self-assessment and submitted documentation to prepare the assessment. But in contrast to assessment level 2, the auditor will verify everything. He will:

Assessment levels and assessment methods

The following table provides a simplified overview of the audit methods associated with each assessment level:

Additional information:

TISAX does not necessarily require you to subject all of your own suppliers to the same requirements. If your assessment objective is “Information security with very high protection needs”, this does NOT automatically mean that your own suppliers have to achieve the same assessment objective. It does not even mean they need to have TISAX labels at all.

But you still have to check for all of your suppliers whether using their services increases risks or introduces new risks.

Two very simplified examples:

However, the risk assessment may show that your supplier also has to meet the requirements for very high protection needs. In this case, TISAX labels are an option to prove this to you accordingly.

The Participant ID:

The Scope ID:

The ISA currently has three “criteria catalogues”^[13]:

Each criteria catalogue has its own Excel sheet:

Which criteria catalogue is relevant for you? This depends on your assessment objective(s).

Each assessment objective defines which requirements from which criteria catalogue apply. For some assessment objectives, only requirements from one criteria catalogue apply, for others, requirements from more than one criteria catalogue apply.

The aforementioned assessment objectives map to these criteria catalogues:

Example: If you have selected the assessment objective “Data Protection”, then you will have to answer the questions in the criteria catalogues “Information Security” AND “Data Protection”.

You may have noticed that there is more than one assessment objective per criteria catalogue. How do you know which requirements are applicable to which assessment objective?

The following table shows you which requirements are applicable:

The screenshot below shows the main elements of the control questions in the “Information Security” criteria catalogue. (The other criteria catalogues only have a subset of these elements.) We explain all elements further down.

Each criteria catalogue groups the questions in chapters.

Example: “2 Human Resources”

The grouping is based on the typical responsibilities in a company. These departments are specified in the column “Usual person responsible for process implementation” (“HR” in the example above).

You find the questions for each criteria catalogue in the respective Excel sheets.

Example: “4.1.2 To what extent is the user access to network services, IT systems and IT applications secured?”

The control questions are also referred to as “controls”. This is “auditor speak”. The ISO standards that the ISA builds upon use the term “control”.

Between the columns “Maturity level” and “Control question” are form fields you need to fill in when you are conducting a self-assessment:

Only the brief description of your implementation and the reference to your documentation are mandatory. This information will help our TISAX audit providers to better understand your company and to prepare the assessment.

There are more optional columns to support your self-assessment:

To the right of the column “Control question” is the column “Objective” (column J). Its content describes what you need to achieve regarding this aspect of your information security management.

Example (for control question 4.1.2): “Only securely identified (authenticated) users are to gain access to IT systems. For this purpose, the identity of a user is securely determined by suitable procedures.”

The requirements are what you are expected to fulfil in order to achieve the objective.

The requirements are spread across four columns:

You have to fulfil all requirements up to the protection need you need to achieve (which you can derive from your assessment objective).

For some assessment objectives, only a subset of the requirements are applicable. For more information on the applicability of the requirements, please refer to Table 8, “Applicability of requirements to the assessment objectives” in Section 5.2.2.1, “Criteria catalogues” and especially the note at the end of the section.

For more information about the ISA definitions of the requirement levels “must” and “should”, please refer to the “Key terms” in the Excel sheet “Definitions”.

The ISA uses the concept of “maturity levels” to rate the quality of all aspects of your information security management system. The more sophisticated your information security management system is, the higher your maturity level will be.

The ISA differentiates six maturity levels. You can find the detailed definition in the Excel sheet “Maturity levels”. For a consolidated view on the maturity levels, we quote the informal descriptions as provided in the ISA:

You have to rate the maturity level of your information security management system per question. Enter your maturity level in the column “Maturity level” (column E).

For more information on target maturity levels and their impact on your assessment result, please refer to Section 5.2.4, “Interpret the self-assessment result”.

With this improved understanding, you are now ready to start the self-assessment.

Your result score summarises the self-assessment result.

You find the result score (“Result with cutback to target maturity level”) in the Excel sheet “Results (ISA5)” (cell D6). We will explain “cutback” soon.

For understanding and subsequently interpreting your self-assessment result and your result score, you need to differentiate two analysis levels:

The figure below shows the analysis levels:

The figure below shows you where to find the results on the score level and the results on the question level:

The next figure shows a simplified view of the analysis levels, the ISA target definitions and your own results:

The following sections explain the result and its analysis in detail.

The ISA defines a “target maturity level” of 3 for each question.

