TISAX, CMMC and ISO 27001 Information Security Management System (ISMS)

TISAX stands for Trusted Information Security Assessment Exchange, a mechanism for the exchange of testing information which is operated by the ENX Association. It is a scheme to prevent multiple Cybersecurity assessments between Customers, Suppliers, and parties doing business with each other. TISAX  was Developed from topics of ISO/IEC 27001 : Information Security Management Systems - Requirements and ISO/IEC 27002 : Code of practice for information security controls.

Omnex and the IATF 16949 FAQs recommend that US Automotive Suppliers implement ISO 27001 to satisfy IATF 16949 requirements for Cybersecurity. If the Automotive Supplier also works with European OEMs, then we recommend ISO 27001 with TISAX be implemented. It is widely believed that TISAX will soon become an Automotive Industry standard.

The UN ECE has a standard UNECE 29, also known sometimes as UN 29 which is an Automotive Product Cybersecurity standard. This standard is focused on the OEM and will be audited by regulators of countries. The OEM has the responsibility to enforce UN 29 for its entire supply chain. The VDA (German OEMs and Tier One Association) announced an Automotive Cybersecurity Management System audit based on UN 29 which they said was applicable to the entire supply chain. The UN 29 and the VDA CSMS requires ISO 27001 to also be applied.

CMCC is the Department of Defense (DOD) Cybersecurity Maturity Model which was announced on Jan 31^st. The DOD will be requiring CMMC compliance in their defense bids. The CMCC has five levels of maturity and the levels relate to the number of Cybersecurity Controls in place. CMMC requirements dovetail with ISO 27001 and provides a management system for implementing and maintaining a Cybersecurity Management System.

Omnex’s ISO 27001 training include both TISAX and CMMC including for Understanding, Internal Auditor and Lead Auditor classes. Also, Omnex conducts gap analysis and implementation for these programs.

ISO 27001 is an Information Security Management System (ISMS) based on the High Level Structure (HLS) and ISMS Controls. It is based on the preservation of “Confidentiality, Integrity and Availability” of information.