TISAX crisis simulation: evidencing incident and continuity processes
What is TISAX?
TISAX (Trusted Information Security Assessment Exchange) is the automotive industry’s standard for information security, operated by the ENX Association. It is based on the VDA ISA catalogue. Suppliers do not have to be audited by every OEM individually. They are assessed once and share the result through the TISAX platform. For many suppliers TISAX is therefore a de facto condition for staying in business.
What TISAX expects from suppliers
The VDA ISA catalogue requires, among other things, established processes for the management of security incidents and for business continuity. The assessors want to see that these concepts work. That applies especially at the higher assessment levels (AL2 for information with high protection needs, AL3 for very high protection needs).
Crisis simulation as evidence
A crisis simulation as a discussion-based tabletop exercise shows whether your response and continuity processes hold in a real incident: whether roles are clear, escalation and communication work and the reporting paths are kept. Every exercise ends with an auditable report that you can present in the TISAX assessment as evidence of effectiveness.
Typical scenario: data leak at the supplier
A typical exercise scenario for automotive suppliers is the leak of confidential OEM development data. The team rehearses the immediate measures, informing the affected OEM, keeping to reporting deadlines and internal crisis communication. These are the processes whose effectiveness is assessed in the TISAX assessment.
Frequently asked questions
What is TISAX?
TISAX (Trusted Information Security Assessment Exchange) is the assessment and exchange mechanism of the automotive industry for information security, operated by the ENX Association on the basis of the VDA ISA catalogue. Suppliers use it to evidence an appropriate level of information security towards OEMs and other partners.
Does TISAX require rehearsed crisis processes?
The VDA ISA catalogue covers, among other things, the management of security incidents and business continuity. Effectiveness is assessed. Documented and rehearsed response processes are robust evidence for that, especially at the higher assessment levels (AL2/AL3).
How does SecDrills support TISAX evidence?
In a tabletop exercise with SecDrills your team plays through a realistic incident, such as a data leak at a supplier. An auditable report with roles, decisions and timestamps is produced automatically, which you can present to the assessor.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.