ISO 27001:2022 and TISAX: overlaps and differences

Introduction

ISO 27001:2022 and TISAX VDA ISA 6.0 are two prominent standards in the realm of information security management, particularly within the automotive industry. While ISO 27001 provides a global framework for establishing, implementing, maintaining, and continually improving an information security management system (ISMS), TISAX (Trusted Information Security Assessment Exchange), based on the VDA ISA (Information Security Assessment) framework, is tailored to meet the specific needs of the automotive sector.

This article delves into the nuances of these two standards, highlighting their overlaps, the ways in which TISAX leverages ISO 27001, and the distinct features that set TISAX apart.

Overview of ISO 27001:2022

ISO 27001:2022 is the latest revision of the internationally recognized standard for information security management. It provides a comprehensive approach to managing sensitive company information so that it remains secure. This involves a risk management process, which includes people, processes, and IT systems by applying a risk management process.

Key Features of ISO 27001:2022

• Risk-Based Approach: Emphasizes the identification and management of risks through a continuous improvement process.
• Annex A Controls: Contains 93 controls categorized under four themes: Organizational, People, Physical, and Technological.
• PDCA Cycle: The Plan-Do-Check-Act cycle is integral for continuous improvement.
• Context of the Organization: Requires understanding of internal and external factors impacting information security.
• Leadership Commitment: Highlights the importance of top management’s involvement in the ISMS.

Overview of TISAX VDA ISA 6.0

TISAX, a standard specific to the automotive industry, is based on the VDA ISA (Verband der Automobilindustrie Information Security Assessment) catalog. TISAX ensures that automotive manufacturers and suppliers meet strict information security requirements to protect sensitive information.

Key Features of TISAX VDA ISA 6.0

• Sector-Specific: Tailored specifically for the automotive industry.
• VDA ISA Catalog: Based on the VDA ISA framework, which is a detailed checklist of requirements and controls. It is split in several areas of interest:
  • Information security – containing everything that belongs to an ISMS
    • IS Policies and Organization
    • Information Security Policies
    • Organization of Information Security
    • Asset Management
    • IS Risk Management
    • Assessments
    • Incident and Crisis Management
    • Human Resources
    • Physical Security
    • Identity and Access Management
    • Identity Management
    • Access Management
    • IT Security / Cyber Security
    • Cryptography
    • Operations Security
    • System acquisitions, requirement management and development
    • Supplier Relationships
    • Compliance
  • Prototype Protection – focused on physical and cyber protection of prototypes
  • Data Protection – focused on policies for protecting privacy and secrets
• Assessment Levels: Comprises different levels of assessment depending on the type of information and its criticality.
• Labeling System: Provides a TISAX label indicating compliance, which can be shared with partners within the automotive ecosystem.
• Focus on KPIs: VDA ISA provides a large set of examples on how to measure certain controls effectively.

Overlaps between ISO 27001:2022 and TISAX VDA ISA 6.0

While TISAX and ISO 27001 serve different purposes, they share several common elements. TISAX leverages the fundamental principles of ISO 27001, creating a robust framework that is both comprehensive and specific to the automotive sector.

In the VDA ISA 6.x (and previous) there are the columns “Reference to other standards” (column P) and “Reference to implementation guidance” (column Q) which point to known standards. Of course, there is no coincidence that the most reference standard is the ISO 27001 in both versions 2022 and 2013.

In the guidance we usually see reference to the Annex A of the ISO 27001 standard (both versions).

 

In the column W there is “Further information” containing explanations of what can be described by the respective control.

Risk Management

Both ISO 27001 and TISAX emphasize a risk-based approach to information security. ISO 27001 mandates a formal risk assessment process, while TISAX incorporates this through the VDA ISA requirements, ensuring that organizations identify and manage risks relevant to the automotive industry.

Control Objectives and Controls

ISO 27001:2022 and TISAX VDA ISA 6.0 share a common structure in terms of control objectives and specific controls. Many of the controls listed in Annex A of ISO 27001 are reflected in the VDA ISA catalog, ensuring a comprehensive approach to securing information.

While this is a common trait shared by the standards, the TISAX is making use of other standards than ISO 27001: NIST, BSI other ISO standards.

Continuous Improvement

Both standards advocate for continuous improvement. ISO 27001’s PDCA cycle and TISAX’s periodic reassessment and updating of security measures ensure that organizations continually enhance their security posture in response to evolving threats.

