Netwrix software for TISAX compliance

The EU-wide audit and exchange mechanism TISAX is based on a catalog of requirements for information security in the automotive industry, which includes important audit criteria such as data protection and the integration of third parties. The industry-specific framework for the verification of information security of suppliers, automobile manufacturers, original equipment manufacturers, and partners was developed by the German Association of the Automotive Industry (VDA) on behalf of the ENX Association:

1. General Aspects

• 1.2 To what extent is a process for the identification, assessment, and treatment of information security risks defined, documented, and implemented?
• 1.3 To what extent is the effectiveness of the ISMS ensured?

6. Organization of Information Security

• 6.3 To what extent is there a policy for the use of mobile devices and their remote access to the organization's data?

8. Management of organization-owned assets

• 8.2 To what extent is information classified according to its need for protection, and are there rules for labeling, handling, transportation, storage, retention, deletion, and disposal?

9. Access Control

• 9.1 To what extent are there regulations and procedures regarding user access to network services, IT systems, and IT applications?
• 9.2 To what extent are procedures for registering, modifying, and deleting users implemented, and in particular, is there a confidential handling of login information?
• 9.3 To what extent is the assignment and use of privileged user and technical accounts regulated and reviewed?
• 9.4 To what extent are there mandatory rules for the user regarding the creation and handling of confidential login credentials?
• 9.5 To what extent is access to information and applications restricted to authorized individuals?

12. Operational Security

• 12.1 To what extent are changes to the organization, business processes, information processing facilities, and systems controlled and implemented with regard to their relevance to security?
• 12.5 To what extent are event logs, which may include user activities, exceptions, errors, and security events, generated, retained, reviewed, and protected against changes?
• 12.6 To what extent are the activities of system administrators and operators logged, the storage of the logs secured against changes, and regularly reviewed?
• 12.7 To what extent are information about technical vulnerabilities of IT systems obtained promptly, assessed, and appropriate measures taken (e.g., Patch Management)?
• 12.8 To what extent are audit requirements and activities planned and coordinated to review IT systems, and subsequently technically inspect the IT systems (system audit)?

13. Communication Security

• 13.1 To what extent are networks managed and controlled to protect information in IT systems and applications?
• 13.4 To what extent are information protected during exchange or transmission?

14. Acquisition, development, and maintenance of systems

• 14.2 To what extent are security-relevant aspects considered in the software development process (including Change Management)?
• 14.3 To what extent is it ensured that test data are carefully created, protected, and used in a controlled manner?

16. Information Security Incident Management

• 16.1 To what extent are responsibilities, procedures, reporting channels, and criticality levels defined for dealing with information security events or vulnerabilities?
• 16.2 To what extent are information security events processed?

18. Compliance

• 18.1 To what extent is compliance with legal (country-specific) and contractual provisions ensured (e.g., protection of intellectual property, use of encryption techniques, and protection of records)?

Depending on the configuration of your IT systems, your internal procedures, the nature of your business activities, and other factors, Netwrix Auditor may also be able to comply with TISAX requirements not listed above.

How to comply with the TISAX information security standard using Netwrix

Netwrix solutions provide enterprise-wide visibility into on-premises and cloud-based systems and applications, and help you establish appropriate information security controls and ensure that these controls comply with TISAX requirements.

To what extent has a process for assessing information security risks been implemented?

The cornerstone of effective IT risk management is the continuous assessment and mitigation of risks. Gain an overview of your current risk profile, identify vulnerabilities, and rank them according to their level of risk. This ensures reliable security and comprehensive compliance with legal requirements.

To what extent is the effectiveness of the ISMS ensured?

Identify security vulnerabilities in your data and infrastructure environment, such as a large number of inactive user accounts or empty security groups. Prioritize and minimize these risks and demonstrate to auditors that you are actively reducing your attack surface.

To what extent has the policy on the use of mobile devices been implemented?

The handling of mobile devices (and their remote access to the organization's data) - especially in unprotected environments - is associated with increased risks (e.g., loss, theft, infection with malware). In order for the information stored on the device to be protected, technical security measures must be implemented.

To what extent are the roles defined between cloud providers and the organization?

When using services and IT services (e.g., cloud services), the relationship between the provider and one's own organization is of particular importance with respect to information security, as the responsibility for implementing requirements is shared. The organization itself must continue to implement parts of the security requirements on its own, while other requirements are implemented completely or in part by the service provider.

To what extent are there directories for assets that contain information?

In addition to the classic inventory of physical items, it is important to gain an overview of the information processed within the organization. Information assets are elements with informational character, such as documents, images, files, programs, servers, networks, facilities, vehicle prototypes, design-relevant or shaping tools and fixtures.