For more information on the definition of each maturity level, please refer to Section 5.2.2, “Understand the ISA document”.

The ISA defines the target maturity levels in the Excel sheet “Results (ISA5)” (starting at column G, row 22; see figure below).

In order to receive TISAX labels, you usually need to have maturity levels for each question that are equal to or above the target maturity level.

Example: If the target maturity level for question X is “3”, your maturity level for that question should be “3” or higher. If your maturity level for that question is below “3”, you may not receive TISAX labels.

This has to happen for each question. If the target maturity level for two questions is “3”, you can’t compensate for a maturity level of “2” for one question with a maturity level of “4” for the other question.

The ISA document automatically transfers your maturity levels from the Excel sheet “Information Security” (column E) to the Excel sheet “Results (ISA5)” (starting at column H, row 23):

Your maturity level is subject to a calculation before the ISA document summarises it in your result score. Basically, your maturity level is “cut back” to the target maturity level. This is done so that questions where your maturity level is above the target maturity level don’t compensate for questions where your maturity level is below the target maturity level.

Here’s how the ISA calculates your result on the question level:

Example (see figure below): The target maturity level is “3”. Your maturity level is “4”. Your “cut back result” for this question will be “3”.

The figure below shows that if your maturity level is higher than the target maturity level, the ISA cuts it back (the colours green, orange and red match with the colours used in the “Result” column, see Figure 19, “Your maturity levels in the Excel sheet “Results (ISA5)””).

Below is another way to view the maturity levels on the question level. The colours of the circles illustrate the target maturity level or the “distance” to it (example: the circle is orange if the maturity level is “-1” below the target maturity level). The check marks illustrate your maturity level.

The ISA defines an “ideal” overall maturity level — the “maximum result score” (or “Maximum score”, cell G6).

In theory, this overall maturity level is the average of all target maturity levels (on the question level). This would be a maximum result score of “3.0”.

However, it is “3.0” only if all questions apply to your situation. As soon as a question is not applicable to your situation, the average changes and the maximum result score is lower than “3.0”.

Based on a view shown further above (Figure 22, “Maturity levels on question level”), you can see below what’s put into the average for the maximum result score:

Your overall result score (“Result with cutback to target maturity levels”, cell D6):

Again using a view shown further above (Figure 22, “Maturity levels on question level”), you can see below what’s put into the average for the result score:

The result score tells you whether you:

If your result score (“Result with cutback to target maturity levels”) is below “3.0”, then at least for one question your maturity level doesn’t match the target maturity level. In this case, you probably must improve your information security management system before you are ready for your TISAX assessment.

The purpose of the analysis above is to know whether you are ready for a TISAX assessment.

You are definitely ready for a TISAX assessment if your result score (“Result with cutback to target maturity levels”) is (close to) “3.0”. In this case, all values in the “Results” column (H) are green (no orange or red).

If they are not green, you need to address your self-assessment result (please refer to Section 5.2.5, “Address the self-assessment result”).

The figure below shows the ISA spider web diagram on the Excel sheet “Results (ISA5)”. The green line marks the target maturity level per chapter. If your maturity levels are on or above that line, you are ready for a TISAX assessment. If they are below that line, this may not be sufficient to receive TISAX labels.

If you “unfold” the ISA spider web to the question level, you get a similar green/red view on the question level:

Like all TISAX assessments, the initial assessment starts with a formal opening meeting. The formal opening meeting is usually done with a conference call or web conference. For small companies, possibly with some experience from other audits, this doesn’t take long.

The purpose of this meeting is to:

According to the prepared plan, the audit provider conducts the initial assessment. How this will look in detail depends on your assessment objectives. The assessment mainly consists of conference calls, on-site interviews and on-site inspections in varying degrees of depth^[23].

The audit provider presents all his findings during the initial assessment.

In the closing meeting, your audit provider again summarises all his findings.

After the closing meeting, the audit provider prepares and sends you the draft version of the “TISAX assessment report”. You can voice objections if you think the audit provider misunderstood something.^[24] Then the audit provider issues the “TISAX assessment report”.

At this stage, the current overall assessment result will either be:

If your overall assessment result is “conform” right at the initial assessment, you can skip the rest of the assessment section and proceed to the exchange of your result.

If your overall assessment result is “major non-conform”, your next task is to work out a plan for how to address the findings and how to close any gaps the audit provider found. The plan is officially called the “corrective action plan”.

Reasons for a “corrective action plan assessment” are:

The “corrective action plan assessment” is not necessarily an independent event. You have the option to already present your “corrective action plan” during the closing meeting of the initial assessment. The audit provider can then directly conduct the “corrective action plan assessment”.

