{"id":4530,"date":"2022-01-31T10:14:34","date_gmt":"2022-01-31T09:14:34","guid":{"rendered":"https:\/\/www.sec4you.com\/?page_id=4530"},"modified":"2022-10-05T08:32:15","modified_gmt":"2022-10-05T06:32:15","slug":"vda-isa-implementation-for-automotive","status":"publish","type":"page","link":"https:\/\/www.sec4you.com\/en\/consulting\/vda-isa-implementation-for-automotive\/","title":{"rendered":"VDA<\/span> ISA<\/span> imple\u00admen\u00adta\u00adti\u00adon for automotive"},"content":{"rendered":"

<\/p>

VDA<\/span> ISA<\/span> IMPLEMENTATION<\/span> FOR<\/span> AUTOMATIVE<\/span><\/strong><\/p>\n<\/div>

<\/div>
<\/div><\/div>
<\/div>
<\/span><\/div>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div>
<\/div>

The VDA<\/span> ISA<\/span> stan\u00addard for infor\u00adma\u00adti\u00adon secu\u00adri\u00adty in the auto\u00admo\u00adti\u00adve indus\u00adtry pro\u00advi\u00addes audi\u00adta\u00adble and uni\u00adform spe\u00adci\u00adfi\u00adca\u00adti\u00adons for mar\u00adket par\u00adti\u00adci\u00adpan\u00adts. Fol\u00adlo\u00adwing the intro\u00adduc\u00adtion of an ISMS<\/span> based on VDA<\/span> ISA<\/span>, a TISAX<\/span>\u00ae audit or cer\u00adti\u00adfi\u00adca\u00adti\u00adon is per\u00adfor\u00admed by an ENX-accre\u00addi\u00adted test\u00ading ser\u00advice provider.<\/p>\n<\/div>

Note: TISAX<\/span>\u00ae is a regis\u00adtered trade\u00admark of the ENX<\/span> Asso\u00adcia\u00adti\u00adon. SEC4YOU<\/span> has no busi\u00adness rela\u00adti\u00adonship with the ENX<\/span> Association.<\/em><\/span><\/p>\n<\/div>

The advan\u00adta\u00adges of VDA<\/span> ISA<\/span> and TISAX<\/span>\u00ae<\/strong><\/h3><\/div>

TISAX<\/span>\u00ae is com\u00adpa\u00adra\u00adble to ISO<\/span> 27001<\/strong><\/p>\n

The VDA<\/span> ISA<\/span> cata\u00adlog is based on sel\u00adec\u00adted con\u00adtrols of ISO<\/span>\/IEC<\/span> 27001, but spe\u00adci\u00adfies the requi\u00adred imple\u00admen\u00adta\u00adti\u00adon in gre\u00adat detail in many mea\u00adsu\u00adres. As a result, a TISAX<\/span>\u00ae cer\u00adti\u00adfi\u00adca\u00adte can replace an ISO<\/span> 27001 certification.<\/p>\n

Uni\u00adform safe\u00adty level in the auto\u00admo\u00adti\u00adve industry<\/strong><\/p>\n

Despi\u00adte a lar\u00adge num\u00adber of Euro\u00adpean test\u00ading ser\u00advice pro\u00advi\u00adders, the TISAX<\/span>\u00ae label is award\u00aded strict\u00adly accor\u00adding to uni\u00adform spe\u00adci\u00adfi\u00adca\u00adti\u00adons. Mar\u00adket par\u00adti\u00adci\u00adpan\u00adts the\u00adr\u00ade\u00adfo\u00adre rely on the uni\u00adform safe\u00adty level of TISAX<\/span>\u00ae cer\u00adti\u00adfied companies.<\/p>\n

TISAX<\/span>\u00ae cer\u00adti\u00adfi\u00adca\u00adti\u00adon is requi\u00adred for new sup\u00adp\u00adly con\u00adtracts with OEMs\"Schweinwerfer\"<\/strong><\/p>\n

