TISAX^® Consulting Readiness, Implementation, Audit and Program Management

Phase I - Understanding Business and Security Context

• Every client is unique with its business model, customers, and information security objectives.
• Here we assess, whether information security controls, prototype protection and/or privacy requirements are applicable.
• This phase helps to determine the applicable and not applicable domains

Phase II - Gap Analysis and Risk Assessment

• Based on the organization structure, a session with each team is conducted to asses their current scope of work and their applicable security responsibility.
• We perform a detailed gap analysis to assess current controls and come out with the current state of controls.
• Coral consultants will provide detailed recommendations for each identified gap. These gaps could combine improvements in technology, people and policy matters.

Phase III - Control - Design, Allocation and Documentation

Depending upon the gaps and the organizational context, we design your control environment.

Some key steps are as follows:

• Identification and documenting each system in scope
• Identifications of roles and associating them as control owners
• Policy and procedures for across applicable TISAX domains involving all areas of governance that include (but are not limited to) Application development, IT operations, Cloud Operations, Human resources, Physical Security, Supplier management etc., as per applicable controls.
• Risks identified in the gap analysis are tracked toward decision-making and closure. Some risks are quick wins, whereas others may take longer to close.

Phase IV - Control - Training, Measurement, and Audit

• Training of staff involved in TISAX operations is a key factor in successful TISAX implementation.
• Our consultants will deliver a combination of training including awareness, risk management and standard interpretation
• Each documentation or risk undergoes brainstorming with staff to derive at a ‘best-fit’ solution for the organization.
• Control Measurement involves testing the control effectiveness and providing stakeholders with an objective performance of the TISAX

Phase V - Internal Audit and Management Review

• Internal Audit involves verifying the effectiveness of the implemented lifecycle of controls through interviews with system verification of applicable controls, We facilitate reviews with the management to ensure that the initial TISAX program goals are achieved.

Summary

At this stage:

• As a result of undergoing these phases, Coral has assisted the client in implementing the requirements for TISAX.
• At this stage, the organization is ready to invite external certification bodies to certify them for TISAX certification

Phase VI - External Certification Support

Chosen external certification body audit performs Tisax certification as per assurance requirements:

• Assessement Level 1 - Remote
• Assessement Level 2 - Onsite

Upon completion of the assessment, the audit body issues the report to TISAX, which then issued the TISAX certificate.