TISAX® and ISO 27001: Differences and Similarities

In this blog post, we compare TISAX® with ISO 27001, dive deep into both standards and summarize the results for you. We will not only look at the differences but also point out commonalities and synergies between the two standards. Here is a comprehensive comparison of TISAX® and ISO 27001.

What are the main differences between TISAX® and ISO 27001?

Although TISAX® was originally derived from ISO 27001, the two standards are completely independent of each other. There are also no dependencies with regard to application, requirements, audits and certifications. In other words, if you have TISAX® or ISO 27001, one does not replace the other.

With this in mind, we have compiled a list of the differences as a summary. Later in this post, however, we will go into the details of each point:

• ISO 27001 is a certification, TISAX® is a label.

• ISO 27001 is an international standard for all industries; TISAX® is an industry standard of the automotive industry that is now used worldwide (more than 21,000 assessed sites).

• TISAX® is used in the automotive industry, whereas ISO 27001 can be applied in all industries.

• In TISAX®, the entire company is assessed. With ISO 27001, production lines can be assessed individually.

• The TISAX® catalogue requires the maturity level of each individual control; ISO 27001 does not measure maturity levels.

• The audit cycle is different: a TISAX® label is valid for three years, after which a re-assessment follows. An ISO 27001 certificate is also valid for three years but requires annual surveillance audits.

• As TISAX® is automotive-specific, it includes details such as prototype protection and data protection (which is much stricter than ISO 27001, especially if Assessment Level 3 is targeted)

• TISAX® allows 9 months from the start to resolve all major and minor nonconformities.

• TISAX® has a limited choice of auditors compared with ISO 27001.

To simplify the differences, we have divided them into 2 groups: structural and technical differences.

Structural differences

Structural differences are the differences relating to the process, the context and the definition of the audits. As mentioned above, ISO 27001 is a certification for information security. TISAX®, however, is awarded as a label. Companies that hold a TISAX® label are listed in the ENX portal, which serves the purpose of TISAX®. What TISAX® specifically requires differs from ISO 27001 above all in the prototype protection and data protection controls.

Furthermore, ISO, hence the name, is an international standard. TISAX® was initiated by the VDA and is operated by the ENX Association; the process is now required by automotive manufacturers and suppliers worldwide. TISAX® is an industry-specific label, whereas ISO 27001 can be applied to all industries. In addition, ISO 27001 can be applied to a production unit or a department. For TISAX®, on the other hand, the entire company – with the option of choosing sites – must be audited.

Finally, the cycle differs: ISO 27001 requires annual surveillance audits and recertification after three years; with TISAX®, a re-assessment takes place after three years without surveillance audits in between.

ISO 27001 certification process

Technical differences

ISO/IEC 27001:2022 contains 93 controls in Annex A, which serve as the basis for the assessment. However, these controls have no measured maturity level. In TISAX®, maturity levels are defined and used as criteria for obtaining the label. There are 6 maturity levels in TISAX®, from 0 to 5. The target maturity level for every relevant control is level 3. The audit provider rates deviations as minor or major; the label is only awarded once no major nonconformities remain open (with minor ones, possibly as a temporary label).

As TISAX® is an automotive industry standard, it also covers the protection of prototypes, and the data protection part of TISAX® is far more comprehensive and restrictive than that of ISO 27001, especially for Assessment Level 3.

Another difference: after the closing meeting of the initial assessment, you have a maximum of nine months to resolve the nonconformities identified. If these measures are not implemented within the 9 months, the application phase for the label has to be restarted. Below you will find the timeline for the TISAX® project.

Process of a TISAX® assessment

Similarities between TISAX® and ISO 27001

First of all, TISAX® is derived from ISO 27001. The TISAX® control catalogue is rooted in Annex A of ISO 27001. We can therefore safely say that the basic idea and the objective are quite similar. Secondly, regardless of which audit the company passes successfully, the level of information security is almost identical. In this sense, both exist to ensure a high standard of information security.

If you are familiar with the ISO PDCA cycle (Plan, Do, Check, Act), TISAX® also requires a continuous improvement process, with almost identical objectives. We believe that a continuous improvement process is crucial not only for information security but also for the company’s other processes.

Do TISAX® and ISO 27001 replace each other?

No, definitely not. TISAX® and ISO 27001 are not mutually exclusive. Depending on customer requirements, industry and objectives, you choose the TISAX® label, ISO 27001 certification or both. Can’t you have both at the same time? Yes, you can. More on this below.

Does it make sense to hold both at the same time?

That depends on your customers. But if you provide services or produce goods exclusively for the automotive industry, TISAX® alone may be sufficient for your purposes. It does no harm to have both, because if you have one before the other, you can save effort on audits. In this case, we suggest obtaining the TISAX® label before ISO 27001.

Summary

ISO/IEC 27001:2022 contains 93 controls in Annex A, the information security module of the VDA ISA around 45 controls. In terms of content, the two catalogues overlap strongly. In addition, the TISAX® controls are derived from ISO 27001. Depending on your company’s needs, objectives and industry, you can choose between the two. In the best case, you can have both.

Not sure where to start or which one to choose? We are here to help. Our TISAX® project support takes you from scoping to the label — in parallel with ISO 27001 if you wish.

You can get in touch with us here.