Choosing the right TISAX® assessment objectives: prototype protection and data protection

Which assessment objective do we need? This question determines the assessment level, the assessment scope and the costs, and it is often answered wrongly: prototype protection is underestimated, data protection is ticked as a precaution. Here you will find what the ten assessment objectives mean, which prototype assessment objective fits which activity and when Data or Special Data really belong in your scope.

The assessment objective is the key to the entire process. It determines which modules of the VDA ISA apply to you and how deeply the audit provider assesses: assessment level 2 as a plausibility check, usually by video conference, or assessment level 3 as a full assessment on site. Your customer specifies which assessment objective you need. Since April 2024, there have been ten:

The assessment objectives build on one another. Strictly Confidential includes Confidential, Very High Availability includes High Availability, Special Data includes Data. Anyone who receives the higher label automatically has the lower one. If ENX introduces a new label that is a subset of an existing one, you receive it retroactively. Several assessment objectives can be combined in one assessment; the assessment scope is then the sum of the modules concerned.

What is protected are physical prototypes that their owner has classified as requiring protection: vehicles, components and parts. The owner is whoever holds the intellectual property, and the owner’s commissioning department defines the protection need. Which of the four assessment objectives you need depends on what you do with the prototypes provided by the customer:

Proto Parts (AL 3)

You develop, manufacture, process or store parts and components requiring protection. The physical security of the areas concerned, the organizational rules and the handling are assessed, fully on site.

Proto Vehicles (AL 3)

Entire prototype vehicles requiring protection are located at your premises, for example in the workshop, in storage or ready for handover. The assessment follows the same module as for parts, focusing on the locations where the vehicles are kept.

Test Vehicles (AL 2)

You carry out tests and test drives with the customer’s vehicles requiring protection, on public roads or test tracks. The assessment covers the customer’s camouflage requirements, the use of approved test tracks and the rules of conduct for driving in public, including for breakdowns, accidents and theft. The physical security of your locations is not necessarily part of the assessment here; ENX recommends additionally choosing Proto Vehicles for appropriately equipped locations.

Proto Events (AL 2)

You show, film or photograph vehicles, components or parts requiring protection at presentations, market research, marketing events or shoots. The assessment covers the coordination of customer-specific requirements, security concepts approved by the customer (organizational, technical, personnel), rules of conduct for incidents and, for shoots, proof that the premises have been approved.

The 22 requirements of the module range from perimeter and access protection through visitor management, non-disclosure agreements and subcontractors to rules for photo and video recordings. Prototype protection is therefore rarely an IT topic, but one for plant security, reception, logistics, the vehicle fleet, marketing and external service providers. And it has no link to ISO 27001: none of the 22 requirements refers to the standard, so an existing ISMS helps little here.

A note on ISA2027: the new catalog fundamentally reorganizes the module. The previous chapters on transport and handling, on test vehicles, and on events and shoots no longer exist as separate chapters; they are replaced by 13 organizational requirements, including the new incident management, and 7 requirements for physical security. How ENX maps the Test Vehicles and Proto Events assessment objectives to this is not described in the ENX documents published so far. We keep this point open in scoping instead of guessing.

Whether the Data or Special Data assessment objectives belong in the assessment is a strategic decision with consequences for effort and level, and many companies cannot answer it. The catalog makes the logic clear: the Data Protection module only applies in addition if you process personal data on behalf of others, that is, as a processor under Art. 28 GDPR for your customer. It is not about your general data protection, not about employee data and not about your own business contacts.

The module has twelve requirements: data protection policy, data protection officer, record of processing activities, impact assessment, transfers to subcontractors and third countries, data subject requests, incidents, commitment and training of employees, instructions from the controller. Unlike the other modules, it is not rated with maturity levels but with yes or no. Three questions decide whether it belongs in your scope:

1. Does your customer explicitly require Data or Special Data? Then the decision has been made, and it is only a matter of implementation and evidence.
2. Do you process personal data on the customer’s instructions, with a data processing agreement or a corresponding contractual clause? Then you should assess Data, even if the customer has not asked for it yet. If there is no such processing, the assessment objective does not belong in your scope, even if your company is “somehow relevant to the GDPR”.
3. Are special categories involved, such as health data? Then Special Data is the right assessment objective. It includes Data and is assessed at AL 3, that is, on site.

Typical mistakes are ticking the box as a precaution without any processing on behalf of others, overlooking an existing data processing agreement with the OEM, and assuming that an ISMS based on ISO 27001 covers the module. It does not: the twelve data protection requirements have no link to ISO 27001 in the catalog. For ISA2027, the module remains unchanged: the same twelve requirements, the same wording.

Each additional assessment objective brings a module or additional requirements into the assessment scope, and AL 3 means an on-site inspection instead of a video conference. The scope is therefore the biggest lever for effort and costs, in both directions: a missing assessment objective costs you the contract, an unnecessary one costs money. Locations are part of this: the scope includes those where the customer’s protected information or prototypes are actually processed.

Scoping is the first building block of our TISAX® consulting. Together with you, we clarify locations, processes and data flows, check the required assessment objective against what you actually do, and give you the arguments you need if an assessment objective should be renegotiated. What comes after that, from the self-assessment to the label, is described on our TISAX® consulting page.