Does an automotive supplier need ISO 27001 or TISAX, and how do they relate?
TISAX is the information security assessment and label that the automotive industry uses to qualify suppliers, and its ISA catalogue stays aligned with ISO/IEC 27001, but the two are not interchangeable. A vehicle manufacturer or tier supplier that asks for TISAX wants an ENX-governed assessment result, shared through the ENX Portal with the partners you select, not a certificate from a general management system audit. Some customers ask for ISO 27001 alongside it, and others accept only one of the two. The answer depends on three things: which customers ask for which result, which scope they need covered, and which assessment level they require. Check those three points in each customer's written requirement before you choose what to pursue. The scope rules are where the two diverge. For ISO 27001, the organization defines its ISMS scope freely and the audit covers that scope. For TISAX, the assessment scope is predefined and must fall inside your ISMS scope, so a supplier can hold a broad ISMS and still need a narrower, specific assessment for a given site or business unit. Read the TISAX Participant Handbook before you draw the boundary, and confirm with the customer which locations and processes their labels must cover. Assessment levels also differ in depth, so confirm with the customer whether they require AL 2 or AL 3 before you plan evidence and interviews.
Ownership stays clear throughout. Your organization owns its controls, policies and evidence. DeployOpen can prepare systems, documentation and evidence for the assessment and for an ISO 27001 audit, but DeployOpen does not issue TISAX labels, audit reports or certificates. Only an ENX-recognized audit provider or an accredited certification body can issue those results. Before you engage anyone, ask the provider to confirm its recognition or accreditation status and the scope it will assess, and ask your customers to confirm which label or certificate they will accept. Label validity is three years, so plan the next assessment cycle at the start, not when the current label expires.
Predefined TISAX scope versus a freely set ISMS scope
Under ISO/IEC 27001, the organization defines its own ISMS scope. It decides which business units, locations, products, services and information assets fall inside the boundary, and the certification body audits against that boundary. The scope must be documented, and it should reflect the interfaces and dependencies the organization has with others.
- Free definition: The organization chooses the boundary, whether that is the whole company or a single division.
- Matching audit: The audit scope follows the ISMS scope as the organization defined it.
- Statement of Applicability: Controls are selected and justified against the chosen boundary.
- Certificate wording: The certificate states the scope, so buyers can see what is covered.
- Interfaces: Shared services, suppliers and sites outside the boundary should be addressed in the scope and risk assessment.
Before relying on the ISMS scope in a supplier discussion, check the exact wording of the certificate scope statement with the certification body, not only the marketing description.
A TISAX assessment scope is not chosen freely. It is predefined within the TISAX framework, and it must fall inside the organization's ISMS scope. The assessed locations and the assessment level are recorded so that vehicle manufacturers and partners can see what was tested. Results are issued as labels, valid for three years, and shared through the ENX Portal.
- Predefined structure: The assessment scope follows the TISAX rules rather than a custom boundary.
- Subset requirement: The TISAX scope must sit within the ISMS scope, so it can never extend beyond it.
- Location records: Assessed locations are listed on the TISAX record with their assessment results.
- Label validity: A label is valid for three years, so the scope should be reviewed when the label renews.
- Assessment level: The depth of verification depends on the assessment level selected.
Confirm with your ENX-registered audit provider which sites and processes the TISAX scope will cover before ordering the assessment.
The following case is illustrative only and does not describe a real company. A supplier holds an ISO 27001 certificate whose ISMS covers the whole company, including administration, logistics and several plants. Its TISAX assessment scope covers only the engineering sites that develop parts for one vehicle manufacturer.
- Wider ISMS: The certificate protects the whole organization, which satisfies the supplier's general information security governance.
- Narrower TISAX scope: Only the engineering sites appear in the TISAX assessment and label.
- Containment: The TISAX scope sits inside the ISMS boundary, so the engineering sites are governed by the company-wide policies.
- Customer view: The manufacturer sees the assessed engineering locations on the record, not the entire company.
- Future customers: A different customer may require other sites, which would need a separate TISAX assessment scope.
When planning, ask the audit provider how the TISAX scope maps to your ISMS scope statement so both documents describe the same boundary.
TISAX records allow an organization to list its ISO/IEC 27001 certification as optional information on a location record. The listing gives partners a quick reference to the certified management system, but it does not replace the TISAX assessment or its label. The two credentials answer different questions: the certificate shows that a management system is in place, while the label shows that a defined scope was assessed against the ISA catalogue.
