Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
TISAX is an assessment and exchange mechanism for the information security of enterprises and allows recognition of assessment results among the participants.
TISAX (Trusted Information Security Assessment Exchange) is an assessment and exchange mechanism for the information security of enterprises and allows recognition of assessment results among the participants.
This framework includes TISAX's information security requirements, which are mandatory for all TISAX participants. Framework can be further expanded with prototype protection and data protection requirements found as extension frameworks.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Objective: Organizations are subject to legislation, regulations and internal policies. Already when hiring staff, it must be ensured that employees commit to compliance with the policies and are aware of the consequences of misconduct.
Requirements (must): A non-disclosure obligation is in effect.
An obligation to comply with the information security policies is in effect.
Requirements (should): A non-disclosure obligation beyond the employment contract or order is in effect.
Information security aspects are considered in the employment contracts of the staff.
A procedure for handling violations of said obligations is described.
Objective: If the requirements and risks of information security are not known to the employees, there is a risk of misconduct resulting in damage to the organization. Therefore, it is important that information security is internalized and practiced as a natural part of their work.
Requirements (must): Employees are trained and made aware.
Requirements (should): A concept for awareness and training of employees is prepared. As a minimum, the following aspects are considered:
- Information security policy,
- Reports of information security events,
- Reaction to occurrence of malware,
- Policies regarding user accounts and login information (e.g. password policy),
- Compliance issues of information security,
- Requirements and procedures regarding the use of non-disclosure agreements when sharing information requiring protection,
- Use of external IT services.
Target groups for training and awareness measures (i.e., people working in specific risk environments such as administrators, employees having access to customer networks, personnel in areas of manufacturing) are identified and considered in a training concept.
The concept has been approved by the responsible management.
Training and awareness measures are carried out both at regular intervals and in response to events.
Participation in training and awareness measures is documented.
Contact persons for information security are known to employees.
Objective: Working outside the specifically defined security zones (teleworking) creates risks requiring corresponding protective measures.
Requirements (must): The requirements for teleworking are determined and fulfilled. The following aspects are considered:
- Secure handling of and access to information (in both electronic and paper form) while considering the protection needs and the contractual requirements applying to private (e.g. home office) and public surroundings (e.g. during travels),
- Behavior in private surroundings,
- Behavior in public surroundings,
- Measures for protection from theft (e.g. in public surroundings),
The organization’s network is accessed via a secured connection (e.g. VPN) and strong authentication.
Requirements (should): The following aspects are considered:
- Measures for travelling (e.g. viewing by authorities),
- Measures for travelling to security-critical countries.
Employee awareness.
Objective: Security zones provide physical protection of information assets. The more sensitive the information assets to be processed are the more protective measures are required.
Requirements (must): A security zone concept including the associated protective measures based on the requirements for the handling of information assets is in place:
- Physical conditions (e.g. premises / buildings / spaces) are considered in the definition of security zones,
- This also includes delivery and shipping areas.
The defined protective measures are implemented.
The code of conduct for security zones is known to all persons involved.
Requirements (should): Procedures for allocation and revocation of access rights are established.
Visitor management policies (including registration and escorting of visitors) are defined.
Policies for carrying along and using mobile IT devices and mobile data storage devices (e.g. registration before they are carried along, identification obligations) are defined and implemented.
Network/infrastructure components (own or customer networks) are protected against unauthorized access.
External properties used for storing and processing information assets are considered in the security zone concept (e.g. storage rooms, garages, workshops, test tracks, data processing centres).
Objective: During their lifecycle (e.g. usage, disposal), supporting assets are subject to risks such as loss, theft or unauthorized viewing.
Requirements (must): The requirements for the handling of supporting assets (e.g. transport, storage, repair, loss, return, disposal) are determined and fulfilled.
Requirements (should): -
Objective: Mobile IT devices (e.g. notebooks, tablets, smartphones) and mobile data storage devices (e.g. SD cards, hard drives) are generally used not only on the premises of an organization, but also in mobile applications. This presents an increased risk with respect to e.g. loss or theft.
Requirements (must): The requirements for mobile IT devices and mobile data storage devices are determined and fulfilled. The following aspects are considered:
- Encryption,
- Access protection (e.g. PIN, password),
- Marking (also considering requirements for use in the presence of customers).
Requirements (should): Registration of the IT devices.
Users are informed of missing data protection on mobile devices.
