TISAX: assessment readiness starts with evidence
ENX identifies ISA, published by VDA, as the catalogue underpinning TISAX assessments. This approach supports assessment of information security maturity in the automotive industry and sharing results with partners through the ENX portal. ENX — Information Security Assessment.
For a supplier, preparation should start by defining scope: sites, processes, information handled and commitments made to customers. Collecting policies without checking their implementation leaves the main question unanswered: how is information actually protected?
As a practical preparation step, I recommend selecting a real process and tracing the information flow: who receives data, who authorises access, where it is stored and how it is deleted. This exercise helps identify differences between documented procedures and operations.
A useful self-assessment should generate actions with owners and deadlines. Gather evidence of access reviews, incident handling, continuity and supplier monitoring, selected according to the scope and applicable requirements.
Before commissioning an assessment, confirm the ISA version, objectives and applicable arrangements with the provider. An internal rehearsal using interviews and document sampling is a practical way to test the team’s readiness.
Practical next step: Discuss your organisation’s preparation and audit needs. Get in touch.