- Optional field: Listing the ISO certificate is a choice, not a requirement of the TISAX process.
- Location-level detail: The listing is attached to a location record, so it should match the sites the certificate covers.
- Not a substitute: A TISAX label is still needed for an assessed scope, even when an ISO certificate is listed.
- Accuracy: Certificate number, scope and expiry should match the certification body's record.
- Updates: Keep the record current when the certificate is renewed or the scope changes.
Before listing a certificate, compare its scope statement with the TISAX location record so partners do not infer coverage that does not exist.
What AL 2 and AL 3 demand in practice
The assessment level sets how the audit provider tests the self-assessment your organization has already completed. Each card below covers one decision or preparation step, so you can agree the right level with your customer and prepare the evidence before the audit provider asks for it.
Agree the level with the customer first
The assessment level is usually set by the customer or the OEM that requests the label, not by the supplier alone. Ask the customer which level its requirements specify for your location and which assessment scope it needs. Confirm this in writing before you book an audit provider, because changing the level later means a different audit and a different preparation effort.
AL 2: plausibility check of self-assessment
At AL 2 the audit provider plausibility-checks your self-assessment against the ISA catalogue. The review covers evidence and an interview, and the interview is usually held by web conference. Your self-assessment must be accurate and internally consistent, because the audit provider tests whether the answers match what your systems actually do.
AL 3: comprehensive on-site verification
AL 3 requires an on-site verification in which the audit provider checks controls in place at the locations in scope. The audit includes interviews and direct observation of working practices, such as access to secure areas and handling of prototypes. Plan for the audit provider to walk the site and test controls rather than only read documents.
Evidence the auditor will ask for
Prepare current, dated evidence for each control in scope: policies, access reviews, asset inventories, training records, incident logs and supplier agreements. For AL 2 the evidence is reviewed remotely, so files must be easy to locate and share. For AL 3, prepare the same evidence and also be ready to show the physical and system controls it describes.
Interview readiness for control owners
Both levels include interviews, so the people who run each control must be able to explain it accurately. Brief control owners on the scope, the self-assessment answers they signed off, and where their evidence is kept. Interview gaps often surface as inconsistencies between what the self-assessment says and what staff describe.
Matching the ISMS scope to the assessment scope
The TISAX assessment scope is predefined and must fall within your ISMS scope, so check that the locations, processes and systems in the assessment are covered by your ISMS. If you hold an ISO 27001 certificate, its scope must include the assessed locations. Confirm this with your certification body or consultant before the audit provider reviews the scope.
How long a TISAX label lasts and how results are shared
A TISAX assessment ends in a label, and the label is valid for three years. Results are not published. They are shared with selected partners through the ENX Portal, so each customer you give access to sees the label and its assessment level for your location, and nobody else does. That access model matters for planning, because your customers do not receive a file they can keep. They look up your current status in the portal, and a lapsed or outdated label can stall a sourcing decision even when your underlying security is sound.
ISO/IEC 27001 certification runs on a different clock. Under ISO/IEC 17021-1, the certification cycle is three years, with at least one audit, either surveillance or recertification, in every calendar year, and a certificate valid for only one year does not conform (see European Accreditation FAQ 51.7). If your suppliers ask for both, you will manage two expiry dates, two audit rhythms and two sets of evidence. Confirm with your certification body whether any audit timing can be aligned, and do not assume that a TISAX label satisfies the annual surveillance expectations of an ISO certificate or the reverse.
Plan the reassessment against your customers' renewal dates, not only against the label's own expiry. Work backward from the date each key customer will re-screen your supplier file, allow time for the assessment to be ordered and completed, and check whether the ISA catalogue version in force at that point differs from the one you were assessed against. Ask each customer in writing which label and assessment level they require, since a level that suits one OEM may not meet another's requirement. Record the answer in your supplier file so the next renewal starts from a confirmed requirement.
How a combined ISO 27001 and TISAX project runs
The sequence below takes an automotive supplier from confirmed customer requirements to a TISAX label, with an ISO 27001 ISMS built alongside so that one body of controls and evidence serves both assessments. Each step names the output that shows it is complete.