Objective: To check the authorization for both physical access and electronic access, means of identification such as keys, visual IDs, other physical access devices as well as cryptographic tokens are often used. The security features are only reliable if the use of such identification means is handled adequately.
Requirements (must): The requirements for the handling of identification means over the entire lifecycle are determined and fulfilled. The following aspects are considered:
- Creation, handover, return and destruction,
- Validity periods,
- Traceability,
- Handling of loss.
Requirements (should): Identification means can be produced under controlled conditions only.
Objective: Only securely identified (authenticated) users are to gain access to IT systems. For this purpose, the identity of a user is securely determined by suitable procedures.
Requirements (must): The procedures for user authentication have been selected based on a risk assessment. Possible attack scenarios have been considered (e.g. direct accessibility via the internet).
State of the art procedures for user authentication are applied.
Requirements (should): The user authentication procedures are defined and implemented based on the business-related and security-relevant requirements:
- Users are authenticated at least by means of strong passwords according to the state of the art.
Superior procedures are used for the authentication of privileged user accounts (e.g. Privileged Access Management, two-factor authentication).
Objective: Access to information and IT systems is provided via validated user accounts assigned to a person. It is important to protect login information and to ensure the traceability of transactions and accesses.
Requirements (must): The creating, changing, and deleting of user accounts is conducted.
Unique and personalized user accounts are used.
The use of “collective accounts” is regulated (e.g. restricted to cases where traceability of actions is dispensable).
User accounts are disabled immediately after the user has resigned from or left the organization (e.g. upon termination of the employment contract).
User accounts are regularly reviewed.
The login information is provided to the user in a secure manner.
A policy for the handling of login information is defined and implemented. The following aspects are considered:
- No disclosure of login information to third parties
- not even to persons of authority
- under observation of legal parameters
- No writing down or unencrypted storing of login information
- Immediate changing of login information whenever potential compromising is suspected
- No use of identical login information for business and non-business purposes
- Changing of temporary or initial login information following the 1st login
- Requirements for the quality of authentication information (e.g. length of password, types of characters to be used).
The login information (e.g. passwords) of a personalized user account must be known to the assigned user only.
Requirements (should): A basic user account with minimum access rights and functionalities is existent and used.
Default accounts and passwords pre-configured by manufacturers are disabled (e.g. by blocking or changing of password).
User accounts are created or authorized by the responsible body.
Creating user accounts is subject to an approval process (four-eyes principle).
User accounts of service providers are disabled upon completion of their task.
Deadlines for disabling and deleting user accounts are defined.
The use of default passwords is technically prevented.
Where strong authentication is applied, the use of the medium (e.g. ownership factor) is secure.
User accounts are reviewed at regular intervals. This also includes user accounts in customers' IT systems.
Interactive login for service accounts (technical accounts) is technically prevented.
Objective: Access to information and IT systems is provided via validated user accounts assigned to a person. It is important to protect login information and to ensure the traceability of transactions and accesses.
Requirements (must): The creating, changing, and deleting of user accounts is conducted.
Unique and personalized user accounts are used.
The use of “collective accounts” is regulated (e.g. restricted to cases where traceability of actions is dispensable).
User accounts are disabled immediately after the user has resigned from or left the organization (e.g. upon termination of the employment contract).
User accounts are regularly reviewed.
The login information is provided to the user in a secure manner.
A policy for the handling of login information is defined and implemented. The following aspects are considered:
- No disclosure of login information to third parties
- not even to persons of authority
- under observation of legal parameters
- No writing down or unencrypted storing of login information
- Immediate changing of login information whenever potential compromising is suspected
- No use of identical login information for business and non-business purposes
- Changing of temporary or initial login information following the 1st login - Requirements for the quality of authentication information (e.g. length of password, types of characters to be used).
The login information (e.g. passwords) of a personalized user account must be known to the assigned user only.
Requirements (should): A basic user account with minimum access rights and functionalities is existent and used.
Default accounts and passwords pre-configured by manufacturers are disabled (e.g. by blocking or changing of password).
User accounts are created or authorized by the responsible body.
Creating user accounts is subject to an approval process (four-eyes principle).
User accounts of service providers are disabled upon completion of their task.
Deadlines for disabling and deleting user accounts are defined.
The use of default passwords is technically prevented.
Where strong authentication is applied, the use of the medium (e.g. ownership factor) is secure.
User accounts are reviewed at regular intervals. This also includes user accounts in customers' IT systems.
Interactive login for service accounts (technical accounts) is technically prevented.
