Toolkit · Compliance · about 5 minutes
TISAX Readiness Check
VDA ISA scores controls on a maturity scale where ISO 27001 asks whether a control exists. That is why certified organisations still fail: a control entirely adequate for certification can score below the level your customer requires.
20 questions. Nothing is sent anywhere as you answer, the scoring runs in your browser, and we only receive anything if you ask for the written version at the end.
Scope and preparation
Getting this wrong is expensive in both directions.
Has your customer confirmed in writing which assessment level and which labels you require?
The level and labels are set by the customer and by the protection needs of the information, not by you. Booking the wrong one wastes the assessment.
Is the assessment scope defined, covering the specific locations and processes that handle customer information?
Have you registered with the ENX portal and selected an approved audit provider?
Do you understand that results are exchanged through the portal rather than published, and who you will need to share with?
Maturity of controls
Where certified organisations most often fall short.
Have you self-assessed against the VDA ISA catalogue at the maturity level required, rather than only confirming the controls exist?
The target is usually a defined maturity level rather than presence. Being ISO 27001 certified is not the same as scoring it.
Are processes documented, consistently applied and measured, rather than performed reliably but informally?
Is there evidence for each control that an assessor could examine, rather than assertion?
Has a gap assessment been run against the catalogue, with remediation tracked and dated?
Information security
The base label, and largely familiar territory.
Is there an information security management system with defined policy, risk process and management review?
Are assets classified, with handling rules matched to classification?
Is access to customer information restricted, reviewed and logged?
Are suppliers and subcontractors who touch customer information assessed and contractually bound?
Is there an incident process covering notification to the customer whose information is involved?
Prototype protection
Only if in scope, and genuinely additional work if it is.
If prototype protection is in scope, are secured areas established with controlled physical access to prototype zones?
This is construction and process work with real lead time, not documentation. It has no ISO 27001 equivalent.
Are rules on photography, mobile devices and recording enforced in prototype areas?
Is the transport of prototypes and prototype parts controlled and documented?
Are events, test drives and presentations involving prototypes covered by defined controls?
Data protection
Only if the data protection label is required.
Is there a record of processing activities covering personal data handled for the customer?
Are processor obligations met, including instructions, confidentiality and subprocessor control?
Is there a breach process able to notify the controller without undue delay?