TISAX VDA ISA has a sheet called “Maturity Levels” containing descriptions of the Maturity Levels 0 to 5.

Documentation and Record-Keeping

ISO 27001 requires detailed documentation of the ISMS, including risk assessments, policies, and procedures. TISAX also mandates thorough documentation as part of its assessment criteria, ensuring that organizations maintain a clear record of their security practices.

Third-Party Management/Suppliers Relationships

Third-party risk management is a critical component in both standards. ISO 27001 includes controls for managing supplier relationships and ensuring their compliance with information security requirements. Similarly, TISAX places a strong emphasis on securing information exchanged with suppliers and partners, crucial for maintaining the integrity of the automotive supply chain.

Differences between ISO 27001:2022 and TISAX VDA ISA 6.0

Despite their overlaps, ISO 27001 and TISAX have several distinctions, reflecting their different scopes and target audiences.

Industry Focus

ISO 27001 is a generic standard applicable to any organization, regardless of its sector. TISAX, however, is designed specifically for the automotive industry, addressing unique challenges such as the secure exchange of data between manufacturers and suppliers.

Assessment Process

ISO 27001 involves a formal certification process conducted by accredited bodies, leading to ISO 27001 certification. TISAX, on the other hand, employs a mutual assessment model where organizations are assessed by ENX approved audit providers, and successful assessments result in a TISAX label. This label can then be shared with other automotive industry stakeholders, facilitating trust and compliance.

Control Specificity

While ISO 27001 provides a broad framework of controls applicable to various industries, TISAX’s controls are highly specific to the automotive sector. The VDA ISA catalog includes detailed requirements for protecting manufacturing data, ensuring compliance with industry-specific regulations, and safeguarding automotive intellectual property.

Levels of Assessment

TISAX introduces different levels of assessment (Basic(Must and Should), High, and Very High) depending on the sensitivity and criticality of the information being protected. ISO 27001 does not have a tiered assessment system but rather a uniform certification standard.

Focus Areas

TISAX places significant emphasis on physical security, secure development of automotive products, and compliance with industry-specific legal requirements. ISO 27001, while comprehensive, does not delve into sector-specific issues with the same level of detail.

Commercial vs Open standards

ISO 27001 is an open international standard governed by the Internation Standards Organisation (ISO). The TISAX trademark is owned by the organization ENX, formed by many OEMs in automotive sector.

 

Implementation of TISAX Using ISO 27001

TISAX leverages ISO 27001’s framework to build a robust and industry-specific information security system. Many organizations begin with ISO 27001 certification and then adapt their ISMS to meet the additional requirements of TISAX.

Integration of Standards

1. Foundation in ISO 27001: Organizations often establish a basic ISMS in accordance with ISO 27001. This includes conducting risk assessments, implementing controls, and ensuring continuous improvement.
2. Customization to TISAX Requirements: Once the foundational ISMS is in place, organizations tailor it to meet TISAX requirements, which may involve additional controls specific to automotive data security and third-party management.
3. Assessment and Labeling: Organizations undergo a TISAX assessment conducted by an approved audit provider. Successful completion results in the issuance of a TISAX label, demonstrating compliance with industry-specific security requirements.

Benefits of Integration

Integrating ISO 27001 with TISAX offers several benefits:

• Streamlined Compliance: Simplifies the process of meeting both generic and sector-specific security requirements.
• Enhanced Trust: The TISAX label, backed by ISO 27001’s rigorous framework, enhances trust among automotive industry partners.
• Cost Efficiency: Leveraging ISO 27001 as a foundation reduces duplication of effort and resources in implementing security measures.

Conclusion

ISO 27001:2022 and TISAX VDA ISA 6.0 represent critical standards for information security, particularly within the automotive sector. While they share common principles such as risk management and continuous improvement, TISAX’s industry-specific focus and detailed requirements for automotive set it apart. By leveraging the robust framework of ISO 27001, organizations can start to effectively implement TISAX, ensuring comprehensive protection of sensitive automotive data and fostering trust within the industry.

Understanding the connections between these standards and their unique requirements is very important for organizations aiming to achieve a high level of information security and compliance.

The post ISO 27001:2022 and TISAX: overlaps and differences first appeared on Sorin Mustaca on Cybersecurity.