Implementation of VDA and ENX TISAX®

Please read our case study on the implementation of ENX TISAX® in a company that develops automotive systems. We are proud that we have completed one of the first ENX TISAX® certification projects in Eastern Europe. After that, we used our experience in other ENX TISAX® implementations. We were the first and remain the best!

VDA ISA and ENX TISAX® Compliance Assessment Online Wizard is recommended for you. Spend 30 minutes to check the extent to which your company complies with VDA ISA and ENX TISAX®, and also how much time you need to achieve full compliance and certification.

Main page about ENX TISAX®

What is VDA ISA and ENX TISAX®

VDA logotype International information security standard VDA ISA was developed by the German Association of the Automotive Industry VDA (Verband der Automobilindustrie) based on ISO/IEC 27001 and 27002 standards.

The standard VDA ISA (Information Security Assessment) contains strictly structured information security assessment criteria, KPIs and additional optional modules:

ENX TISAX® (Trusted Information Security Assessment Exchange, a registered trademark that belongs to ENX) is a framework for VDA ISA which allows independent vendors to share their certification and assessment results with their customers (usually from the automotive industry).

Our certifications (CISSP, ISO 27001 Lead Auditor, CISA, OSCP, CEH, etc.) allow us to cover both formal and practical aspects of security compliance and security management.

When building an Information Security Management System (ISMS) and security controls, we rely not only on ISO 27001/27002, VDA ISA and TISAX requirements, but also actively use other standards and frameworks, when this is appropriate or explicitly required by our customers or their partners. For example, ISO/TS 16949, ASPICE (Automotive Software Performance Improvement and Capability dEtermination), GDPR (General Data Privacy Regulation), and so on.

Our approach to implementation begins with simple steps so that you receive the first results for free. That would also introduce you to the process and help you understand how the implementation works and your role in it.

Scoping and prioritization

Metaphor for priorities We prepare individual self-assessment questionnaires for our customers, to start assessing the current state of the ISMS in accordance with VDA ISA. Then we define and document the scope and elaborate the project plan for the initial audit and gap analysis.

Scope definition is crucial for VDA ISA and ENX TISAX®. Any mistakes at this stage can lead to excessive implementation and maintenance works or unsuitable certification results. Also, we perform the initial prioritization of tasks, to allow you to get the most important security measures as soon as possible.

Usually, the scope includes the customer's business processes to which physical and logical security processes apply. They include, but are not limited to:

We perform this stage for you free of charge. When you are sure that you are interested in working with us further, we will send you a commercial offer and sign a service agreement.

Initial audit, gap analysis, and detailed project planning

We usually carry out this stage within 3 to 4 weeks, depending on the approved scope. During the initial audit, we interview the customer’s employees, verify documents, assess physical security and the perimeter, etc.

This stage includes the analysis of the initial or current state of the processes and information security management controls, business processes and technological processes; analysis of the physical security of the premises, personnel, IT infrastructure, etc. The outcome of this stage is an initial audit report, gap analysis and a detailed schedule for the implementation of the VDA ISA controls.

The implementation plan takes into account the customer’s capability to perform some part of the project tasks.

Implementation of security processes and operations

Cyber security This stage is usually performed within 4 to 9 months, depending on the approved scope, initial state, requirements and the results of the previous stage.

This stage includes, but is not limited to, implementation of the following essential steps:

The result of this phase is not just a set of documents and records that correspond to your actual processes, but also a new security culture within your organization and the highest degree of readiness for official certification.

Certification process

ENX TISAX certificate sample

The certification process usually lasts 1-3 months, depending on the approved scope. During this stage, we will select the certification body, perform a pre-audit, make the necessary corrections and conduct the certification audit.

First, we help you register for the audit and fill in the ENX TISAX® application form. Then we help you choose a certification body from the list of ENX approved TISAX® audit providers. We consult with the certifying organization on your behalf.

Then you make an agreement with the certification body directly and we start the pre-audit and implementation process described above.

When the date of the official certification comes, we represent you and show what we have built for you. After that, the auditor analyzes the results, collects the evidence and produces the final report. We support you throughout the whole process and help you provide the required documents.

Finally, you get the ENX TISAX® certificate, become officially compliant and can share the assessment results with your clients through the ENX portal.

Click the button below to contact us and get a free consultation on VDA ISA and ENX TISAX®:

What is next?

ENX TISAX® certification is valid for 3 years. The Information Security Management System (ISMS) must constantly be kept up-to-date. It should be developed further, maintained and optimized.

We provide continuous support of every element of the ISMS, conducted throughout the entire ISMS life cycle. It includes but is not limited to:

We provide managed compliance with ENX TISAX® and fully support you when you need to confirm your ENX TISAX® compliance status in the future.

Please choose whether you would like to get help on VDA ISA and ENX TISAX® implementation:

or to assess the compliance of your organization with ISO 27001 online in several minutes for free:

Main page about ENX TISAX®.

Who we are, what we do and what we offer.

Compliance services.

Security Team Extension and Remote CISO Services.

Our certificates:

Offensive Security