Objective: When using cryptographic procedures, it is important to consider risks in the field of availability (lost key material) as well as risks due to incorrectly applied procedures in the fields of integrity and confidentiality (poor algorithms/protocols or insufficient key strengths).
Requirements (must): All cryptographic procedures used (e.g. encryption, signature, and hash algorithms, protocols) provide the security required by the respective application field according to the recognized industry standard,
- to the extent legally feasible.
Requirements (should): Preparation of technical rules containing requirements for encryption in order to protect information according to its classification.
A concept for the application of cryptography is defined and implemented. The following aspects are considered:
- Cryptographic procedures,
- Key strengths,
- Procedures for the complete lifecycle of cryptographic keys, including generation, storage, archiving, retrieval, distribution, deactivation, renewal, and deletion.
An emergency process for restoring key material is established.
Objective: When being transferred via public or private networks, information can in some circumstances be read or manipulated by unauthorized third parties. Therefore, requirements regarding the protection needs of the information must be determined and implemented by taking suitable measures during such transfer.
Requirements (must): The network services used to transfer information are identified and documented.
Policies and procedures in accordance with the classification requirements for the use of network services are defined and implemented.
Measures for the protection of transferred contents against unauthorized access are implemented.
Requirements (should): Measures for ensuring correct addressing and correct transfer of information are implemented.
Electronic data exchange is conducted using content or transport encryption according to the respective classification.
Remote access connections are verified to possess adequate security features (e.g., encryption, granting and termination of access) and capabilities.
Objective: The objective is to ensure that information security aspects are considered in case of any changes to the organization, business processes and IT systems (Change Management) in order to prevent these changes from causing an uncontrolled reduction in the information security level.
Requirements (must): Information security requirements for changes to the organization, business processes, IT systems are determined and applied.
Requirements (should): A formal approval procedure is established.
Changes are verified and assessed for their potential impact on the information security.
Changes affecting the information security are subjected to planning and testing.
Procedures for fallback in fault cases are considered.
Objective: The objective of separating the development, testing and operational environments is to ensure that the availability, confidentiality and integrity of productive data are maintained.
Requirements (must): The IT systems have been subjected to risk assessment in order to determine the necessity of their separation into development, testing and operational systems.
A segmentation is implemented based on the results of risk analysis.
Requirements (should): The requirements for development and testing environments are determined and implemented. The following aspects are considered:
- Separation of development, testing and operational systems,
- No development and system tools on operational systems (except those required for operation),
- Use of different user profiles for development, testing, and operational systems.
Objective: The aim is to both technically and organizationally ensure the protection of IT systems against malware.
Requirements (must): Requirements for protection against malware are determined.
Technical and organizational measures for protection against malware are defined and implemented.
Requirements (should): Unnecessary network services are disabled.
Access to network services is restricted to necessary access by means of suitable protective measures (see examples).
Malware protection software is installed and updated automatically at regular intervals (e.g. virus scanner).
Received files and software are automatically inspected for malware prior to their execution (on-access scan).
The entire data contents of all systems is regularly inspected for malware.
Data transferred by central gateways (e.g. e-mail, internet, third-party networks) is automatically inspected by means of protection software:
- Encrypted connections are considered.
Measures to prevent protection software from being deactivated or altered by users are defined and implemented.
Case-related staff awareness measures.
For IT systems operated without the use of malware protection software, alternative measures (e.g. special resilience measures, few services, no active users, network isolation) are implemented.
Objective: Event logs support the traceability of events in case of a security incident. This requires that events necessary to determine the causes are recorded and stored. In addition, the logging and analysis of activities in accordance with applicable legislation (e.g. Data Protection or Works Constitution Act) is required to determine which user account has made changes to IT systems.
Requirements (must): Information security requirements regarding the handling of event logs are determined and fulfilled.
Security-relevant requirements regarding the logging of activities of system administrators and users are determined and fulfilled.
The IT systems used are assessed regarding the necessity of logging.
When using external IT services, information on the monitoring options is obtained and considered in the assessment.
Event logs are checked regularly for rule violations and noticeable problems in compliance with the permissible legal and organizational provisions.
Requirements (should): A procedure for the escalation of relevant events to the responsible body (e.g. security incident report, data protection, corporate security, IT security) is defined and established.
Event logs (contents and meta data) are protected against alteration. (e.g. by a dedicated environment).
Adequate monitoring and recording of any actions on the network that are relevant to information security are established.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.