01
Scope and self-assessment
We clarify customer requirements, assessment objectives, locations and data. We help prepare the VDA ISA self-assessment, review risks and available records, and identify critical gaps.
TISAX implementation
Preparing for a TISAX assessment
We help automotive suppliers clarify customer requirements, address gaps and prepare their documentation and team for a TISAX assessment. We connect procedures with IT safeguards. Virtline supports preparation and corrective action; an independent provider approved by ENX conducts the assessment.
Trusted by
Companies and institutions that need stable IT.
Automotive customer requirements
TISAX is an ENX-governed mechanism for assessing information security and exchanging results, based on the VDA ISA catalogue. Preparation supports component manufacturers, design offices, engineering centres, IT firms, logistics providers and subcontractors, including companies entering the automotive market. We start with the expectations of the vehicle manufacturer (OEM) or its direct supplier (Tier 1). Your company approves the scope, risk and resources; Virtline helps turn requirements into tasks. Preparation does not guarantee a label or a contract.
Services that support preparation
We select the work needed for your gaps and existing environment. Not every project needs all these services.
ISO 27001 management
Policies, risk, responsibilities and reviews. We reuse your existing system where it meets the TISAX assessment objectives.MFA and access
Additional login verification, privileged accounts, access reviews and removal of access when people leave.Backup and recovery
Backups and restore tests supporting continuity of critical processes. Having a backup alone does not demonstrate recoverability.IT system protection
Device and network safeguards, logs, alerts and incident handling matched to your company's data and risk.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateTISAX implementation process
We review the results of each stage with your company. Our readiness review is advisory work, not a formal TISAX assessment.
02
Plan and ownership
We agree on tasks, budget, owners, deadlines and acceptance criteria. We connect the work with your existing information security management system to avoid conflicting procedures.
03
Safeguards and staff
Within the agreed scope, we implement or improve access, network segmentation, device protection, vulnerability management, backup and monitoring. We update procedures, supplier requirements and training, then check that safeguards work.
04
Review and further support
With process owners, we review documents, records and open gaps, and rehearse answers to assessor questions. We support explanations during the independent assessment and corrective action, then hand over arrangements for ongoing reviews.
Practical scope
What you receive
The materials support management, process owners and the team preparing for assessment. They show completed work and gaps that still require decisions.
Assessment objectives, locations, processes, assets, information categories and contractual requirements mapped to the applicable VDA ISA version. Self-assessment, owner interviews and a review of documentation and safeguards show the current state of preparation.
Priorities based on risk, estimated effort and costs, accountable owners, deadlines and acceptance criteria. The plan separates organisational and technical changes from work dependent on your company, suppliers or the independent assessment provider.
Policies, procedures, risk and exception registers, access reviews, supplier agreements, training results, restore tests, monitoring reports, incident records and corrective action. Relevant configuration screenshots and approvals supplement these materials.
Safeguard owners, a management review schedule and rules for updating documentation and handling changes. We agree on support after assessment, follow-up on recommendations and a way to address new OEM or Tier 1 requirements.
Data, prototypes and suppliers
The scope may include drawings and specifications, design documents, test and production data, prototypes, repositories and project rooms. It also covers teams developing vehicle software, driver-assistance systems, communication between vehicles and their surroundings, and telematics. We establish information classification, remote and partner access, secure exchange, and rules for subcontractors and maintenance providers. We consider site protection and physical access. Personal data and prototype protection depend on the applicable scope; we do not assume every company needs identical safeguards.
Questions about TISAX preparation
Does Virtline award TISAX labels?
+
No. We prepare your company for independent assessment and help implement improvements. An ENX-approved provider conducts the assessment. A TISAX label summarises its result for defined objectives; it is not a certificate issued by Virtline. Our documentation and our own ISO 27001 certificate do not replace that assessment.
How do AL1, AL2 and AL3 differ?
+
AL1 mainly supports internal self-assessment; its results are not used in TISAX. AL2 checks the plausibility of self-assessment and evidence, with an interview, usually remote. AL3 involves detailed verification, including on-site work. The level follows from the assessment objectives, not a freely chosen service package.
Can we reuse our existing ISO 27001 system?
+
Yes, where its scope, safeguards and records match the TISAX objectives. Shared areas may include risk, access, incidents, business continuity, suppliers, training and management reviews. We separately check automotive data and prototype requirements. For companies operating in Poland, we also align overlapping work on GDPR, NIS2 and customer requirements, without presenting TISAX as proof of compliance with those laws.
How long does preparation take, and what follows assessment?
+
We agree on timing after reviewing the scope, gaps, staff availability and supplier dependencies. First we clarify requirements and risks, then implement changes and review documentation and safeguards in use. The preparation schedule does not guarantee the date or result of the independent assessment. Afterwards, we can support corrective action, recurring reviews, updated records and new customer requirements.
Plan your assessment preparation
Describe customer requirements, locations, data or prototypes, your target date and current management system. We will agree on the initial review scope. Do not send confidential design documents or passwords.
Discuss your TISAX scope