If infor\u00adma\u00adti\u00adon is exch\u00adan\u00adged with OEMs and pro\u00adces\u00adsed for them, the\u00adse cli\u00adents requi\u00adre a TISAX<\/span>\u00ae label \u201cInfor\u00adma\u00adti\u00adon Secu\u00adri\u00adty High\u201d or \u201cInfor\u00adma\u00adti\u00adon Secu\u00adri\u00adty Very High\u201d from the auto\u00admo\u00adti\u00adve sup\u00adpli\u00aders as a mini\u00admum. When hand\u00adling pro\u00adto\u00adty\u00adpes, addi\u00adtio\u00adnal\u00adly \u201cPro\u00adtec\u00adtion of pro\u00adto\u00adty\u00adpes\u201d. The purcha\u00adsing depart\u00adments of the lar\u00adge OEMs such as BMW<\/span>, Audi, Volks\u00adwa\u00adgen and others now also demand TISAX<\/span>\u00ae from small companies.<\/p>\n

Reduc\u00adtion of effort for audits by OEMs<\/strong><\/p>\n

The num\u00adber of indi\u00advi\u00addu\u00adal audits and sup\u00adpli\u00ader sur\u00adveys is signi\u00adfi\u00adcant\u00adly and sus\u00adtain\u00adab\u00adly redu\u00adced by TISAX<\/span>\u00ae cer\u00adti\u00adfi\u00adca\u00adti\u00adon. Cer\u00adti\u00adfied sup\u00adpli\u00aders are reli\u00ade\u00adved by the eli\u00admi\u00adna\u00adti\u00adon of the\u00adse time-con\u00adsum\u00ading indi\u00advi\u00addu\u00adal audits. Once TISAX<\/span>\u00ae labels have been issued, no fur\u00adther audits are requi\u00adred for a peri\u00adod of 3 years.<\/p>\n

Reco\u00adgni\u00adti\u00adon out\u00adside the auto\u00admo\u00adti\u00adve industry<\/strong><\/p>\n

A TISAX<\/span>\u00ae cer\u00adti\u00adfi\u00adca\u00adti\u00adon accor\u00adding to Pro\u00adtec\u00adtion Level \u201cInfor\u00adma\u00adti\u00adon Secu\u00adri\u00adty High\u201d or \u201cInfor\u00adma\u00adti\u00adon Secu\u00adri\u00adty Very High\u201d is con\u00adside\u00adred by experts to be of hig\u00adher qua\u00adli\u00adty com\u00adpared to ISO<\/span> 27001 cer\u00adti\u00adfi\u00adca\u00adti\u00adon. The\u00adr\u00ade\u00adfo\u00adre, the TISAX<\/span>\u00ae label speaks for the qua\u00adli\u00adty of a com\u00adpany\u2019s infor\u00adma\u00adti\u00adon security.<\/p>\n<\/div>

<\/div>
<\/div>
<\/div>
Ques\u00adti\u00adons? Free ans\u00adwers here!<\/span><\/a><\/div>
<\/div>
<\/div>
<\/div>

The imple\u00admen\u00adta\u00adti\u00adon of VDA<\/span> ISA<\/span> until the suc\u00adcessful com\u00adple\u00adti\u00adon of the TISAX<\/span>\u00ae assessment<\/h3><\/div>

We recom\u00admend car\u00adry\u00ading out the imple\u00admen\u00adta\u00adti\u00adon in the fol\u00adlo\u00adwing steps and pro\u00advi\u00adde sup\u00adport in all pha\u00adses with con\u00adsul\u00adting and pro\u00adject management:<\/p>\n<\/div>

<\/span><\/div>
<\/div>
<\/div>
<\/div>

Defi\u00adni\u00adti\u00adon of the Pro\u00adtec\u00adtion Level<\/strong><\/p>\n

