Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
TISAX is an assessment and exchange mechanism for the information security of enterprises and allows recognition of assessment results among the participants.
TISAX (Trusted Information Security Assessment Exchange) is an assessment and exchange mechanism for the information security of enterprises and allows recognition of assessment results among the participants.
This framework includes TISAX's information security requirements, which are mandatory for all TISAX participants. Framework can be further expanded with prototype protection and data protection requirements found as extension frameworks.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!




Objective: The company fulfils its duty of accountability and transparency and thus creates an overview of the respective data processing.
Requirements (must): If required by law, a register of processing activities as defined in Article 30 (1) and/or (2) GDPR (in the latter case only information relating to the order, expressly not other information/details on internal processing) exists and is up to date.
- Technical and organizational measures required for processing as required by the information security questionnaire are adequatly implemented for the processing activities
- There is a process description / sequence description with defined responsibilities.
























Objective: The handling of high-risk processing is secured in cooperation with the service provider with appropriate measures to identify and, if necessary, reduce risks to the rights and freedoms of the data subjects.
Requirements (must): Processing activities that require a data protection impact assessment are known.
Data protection impact assessments are carried out.
- Responsibilities/tasks and support possibilities in the context of data protection impact assessments are defined and known.




Objective: The company knows and secures data transmissions.
Requirements (must): Appropriate processes and workflows for the transmission of data are implemented (e.g. valid contracts within the meaning of Art. 28 GDPR, suitable transfer instruments like standard contractual clauses, transfer impact assessments, adequacy decisions)
- Ensuring the consent or the right of objection of the person responsible for subcontracting




























Objective: The company is aware of and secures data transfers to subcontractors.
Requirements (must): Applicable contractual obligations to clients are passed on to subcontractors and cooperation partners (sub processors).
+ Compliance with contractual agreements is reviewed.
- Contact details of the contact persons of the subcontractor are available and up to date.








Objective: The company is aware of and secures data transfers to third countries.
Requirements (must): Transfers to third countries are known and systematically recorded.
- e.g. through corresponding documentation in the processing directory
Sufficient guarantees (Chapter V GDPR, consideration of decisions of the ECJ on international data transfer, Transfer Impact Assessment in case of relevance, especially in the role of data exporter) are available for data transfers.
In the case of data transfers to third countries, it is determined whether the consent of the person responsible is to be obtained for each transfer to third countries.












Objective: The objective is to ensure the timely processing and fulfillment of data subject requests in order to secures the rights of data subjects guaranteed by law.
Requirements (must): Requests from data subjects are processed in a timely manner.
- Procedures are in place to assist the controller in responding to data subject requests.
- Employees are trained to the effect that they must immediately contact the respective person responsible in the event of an incoming request from a data subject and coordinate the further procedure with this person.












Objective: The objective of processing data protection incidents is to ensure that possible damage to the data subjects is limited and that a recurrence is prevented. In addition, the legally required documentation and, if necessary, timely reporting to the supervisory authority must be ensured.
Requirements (must): Data protection incidents (e.g. unauthorized access to personal data) are processed in a timely manner.
The requirements from 1.6 of the information security questionnaire also take into account data protection incidents or, alternatively, there is an emergency plan for dealing with data protection incidents.
In addition, procedures are established and documented to ensure the following aspects:
- immediate notification to the respective responsible person, as far as his order is affected
- Documentation of the incident handling activities
- Training of employees on the defined measures/processes
- Support of the respective controller in the processing of data protection incidents




















Objective: Organizations are subject to laws, regulations, and internal policies. For employment (hiring/implementation/termination), it is important that employees commit to compliance with the guidelines.
Requirements (must): Employees whose tasks include the processing of personal data are obliged to maintain confidentiality (even beyond the duration of the employment relationship) and to comply with applicable data protection laws.
- The obligation is documented












Objective: If the requirements and risks of data protection are not known to employees, there is a risk that employees will behave incorrectly and thus damage the organization. It is therefore important that data protection is internalized and lived as a natural part of their work.
Requirements (must): "+ Employees are trained and sensitized.
- Scope, frequency, and content of the training is determined according to the protection needs of the data
- Employees in critical areas (e.g. IT administrators) are instructed and trained specifically for their work (e.g. specific training courses or instructions, short videos, etc.)."
























Objective: The orderly and defined handling of instructions with regard to the processing of the controller is intended to ensure that the tasks of the processor are fulfilled, and that the processor fulfils the planned and contractually agreed obligations (in particular also to determine a possible exceeding of the contractually agreed framework).
Requirements (must): The instructions by the controller regarding the processing of personal data are handled.
Procedures and measures are in place to ensure that:
- Received instructions are documented
- Instructions can be implemented (e.g. procedures for correcting, deleting, ...)
- Data is separated by client and specific order or project








Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
