Automotive industry

In the automotive industry, the requirement for security comes from the customer, not from an authority. It usually comes as a deadline set without knowing where the supplier stands — and the consequence of missing it is not a penalty but removal from the supply chain.

Which regimes usually concern you

• TISAX. The customer asks for a label and also sets the level, according to how sensitive the data it entrusts to you is. The assessment itself may be carried out only by a provider accredited by ENX, and no one who prepares you for it can also carry it out — independence is the point of the whole scheme. We prepare you for it and help you choose a provider.

• ISO/IEC 27001. The VDA ISA catalogue is based on its structure, so a working information security management system covers a large part of the preparation. What is added is mainly what is specific to the industry — prototype protection and physical security at a level the standard itself does not require. The certificate is issued by an accredited certification body, not by an adviser.

• Cybersecurity (NIS2). Directive (EU) 2022/2555 applies through the national law of each Member State. Where it applies, it covers entities of the types listed in its Annexes I and II that are at least medium-sized (Article 2(1)), and some entities regardless of their size (Article 2(2)). Whether that includes you depends on the service you provide and on the national rules — it cannot be inferred from the industry.

• GDPR. Alongside production data you also process data on employees and agency workers; for transfers within a multinational group, the focus is on the contractual arrangements and on documentation that matches reality.

Operational technology is an open question

Audit scopes now often cover operational technology as well as information systems — assembly lines, robots and control systems. Such systems cannot be assessed with the same methods as office IT: active scanning can bring down a controller, and a shutdown for the sake of an audit costs more than the audit itself.

We mention this as a risk on your side, not a promise on ours. Whether and to what extent we assess operational technology ourselves is agreed case by case when the scope is set — for part of the environment we bring in a specialist in industrial control systems. Claiming more for these systems than we can evidence would serve neither us nor you.

What we do for automotive

We prepare you for the assessment: we set the scope and protection objectives, carry out a gap analysis against the VDA ISA catalogue, complete the management system and documentation and prepare the evidence. If the deadline you received from your customer cannot be met, we say so at the outset — together with the arguments for negotiating it. That is often worth more than the preparation itself.

If you are responsible for a whole network of dealers and service centres rather than a single site, there is a separate programme for that: Automotive network audits.