TISAX VDA Self-Assessment Gap Analysis

A TISAX gap analysis systematically evaluates all control objectives from the VDA ISA questionnaire against your current state. This covers six core areas: information security management, human resources security, physical security, identity and access management, IT security and supplier management. For each control objective, the current maturity level is determined and compared with the required minimum. ADVISORI documents existing strengths as well as concrete gaps with prioritised recommendations.

Duration depends on company size and number of sites. Small companies with one location typically need one to two weeks, mid-sized organisations with multiple sites two to three weeks. Costs typically range from EUR 5,

000 to 15,

000 for small companies and EUR 15,

000 to 40,

000 for mid-sized organisations. This investment pays for itself quickly because it prevents costly rework after a failed assessment and reduces implementation time by up to

40 percent.

A minimum of maturity level

3 (Defined) per control objective is required for successful TISAX certification. This means processes must be documented, standardised and demonstrably implemented. For security-critical control objectives, particularly in the area of prototype protection or at Assessment Level AL3, maturity level

4 (Managed) or even level

5 (Optimised) may be required. The gap analysis shows you the current and required maturity level for each control objective.

The most common gaps in TISAX self-assessments affect six core areas: incomplete asset management, outdated or missing security policies, insufficient evidence of security awareness training, inadequate supplier security, untested incident response processes and incomplete access controls. Documentation requirements are particularly often underestimated: VDA ISA requires not only that measures are implemented, but that their effectiveness is regularly reviewed and evidenced.

After the gap analysis, targeted implementation of the identified measures follows according to the prioritised plan. The typical process: first, quick wins are implemented, meaning gaps that can be closed with minimal effort. In parallel, more complex measures such as new policies, process changes and technical implementations are tackled. ADVISORI then conducts an internal pre-assessment that simulates the audit situation. Only when all control objectives reach the required maturity level is the official ENX assessment booked with an accredited audit provider.