Confirm customer requirements and assessment level
Start by asking each OEM or tier-1 customer which TISAX assessment level and which scope they require, and whether they also ask for an ISO 27001 certificate. The organization owns this decision, and procurement or the customer's supplier portal usually states it. The output is a short requirements register listing each customer, the assessment level (AL 2 or AL 3), the required scope and the deadline the customer has set. Confirm timing directly with the customer and the audit provider, since no durations are fixed here.
Set the ISMS scope and the TISAX scope
Define the ISO 27001 scope first, because the TISAX participant handbook treats the organization's ISMS scope as free to set, with the TISAX assessment scope predefined and required to fall within it. Decide which sites, business units, processes and IT systems are in, and document the reasons for any exclusions. The output is a signed scope statement, plus a TISAX scope check showing that every location and function the customer needs is covered by the ISMS.
Map ISA requirements to existing ISO 27001 controls
Compare the ISA catalogue requirements for your chosen assessment level with the Annex A controls and clauses 4 to 10 already in your ISMS. ENX states that the ISA catalogue stays aligned with ISO/IEC 27001, but the mapping must be checked against the catalogue version your assessment uses, and ISA2027 applies only to assessments ordered from 1 January 2027. The output is a gap-mapping workbook that links each ISA requirement to a control, a policy, a procedure and an evidence source, with the gaps marked.
Close gaps and collect evidence
Work through the gaps with control owners. Typical fixes include written procedures, access reviews, asset inventories, supplier security clauses and logging of privileged actions, and each fix is owned by the organization. An implementation partner can prepare systems, configurations and evidence collection, but the organization must run and approve the controls. The output is a population of dated, owner-assigned evidence for each requirement that a reviewer can trace back to a control.
Complete the self-assessment in the ENX Portal
Complete the TISAX self-assessment for each location in scope, answering every ISA question against the evidence gathered in the previous step. Answers should match what the evidence shows, because the audit provider checks them. Assign the self-assessment a named internal reviewer who has read the evidence. The output is a completed self-assessment for each location, ready for the audit provider to review.
Book the audit provider and prepare for the audit
Select an audit provider approved for TISAX and book the assessment at the agreed level. At AL 2 the provider plausibility-checks the self-assessment through evidence review and an interview, usually by web conference. At AL 3 it performs a comprehensive on-site verification with interviews and observation, so plan access to the sites and staff. The output is a confirmed audit plan, a list of interviewees and an evidence index shared with the provider before the audit starts.
Handle audit findings and remediation
After the assessment, the audit provider reports its findings. Review each finding, agree on remediation actions with the provider, and fix the underlying gaps rather than only the symptoms. Record each action with an owner and the evidence that will show it is closed. The output is a remediation log that the provider accepts, and any reassessment the provider requires for the assessment to conclude.
Receive the label and share it through ENX
When the assessment is complete, the TISAX label is issued and valid for three years. Results are shared with selected partners through the ENX Portal and are not published, so grant access only to the customers that need it. Keep the ISMS running for the full label period, with the evidence current. If your customers also ask for an ISO 27001 certificate, the certification body audits the ISMS separately. The output is a valid label visible to the partners you have selected, and a maintained ISMS ready for the next cycle.
What must be in place before the TISAX assessment
A TISAX assessment tests whether what a supplier says about its information security holds up against evidence. The cards below cover the scope, the ISMS, the evidence, the self-assessment, the owners and the ENX Portal record that have to line up before an audit provider is engaged.
A defined scope with a location list
Confirm the locations, business units and systems that the TISAX assessment covers, written down as a location list. The assessment scope is predefined and must fall within the ISMS scope, so check that every listed site is also inside your ISMS boundary. If an ISO 27001 certificate exists, compare its scope statement with the location list and note any site that appears in one but not the other.
A current ISMS with a Statement of Applicability
Confirm that an ISMS exists and is running, with a Statement of Applicability that records which Annex A controls apply, which are excluded and why. Under ISO/IEC 27001 the organization defines its ISMS scope freely, so the scope must be stated clearly before the TISAX scope is drawn from it. Check that the document is dated, approved by management and matched to the current risk assessment.
Evidence for ISA requirements at the chosen level
Choose the assessment level first, because the depth of evidence depends on it. At AL 2 an audit provider reviews evidence and interviews staff, usually by web conference. At AL 3 the provider verifies controls on site with observation. For each ISA requirement in scope, collect the policy, record or configuration that shows it operates, and confirm that the evidence is dated and retrievable.
