TISAX^® Consulting Readiness, Implementation, Audit and Program Management

Phase I - Understanding Business and Security Context

• Every client is unique with its business model, customers, and information security objectives.
• Here we assess, whether information security controls, prototype protection and/or privacy requirements are applicable.
• This phases results in defining a scope statement, that includes applicable assurance level (AL1, AL2 or AL3), and applicable TISAX requirements.

Phase II - Gap Analysis and Risk Assessment

• Based on the organization structure, a session with each team is conducted to asses their current scope of work and their security responsibility.
• The gap analysis is conducted on the applicable controls, whereas risk assessment is conducted on organisational context, which includes their network. This can be on-prem, cloud or a combination thereof, covering one or more locations as per the scope.
• At the end of this phase, Coral consultants will provide detailed recommendations for each TISAX gap. These gaps could combine improvements in technology, roles, and internal policies. In some cases, we have recommended new tools and technology requirements.

Phase III - Control - Design, Allocation and Policy Documentation

Depending upon the gaps and the organizational context, we design your control environment.

Key steps are as follows:

• Identification and documenting each system in scope.
• Identifications of roles and associating them as control owners.
• Policy and procedures for across applicable TISAX domains involving all areas of governance that include (but are not limited to) Application development, IT operations, Cloud Operations, Human resources, Physical Security, Supplier management etc.
• Risks identified in the gap analysis are tracked toward decision-making and closure.
• This phase generally takes longer.

Phase IV - Training, and Measurement

• Our consultants will deliver a combination of training including awareness, risk management and standard interpretation.
• Each documentation or risk undergoes brainstorming with staff to derive at a ‘best-fit’ solution for the organization.
• Control Measurement involves testing the control effectiveness and providing stakeholders with an objective performance of the TISAX.

Phase V - Internal Audit and Management Review

• Internal Audit involves independent verification of control effectiveness. Here the client receive a formal report, that gives them the confidence of compliance.
• Management review: we facilitate reviews with the management to ensure that the initial TISAX program goals are achieved.

Summary

• As a result of undergoing these phases, Coral has assisted the client in implementing the requirements for TISAX.
• At this stage, the organization is ready to invite external certification bodies to certify them for TISAX certification.

Phase VI - External Certification Support

Chosen external certification body audit performs TISAX certification as per assurance requirements:

• Assurance Level 2 - Remote
• Assurance Level 3 - Onsite

Upon completion of the assessment, the audit body issues the report to the client through the ENX Portal, where the client decides to whom it wishes to share.