TISAX

Automotive industry standard for information security in the supply chain.


Region	Europe
Country or scope	Germany
Sector	Automotive
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers TISAX

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for TISAX.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for TISAX and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`TISAX-ASSET` Asset Inventory	Information assets, including software in use, must be identified and inventoried with assigned responsibility (VDA ISA catalogue: asset management controls, ISO 27001-aligned)	Scan
`TISAX-VULN` Technical Vulnerability Management	Information about technical vulnerabilities of systems in use must be obtained and evaluated in a timely manner, requiring identifiable software components (VDA ISA catalogue: vulnerability management controls)	Scan
`TISAX-PATCH` Patch Level Awareness	Managing vulnerabilities across the automotive supply chain requires knowing the version and patch level of software components in scope (VDA ISA catalogue: IT operations / patch management controls)	Scan
`TISAX-SUP` Supplier Relationship Security	Information security must be maintained in supplier relationships, requiring each externally sourced software component to be attributable to its supplier (VDA ISA catalogue: supplier relationships controls)	Scan
`TISAX-INT` Software Integrity in the Supply Chain	Protecting prototype and production-related information includes assurance that software exchanged along the supply chain is unaltered, supported by component integrity hashes (VDA ISA catalogue: IT security / integrity protection controls)	Scan
`TISAX-DOC` Assessment Evidence	TISAX assessments and label exchange require documented, current evidence; a dated, identifiable SBOM evidences the software-asset portion of the ISMS (TISAX assessment / ENX exchange requirements)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`TISAX-1.1.1`	Establish Information Security Policy
`TISAX-1.2.1`	Define Information Security Roles and Responsibilities
`TISAX-1.6.1`	Conduct Information Security Risk Assessment
`TISAX-5.1.1`	Classify and Label Information Assets
`TISAX-5.2.1`	Implement Access Control for Classified Information
`TISAX-5.2.2`	Protect Classified Information During Transfer
`TISAX-PROTO-1`	Establish Prototype Protection Requirements
`TISAX-PROTO-2`	Implement Prototype Camouflage and Tracking Controls
`TISAX-SUPPLIER-1`	Assess Supplier Information Security Before Engagement
`TISAX-SUPPLIER-2`	Include Information Security Requirements in Supplier Contracts
`TISAX-IT-1`	Implement Secure Configuration for IT Systems
`TISAX-INCIDENT`	Establish Information Security Incident Management

Policy templates

Written for TISAX:

TISAX Information Security Policy
TISAX Prototype Protection Policy
TISAX Supplier Information Security Policy

And 22 from the standard set, adapted to TISAX.