The requi\u00adre\u00adment as to which pro\u00adtec\u00adtion level (high or very high) is neces\u00adsa\u00adry is usual\u00adly the respon\u00adsi\u00adbi\u00adli\u00adty of your cus\u00adto\u00admer (OEM<\/span>). It is important to cle\u00adar\u00adly com\u00admu\u00adni\u00adca\u00adte which TISAX<\/span>\u00ae label(s) is\/are requi\u00adred and by what date.<\/p>\n

GAP<\/span> ana\u00adly\u00adsis<\/strong><\/p>\n

In an initi\u00adal GAP<\/span> ana\u00adly\u00adsis, an audi\u00adtor or con\u00adsul\u00adtant com\u00adpa\u00adres the matu\u00adri\u00adty level of infor\u00adma\u00adti\u00adon secu\u00adri\u00adty against the requi\u00adre\u00adments of the VDA<\/span> ISA<\/span> cata\u00adlog. Befo\u00adre imple\u00admen\u00adta\u00adti\u00adon, the tar\u00adget matu\u00adri\u00adty level of 3.00 is usual\u00adly not achieved.<\/p>\n

Imple\u00admen\u00adta\u00adti\u00adon VDA<\/span> ISA<\/span> and ISMS<\/span><\/strong><\/p>\n

The VDA<\/span> ISA<\/span> cata\u00adlog is divi\u00added into the sec\u00adtions Info\u00adSec Gui\u00adde\u00adlines and Orga\u00adniza\u00adti\u00adon, Human Resour\u00adces, Phy\u00adsi\u00adcal Secu\u00adri\u00adty and Busi\u00adness Con\u00adti\u00adnui\u00adty, Iden\u00adti\u00adty and Access Manage\u00adment, IT<\/span> Secu\u00adri\u00adty and Cyber\u00adse\u00adcu\u00adri\u00adty, Sup\u00adpli\u00ader Secu\u00adri\u00adty, and Com\u00adpli\u00adance. A matu\u00adri\u00adty level of 3 \u201cEstab\u00adlished\u201d must be achie\u00adved in all sec\u00adtions. SEC4YOU<\/span> can bring pro\u00adven TISAX<\/span>\u00ae com\u00adpli\u00adant ISMS<\/span> tem\u00adpla\u00adtes (inclu\u00adding poli\u00adci\u00ades, ISMS<\/span> manu\u00adal, risk manage\u00adment, pro\u00adcess descrip\u00adti\u00adons, con\u00adtin\u00adgen\u00adcy plans) to this stage.<\/p>\n

Pre-audit<\/strong><\/p>\n

In the cour\u00adse of a pre-audit, a TISAX<\/span>\u00ae expert per\u00adforms a GAP<\/span> ana\u00adly\u00adsis and docu\u00adments devia\u00adti\u00adons from the tar\u00adget matu\u00adri\u00adty level. The\u00adse can be eli\u00admi\u00adna\u00adted in this pha\u00adse until the TISAX<\/span>\u00ae audit.<\/p>\n

TISAX<\/span>\u00ae audit by the sel\u00adec\u00adted test\u00ading ser\u00advice provider<\/strong><\/p>\n

The audit by the test\u00ading ser\u00advice pro\u00advi\u00adder is car\u00adri\u00aded out with the invol\u00advement of the spe\u00adcia\u00adlist depart\u00adments and detail\u00aded exami\u00adna\u00adti\u00adon of evi\u00addence. In the first pha\u00adse of the audit, the com\u00adpa\u00adny must car\u00adry out a self-assess\u00adment and, if pos\u00adsi\u00adble, pro\u00advi\u00adde docu\u00admen\u00adted evi\u00addence for the indi\u00advi\u00addu\u00adal controls.<\/p>\n

If the audit is suc\u00adcessful\u00adly com\u00adple\u00adted, the TISAX<\/span>\u00ae label(s) is\/are valid for 3 years.<\/p>\n<\/div>

\"Reifegrad\"Zielreifegrad
<\/div>
<\/div><\/div>
<\/span><\/span><\/div><\/div><\/div>
<\/div>
<\/div>
<\/div>

Nice to know<\/h3><\/div>