If you combine the “corrective action plan assessment” with the initial assessment, and your “corrective action plan” fulfils the requirements, you can agree with the audit provider that you don’t need an “initial assessment report”. Instead, your audit provider would just prepare the “corrective action plan assessment report”. This report allows you to directly receive temporary TISAX labels.

The audit provider assesses your “corrective action plan” against the following requirements:

If your overall assessment result is “minor non-conform”, you receive temporary TISAX labels.

The benefit of temporary TISAX labels is that your partner generally accepts them under the condition that you later receive permanent TISAX labels. This may help you if proving the effectiveness of your information security management system to your partner is urgent.

The prerequisite for temporary TISAX labels is a corrective action plan assessment report with the overall assessment result “minor non-conform”.

Temporary TISAX labels are equal to permanent TISAX labels. The only difference is the shorter validity period of temporary TISAX labels.

Temporary TISAX labels can be valid for up to nine months after the closing meeting of the initial assessment. The validity period of the temporary TISAX labels is determined by the longest implementation period of the corrective actions.

Examples:

For more information on the requirements for implementation periods, please refer to Section 5.4.9.3, “Corrective action plan requirements”

Once you’ve completed all corrective actions, you should request the “follow-up assessment”.

Your audit provider can conduct the follow-up assessment(s) within up to nine months after the conclusion of the initial assessment^[26].

If you don’t need temporary TISAX labels, you can directly request a follow-up assessment. You don’t need to have a “corrective action plan assessment” prior to a follow-up assessment.

In case you need temporary TISAX labels, you may want to ensure there is no gap to receiving the permanent TISAX labels. We therefore recommend requesting your follow-up assessment well ahead of the latest possible date^[27]. The reason is that you want to have enough buffer time to address any minor findings identified during a follow-up assessment.

The mapping between assessment objectives and corresponding TISAX labels is pretty straightforward. But there is another important aspect: Some TISAX labels are hierarchically linked. This means that if you receive a certain TISAX label, you automatically receive the TISAX labels “below” that particular label.

Example: If your assessment objective was “Very high availability”, you receive the corresponding TISAX label “Very high availability”. But because the assessment objective “Very high availability” is a superset of “High availability”, you automatically receive the TISAX label “High availability”, too.

This hierarchy currently exists for these TISAX labels:

You can derive these hierarchical relationships by comparing the applicable requirements as specified in Table 8, “Applicability of requirements to the assessment objectives”.

This might not seem important for every participant. But imagine one partner requests you to show the TISAX label “Very high availability” and another one requests the TISAX label “High availability”. Then having both TISAX labels makes it easier for everyone because no one needs to understand that “High availability” is a subset of “Very high availability”. This may be particularly true for partners where having certain TISAX labels is part of rather stringent purchasing process. You surely won’t want to explain that “Very high availability” is “better” than “High availability”. You just show all your TISAX labels and the person doing the evaluation can simply check off the requirement “must have TISAX label ’High availability’“.

TISAX labels are generally valid for three years. The validity period starts at the end of the assessment process (even before the TISAX assessment report is issued).

Their validity period might be shorter if something significant regarding the TISAX assessment scope changes.

Examples: relocation of your company, new locations. (For instructions on what to do in such cases, please refer to Section 7.9.3.2, “How to request the change of a location” and Section 7.9.3.4, “How to add an additional location”.)

To keep your TISAX labels long-term, you need to renew^[30] them every three years.

For this you basically need to run through the TISAX process again (register an assessment scope, get TISAX-assessed again, share your assessment result). The registration is somewhat easier as you don’t need to re-create your company as a TISAX participant. And you can of course re-use all your contacts and locations that are already stored in the TISAX database.

Now that you received your TISAX labels, you can proceed to the last step and share them with your partner.

To add a new contact, follow these steps:

To delete an existing contact, follow these steps:

To update the details of an existing contact, follow these steps:

If you want to request the change of your company’s name, please follow these steps:

We will check your request, possibly accept the request to change the company name, and inform you once it is done.

If one of your locations relocated to a new address, please follow these steps:

The audit provider will check your request and update your assessment scope in the ENX portal.

If an official authority renamed the street of your location, please follow these steps:

We will check your request, possibly accept the request to change the street name, and inform you once it is done.

If you open an additional location during the validity period of your existing TISAX labels, you can request a “scope extension assessment” from your audit provider.

For more information, please refer to Section 7.10, “Annex: Scope extension assessment”.