A self-assessment that matches the evidence
Complete the ISA self-assessment only after checking each answer against the evidence you hold. A self-assessment that claims a control is in place while the supporting record is missing is the most common reason an audit provider raises findings. Walk through a sample of answers with the people who run each control and confirm that the stated maturity matches what they do day to day.
Named owners for each control area
Assign a named person to each control area in the ISA catalogue, such as access management, asset handling, incident response and supplier management. Owners should be able to produce their evidence and explain it in an interview. Record the owners in the ISMS documentation and confirm that each person accepts the responsibility, because interviews at higher levels test whether control ownership is real.
Access to the ENX Portal assessment record
Confirm that the people who will manage the assessment have accounts on the ENX Portal and that the record for your organization and locations is set up correctly. Results are issued as labels valid for three years and shared with selected partners through the portal rather than published, so the access list should reflect who may view and share results. Check the record before the audit provider is engaged so that scheduling and results do not stall.
ISO 27001 only, TISAX only, or both
This table compares the three paths an automotive supplier can take: an ISO 27001 certificate, a TISAX label, or both. Read each column for who issues the result, how long it stays valid and the situation where that option fits best. Where a customer scope differs from the ISMS scope, the supplier will usually need both results.
| Option | Who issues the result | Validity | When it fits |
|---|---|---|---|
| ISO 27001 certificate only | An accredited certification body after an independent audit of the ISMS | Three-year certification cycle with annual audits (ISO/IEC 17021-1) | General customers ask for ISO 27001 and no vehicle manufacturer requires a TISAX label |
| TISAX label only | An audit provider recognized under the ENX Association scheme, with results shared through the ENX Portal | Labels valid for three years (ENX) | Vehicle manufacturers or partners require TISAX and no certificate is requested |
| Both results | A certification body for ISO 27001 and an ENX-recognized audit provider for TISAX | ISO 27001 cycle and TISAX label run on their own timelines | The customer mix differs, or the TISAX assessment scope is narrower than the ISMS scope |
| Scope basis | ISMS scope is set freely by the organization; TISAX scope is predefined | Confirm the scope wording each customer expects before the audit | Use the ISMS scope to cover the wider organization and the TISAX scope for the locations automotive work touches |
| Assessment depth | ISO audits follow the standard; TISAX levels AL 2 and AL 3 differ in depth | Confirm the required assessment level with each customer | Higher TISAX levels mean on-site verification, which affects planning for both audits |
| Shared evidence | Same policies, asset records and access reviews can support both | Keep one evidence set mapped to both schemes | Reduces duplicate work when both results are needed |
| Reuse of ISO certificate for TISAX | A certificate does not replace a TISAX assessment | Ask the customer whether they accept a certificate as optional information on a TISAX location record | Helpful when a customer asks for a certificate alongside a label |
| Ordering timeline | Each body sets its own scheduling | Confirm booking lead times with each body before committing dates | Plan both audits early when a supplier contract depends on either result |
Who does what on a TISAX and ISO 27001 project
The supplier owns the information security management system, the scope decision and every control it claims. Management approves the policies, sets the scope for the ISMS and, for TISAX, selects the assessment level and the predefined assessment scope that must fall within the ISMS scope. Staff who run the processes, such as IT operations, HR, facilities and purchasing, produce the day-to-day records that show the controls operate. The supplier also answers for the self-assessment in TISAX, which the audit provider later checks for plausibility.
- Scope decisions: Management defines the ISMS scope and confirms which sites, systems and business processes it covers.
- Control ownership: Named internal owners run each control and keep its records current.
- Self-assessment accuracy: The supplier answers the ISA catalogue honestly, because the auditor tests those answers against evidence.
- Internal review: The supplier runs internal audits and management reviews before any external audit.
- Label and certificate use: The supplier decides which partners receive a TISAX label through the ENX Portal.
Before starting, ask who on your team owns each control and whether they have the time to maintain its evidence after the assessment.
An implementation partner such as DeployOpen helps the supplier prepare its systems and evidence. Typical work includes hardening self-hosted platforms, configuring logging and access controls, collecting and organizing evidence, running technical testing and documenting how the environment meets the controls. The partner works inside the supplier's own infrastructure, and the supplier keeps ownership of the outcome. The partner cannot perform the assessment, mark controls as passed for the auditor or issue a TISAX label or ISO 27001 certificate.
