How Is a TISAX® GAP Analysis Carried Out?

What Is a GAP Analysis and Why Does It Matter for Information Security in Your Organization?

Let us start with the definition of a GAP analysis. It is a widely used method, mostly by consultants. The aim of the TISAX® GAP analysis is to find the gap between the target state and the current state. The target state is the TISAX® requirements catalogue: Level 2 or Level 3, depending on what your customer requires. The decisive reference is the VDA ISA catalogue in the version that applies when the assessment is commissioned: ISA 6, or ISA 2027 for assessments commissioned from 1 January 2027. Only then can the project plan be outlined and the necessary corrective measures planned.

If you do not know where you stand, it will be difficult to define the actions and measures you need to take to reach your goals. The same applies to obtaining your TISAX® label.

In the TISAX® questionnaire, the controls are divided into the following sections:

• Information security policies and organization
• Human resources
• Physical security
• Identity and access management
• IT security / cyber security
• Supplier relationships
• Compliance

Depending on your needs, the prototype protection and data protection modules are added.

Each of these controls should be rated in terms of maturity level. The VDA ISA maturity levels range from 0 to 5. Maturity level 0 (“incomplete”) means that no suitable process is in place or it is not followed. Maturity level 5 (“optimizing”) means that the process is continuously measured and improved. The target maturity level for TISAX® is usually 3 (“established”).

Once you have determined your maturity levels for each of the TISAX® controls, you can define the corrective measures and actions. This gives you a clear idea of how many resources need to be invested in the project.

What Are the Benefits of the GAP Analysis?

A thoroughly conducted GAP analysis against VDA ISA gives you a clear picture of where your TISAX® project stands. It therefore prevents you from allocating arbitrary resources to your TISAX® project. At the same time, it helps you reflect on your organization’s strengths and weaknesses in the various TISAX® areas (see above).

For example, your physical security measures may be well implemented. Your HR processes may also be in place and running smoothly. A GAP analysis, however, helps you recognize that your IT security processes are not mature enough, so you might consider improving them.

As a rule of thumb, to obtain the TISAX® label you must reach at least maturity level 3. There are, however, exceptions to this rule. Nevertheless, the maturity level is a good indicator of the remaining effort for your organization until the audit.

Even if you decide not to pursue your TISAX® project further, you gain a good overview of the state of information and physical security in your organization. You can improve your processes accordingly at any time.

What Does the Result of a TISAX® GAP Analysis Based on the VDA ISA Catalogue Look Like?

To start the GAP analysis, you need to work through the VDA TISAX® questionnaire in detail. Please note that there are “must” and “should” requirements, as well as additional requirements for high and very high protection needs (confidentiality or availability). Before starting your GAP analysis, therefore clarify:

• Your scope and your sites
• Your TISAX® assessment level (AL2 or AL3)
• Does your customer require Info High or Info Very High?
• Are additional modules such as data protection or prototype protection required?

It is advisable to agree with your customer in advance which level is expected of you. Only then can you obtain solid GAP analysis results. If you do not know your customer’s requirements, you can still carry out a self-assessment to get a rough idea.

Work through the controls and fill in the respective maturity levels, and you will already have your first results. In the large Excel file – the VDA ISA catalogue – you can also see the graphical representation of the analysis.

Source: VDA ISA catalogue

What Should I Do With the Result of the GAP Analysis? – Interpreting the Results

Before we look at interpreting the results, I would like to stress that there are no good or bad results. The results are there to show you and your organization where you currently stand. It is very important, however, to look at the results objectively. If you want to reach your goal, the TISAX® label, now is the time to plan.

Let us assume your organization has no change process and no documentation. You have therefore rated yourself at maturity level 1. As we know from the TISAX® guidelines, we must aim for at least 3. So let us take a look at level 3: Established.

A standard process integrated into the overall system is followed. Dependencies on other processes are documented and suitable interfaces are in place. There is evidence that the process has been used sustainably and actively over a longer period of time.

So what do you need to do now? It is simple.

1. You need to make sure that you have defined a change process and integrate it into your systems.
2. Make sure that not only the process itself but also the process instances are documented.
3. Last but not least, you must be able to demonstrate that you have applied the change process and carried it out with the corresponding documentation.

For example, you can submit a change request for new software, review the software, add it to your software list (IT assets) and release the approved software. All documented.

Source: VDA ISA catalogue (maturity model)

How Is the TISAX® Questionnaire Used to Determine the Maturity Level?

In the GAP analysis, you rate your organization, processes, policies and documentation for each control against the six maturity levels (0 to 5). How the questionnaire is structured and how to fill it in is explained in our article on the TISAX® questionnaire. If in doubt, rate yourself lower – overestimating can prevent you from taking necessary measures.

At the end of the day, the auditor will assess the controls objectively in an assessment. If a control is not fully applied or critical prerequisites are missing, this results in a low maturity level. In fact, a maturity level of 0 or 1 is not acceptable for TISAX®. So you must not only make sure that you reach an average maturity level of 3, but also avoid maturity levels 0 and 1.

How Can External Experts Help Accelerate My Success With the TISAX® Questionnaire?

There are several ways in which the right partner can accelerate your success with the GAP analysis.

1. The results and the accuracy of the average maturity level will be reliable.
2. An external consultant for TISAX® brings an objective perspective to the analysis. In turn, you avoid overestimating your maturity level and thereby increasing the likelihood of failure. Or underestimating your maturity level and therefore committing too many resources to the project.

In both cases, it is very helpful to bring in a professional when carrying out your GAP analysis. In addition, your result will be better when you define the measures to be taken. This way, your resource allocation will be correspondingly precise rather than arbitrary.

How Much Effort Does a Detailed GAP Analysis Take?

The cost of the GAP analysis depends on the size of your organization and on your team. If you want to carry out the GAP analysis on your own, you must factor in the time needed to understand the VDA ISA catalogue itself.

In addition, you must make sure that you also understand the controls and their implications. You can therefore roughly expect 2 to 4 days if 2 employees carry out the analysis.

TISAX® GAP ANALYSIS

Are you ready to start your TISAX® project? Then our TISAX® GAP analysis is exactly right for you. At the end of the 1-day GAP analysis, you receive a complete evaluation as well as your timeline for your TISAX® project.

TISAX® GAP Analysis – Price

€3,500 (up to 50 employees) · €4,500 (50 employees or more)

For organizations with up to 50 employees, 50% of the price is credited towards the follow-up project.

• Key facts:
• 1-day GAP analysis
• Together with our experts with extensive TISAX® experience!
• Including a closing meeting to present the GAP analysis results
• Deliverables:
• Project plan
• Executive summary
• List of measures
• Fixed-price offer

The TISAX® GAP analysis can be booked with a lead time of approximately two weeks.

Book your TISAX® GAP analysis