- System hardening: Configuring servers, identity services, endpoints and backups to the baseline the supplier has agreed.
- Evidence collection: Setting up tools that capture access reviews, change records and logs in a form an auditor can sample.
- Technical testing: Running vulnerability assessments and penetration tests that the supplier can present as input, separate from the assessment itself.
- Documentation: Writing runbooks and configuration records that show how controls are implemented.
- Independence boundary: The partner does not act as the auditor, does not write the supplier's self-assessment answers on its behalf and does not sign off on results.
Ask any partner to put in writing which tasks it performs, which it will not perform and who keeps the evidence after the engagement ends.
For TISAX, an audit provider approved under the ENX framework performs the assessment at the assessment level the supplier ordered. At AL 2, the provider plausibility-checks the self-assessment through evidence review and an interview, usually by web conference. At AL 3, the provider performs a comprehensive on-site verification with interviews and observation. For ISO 27001, an accredited certification body performs the audit and issues the certificate, and it must operate to ISO/IEC 17021-1 and ISO/IEC 27006-1. The provider or body reports its findings; it does not design the controls it tests.
- Independent testing: The auditor samples evidence and tests controls without help from the team that prepared them.
- Assessment level: For TISAX, the level decides whether the review is remote or on-site.
- Results issuance: Only the audit provider or certification body issues the TISAX label or ISO 27001 certificate.
- Accreditation: For ISO 27001, check that the certification body is accredited and that its certificate appears in the IAF CertSearch database.
- Impartiality: The auditor should not be the same firm that implemented the controls for the same engagement.
Before booking, confirm with the provider which assessment level, scope and evidence it expects, and verify the accreditation or approval status yourself.
Checks before choosing a TISAX or ISO 27001 partner
Automotive suppliers often need both a TISAX assessment and an ISO 27001 certificate, and each has its own gatekeepers. The checks below separate who prepares your evidence from who judges it, so you can confirm that every party in the engagement holds the role it claims.
Confirm the audit provider is recognized by ENX
TISAX assessments must be carried out by audit providers that ENX recognizes for TISAX. Ask the provider to show its current recognition before you sign, and confirm that the assessment level you need is covered. Results are issued as labels valid for three years and shared through the ENX Portal, so your OEM partners will rely on the provider's recognition, not on your consultant's word.
Confirm certification body accreditation
If you need an ISO 27001 certificate, the certification body must be accredited for ISMS certification. Check its accreditation on IAF CertSearch, which ISO still points to for accredited certificates, and confirm the scope listed matches your services. A certificate from an unaccredited body will not satisfy a customer who checks it.
Keep design and assessment separate
A firm that designs your controls and then assesses them has marked its own homework. For ISO 27001, the certification body must be independent of the consultant who built the ISMS. For TISAX, the audit provider must not be the party that prepared your self-assessment. Ask each firm in writing which parts of the work it does not perform, and ask who signs off the readiness review.
Ask about automotive experience
Ask the partner how many TISAX-related engagements it has supported and which ISA catalogue version it works from, since the ISA2027 catalogue applies to assessments ordered from 1 January 2027. Ask how it maps the ISA catalogue to ISO/IEC 27001:2022 controls, and how it handles prototype parts, engineering data and supplier-to-OEM data flows. Request concrete examples in anonymized form, and treat vague answers as a warning.
Request a written scope
A TISAX assessment scope is predefined and must fall within your ISMS scope, while your ISO 27001 scope is one you set freely. Ask for a written scope statement that names the sites, business units, systems and suppliers covered, and check that the TISAX scope sits inside the ISMS scope. Vague scope language is the most common source of later disputes about what a certificate or label actually covers.
Clarify who prepares and who produces evidence
Ask the partner to list each piece of evidence it will prepare, such as policy templates, risk register structure or access review tooling, and each piece your own staff must produce, such as signed access reviews, incident records and supplier contracts. Assessors test what your organization actually does over time, so evidence the partner drafts without operational use will not pass. Get the split in writing before work begins.
Questions automotive suppliers ask about TISAX and ISO 27001
Is ISO 27001 enough to pass a TISAX assessment?
No. ISO 27001 certification does not replace a TISAX assessment, but the two overlap heavily. The ISA catalogue was built on ISO/IEC 27001 and, from ISA 5, has stayed aligned with it, so an ISMS that is well run covers much of the same ground. The gap is in what the customer asks for: TISAX results are issued as labels through the ENX Portal and shared with selected partners, and the automotive catalogue contains requirements that a generic ISMS does not address. Ask your OEM customers which assessment they require and at what level before you decide what to build first.
Does the ISMS scope have to match the TISAX assessment scope?
Not exactly. For ISO 27001, the organization defines its ISMS scope freely and the audit covers that scope. A TISAX assessment scope is predefined and must fall within the ISMS scope, so the ISMS has to be at least as broad as the locations and processes a TISAX assessment covers. Many suppliers therefore set the ISMS scope first and then confirm that the TISAX scope sits inside it. The Participant Handbook also allows ISO 27001 certification to be listed as optional information on a location record. Check the current handbook before you define the boundary.
What changes with ISA2027 for assessments ordered from 1 January 2027?
ISA2027, published by the VDA in 2026, applies to TISAX assessments ordered from 1 January 2027. According to ENX, it refines the mappings to ISO/IEC 27001:2022, updates the mappings to NIST CSF 2.0 and removes references to ISO/IEC 27001:2013. For an ISMS built on the 2022 edition, this reduces the translation work. Suppliers should read the new catalogue against their current controls, confirm which evidence their assessment provider will expect, and check whether any assessments already in progress fall before or after the ordering date. Future catalogues are published each summer and take effect on 1 January.
How long is a TISAX label valid?
A TISAX label is valid for three years, according to ENX. Labels are shared with selected partners through the ENX Portal rather than published, so your customers see the label you have chosen to share. Plan the reassessment well before the label expires, because a lapsed label can interrupt supply relationships. The ISO 27001 side follows a different rhythm: under ISO/IEC 17021-1, the certification cycle is also three years, with an audit in every calendar year. Keep both cycles on one calendar so surveillance and reassessment work does not collide.
Which TISAX assessment level do customers ask for?
The level is set by the customer, so ask your OEM or Tier 1 contact which assessment level and label they require for each location and data category. The levels differ in depth. At AL 2, the audit provider checks your self-assessment through evidence review and an interview, usually by web conference. At AL 3, the provider performs a comprehensive on-site verification with interviews and observation. Higher levels cost more and take more preparation, so confirm the requirement in writing before you book an assessment. Ask the audit provider for a quote that states the level, the locations and the expected effort.
Can we prepare for TISAX and ISO 27001 ourselves?
Yes, if your team has the time and the skills to run both programs. The organization owns its controls, policies and evidence, and that work cannot be handed to anyone else. Internal teams usually need help with the parts they have not run before: mapping controls to the catalogue, collecting evidence that an assessor will accept, and testing that controls work in practice. An implementation partner such as DeployOpen can prepare systems and evidence for assessment, but only the audit provider performs the TISAX assessment and only an accredited certification body issues an ISO 27001 certificate. Ask any partner to put scope, deliverables and timelines in writing before work starts.
How DeployOpen prepares TISAX and ISO 27001 evidence
DeployOpen helps automotive suppliers prepare the systems, controls and evidence behind an ISO 27001 ISMS and a TISAX assessment. We plan and implement self-hosted open-source platforms inside your own infrastructure, then document the results for the independent auditor or assessment provider to test. We do not issue labels, reports or certificates.
How we scope
- We agree the written scope with you before any work starts, since engagements are fixed-scope.
- We separate the ISMS scope you set for ISO 27001 from the predefined TISAX assessment scope and its assessment level.
- We confirm which sites, locations, supplier links and engineering systems fall inside the agreed boundary.
How we build
- We configure self-hosted platforms for access control, logging, backups and change records inside your environment.
- We map the implemented technical measures to the relevant Annex A controls and the matching ISA catalogue requirements.
- We run internal checks against the agreed controls so gaps are found and fixed before the external assessment.
How we hand over
- We deliver documented procedures, configuration records and evidence files that your team can maintain and show an auditor.
- We provide a control-by-control evidence index so assessors can trace each claim to a stored artifact.
- We hand over ownership of all systems and documents, so your organization keeps control of its own ISMS.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the handover.
- We can help your team prepare for surveillance reviews and the next TISAX or ISO 27001 assessment cycle.
- Questions about certification bodies, assessment providers and their fees stay with you, and we recommend confirming them directly.
