TISAX Corrective Actions: A Post-Assessment Guide
A TISAX assessment can leave your organisation with clear findings but uncertainty about what happens next. Effective TISAX corrective actions need clear ownership, realistic deadlines and evidence that security measures work.
Buyers may refer to “TISAX certification”, but the scheme provides assessment results and labels, not an ISO-style certificate. For original equipment manufacturers (OEMs) in the automotive industry, unresolved findings can delay labels and affect assurance across the supply chain.
A structured response helps your team address the underlying weakness and demonstrate improvement. Start by confirming what the assessor found, then connect each finding to a verifiable outcome. Share assessment results with relevant participants through the ENX platform where appropriate.
Confirm the findings and assessment scope
Before assigning work, review the assessment report with your audit provider. Confirm the reported non conformities, their classification, the applicable VDA ISA requirements, and affected locations or processes.
Separate major and minor non-conformities from observations or improvement recommendations. Assessment levels and maturity level describe assessment outcomes, not finding severity. Don't treat every comment as an identical remediation task. If wording is unclear, ask which requirement wasn't met and what evidence supports the conclusion.
Check the scope carefully. An access-control finding at one location may expose the same weakness elsewhere. Compare findings with existing security measures in a focused gap analysis, covering affected systems, departments and sites within scope.
TISAX provides assessment results and labels rather than an ISO-style certificate. Relevant participant or result information may appear on the ENX platform, but it doesn't change the provider's assessment decision. AKRUP's guide to TISAX and automotive information security explains the wider framework.
The post-assessment stages can include a corrective action plan assessment and a follow-up assessment. Use your prior self assessment as supporting context for the external assessment, not a replacement. Agree the appropriate route with your provider.
A practical workflow for TISAX corrective actions
Use one controlled register as part of your compliance process. A spreadsheet, service-management platform or governance tool can work, provided responsibilities and evidence remain traceable.
The following sequence is practical management guidance, rather than a prescribed ENX tracking format:
Record the finding exactly, including its identifier, classification and requirement reference.
Correct the detected instance where possible, then contain immediate exposure by applying security measures, such as disabling inappropriate access or restricting an unsecured area.
Investigate the root cause using records, interviews and process checks.
Assign corrective actions that address the cause, with accountable owners, implementation dates and expected evidence.
Implement lasting changes, including any necessary security measures, then test their effectiveness and prepare evidence for follow-up.
Correction fixes the detected instance, while containment limits immediate exposure. A corrective action addresses the cause to prevent recurrence. If a finding reveals an active incident or event, follow incident management procedures; this finding workflow doesn't replace incident response.
Don't wait for every root-cause investigation to finish before controlling an active security risk. Record temporary measures separately so they don't become mistaken for the permanent solution.
Build a corrective action plan the assessor can evaluate
A useful plan connects each finding to the relevant VDA ISA requirements, its cause and the proposed remedy. Broad commitments such as "improve security awareness" don't explain which security measures will change.
Include the formal plan contents
The ENX TISAX Participant Handbook describes the formal requirements for a corrective action plan. For each non-conformity, identify the finding, explain its root cause, define corrective actions and provide an implementation date for each action.
The root cause should explain why the control failed and what this reveals about its maturity level. "Human error" rarely provides enough detail to support a lasting remedy. Investigate whether responsibilities, triggers, resources or monitoring were missing.
Where several actions are necessary, give each its own date. Updating a procedure, configuring technical security measures and training staff may require different schedules.
Add fields that support delivery
As practical additions, record an accountable owner, affected scope, dependencies, interim controls, evidence references and an effectiveness check. These fields support delivery and link the register to your organisation's compliance process, but aren't all formal ENX plan-content requirements. Participant or assessment-result information may also be available through the ENX platform.
Use separate statuses for planned, implemented, internally verified and assessor-confirmed closure. This prevents a completed task from being confused with a closed finding.
An owner should have authority to deliver the change. Where IT, HR and operations share responsibilities, nominate one person to coordinate the complete response.
Set deadlines against the formal remediation window
ENX allows remediation schedules of up to nine months, subject to its timing rules. Three months isn't an absolute deadline for every finding.
The handbook sets different expectations for proposed implementation periods:
Implementation period | Supporting requirement |
|---|---|
Up to three months | No additional timing justification |
More than three, up to six months | Justification required |
More than six, up to nine months | Justification and evidence required |
More than nine months | Not permitted |
A longer schedule needs a credible explanation. If dependencies affect security measures, document specific reasons and dates, such as procurement lead times, site modifications or technical dependencies, rather than citing general resource constraints.
The overall remediation window runs from the initial assessment's closing meeting. Your internal project start date doesn't reset it.
Leave time for evidence collection, internal verification and the provider's follow-up work. An implementation date at the end of the available window leaves little room for corrections.
ENX's TISAX and NIS2 guidance confirms that unresolved deviations after nine months mean the assessment has failed and must be repeated in full. Escalate blocked actions early.
Write actions that address the control failure
Strong action plans state what will change, who owns it, when it will happen and how your organisation will demonstrate the result. The examples below show practical responses to access and supplier-security findings, without assuming either applies to your organisation.
Access removal and employee offboarding
For an offboarding finding, establish the cause before proposing additional training. Examine how HR communicates departures, how IT receives instructions and who checks completion.
A strong action could read: "The HR manager and IT manager will implement an approved offboarding workflow by [date]. It will cover directory accounts, applications, remote access and physical passes. These security measures will ensure access is removed promptly after departure. The IT manager will reconcile leavers against active access and retain completion records."
Evidence should include the updated procedure, completed offboarding records, account-disable logs and reconciliation results. Set an approved implementation date for each task.
Test the next departures against the process. If none occur before follow-up, discuss suitable test evidence with the assessor.
Supplier security and due diligence
For incomplete supplier reviews, establish which suppliers handle sensitive information and why the review process failed. In the automotive industry, tier suppliers and other providers may handle different information and present different levels of risk.
A strong action could read: "By [date], the procurement manager will complete a risk assessment of suppliers handling sensitive information. As part of third party risk management, the manager will prioritise outstanding reviews, record exceptions and apply documented security measures to new and existing suppliers. The information security lead will review exceptions and set a recurring review schedule by [date], aligned with relevant VDA ISA requirements where applicable."
Support this with the supplier register, completed assessments, contractual requirements and documented exception decisions. Check that purchasing staff apply the process to new suppliers as well as existing ones.
Assemble evidence that demonstrates implementation
Evidence should show that the action and related security measures were implemented across the affected scope, including any prototype protection controls. A policy or revised document may explain the control, but alone it does not demonstrate operation. Operational records show whether security measures are in use.
Match evidence to the finding
For access control, combine approved procedures with access reviews, change records and relevant system logs. For employee awareness, retain training content, attendance records and checks of understanding.
Evidence for prototype protection may include zoning plans, access authorisations, visitor records and records of physical controls across affected areas. Data protection findings may require processing records, contractual updates or implemented retention controls.
Select evidence against the actual finding and applicable VDA ISA requirements. Avoid collecting a generic bundle that leaves the assessor to identify what matters.
Make the evidence traceable
Reference each item against the finding and action it supports, and identify the affected areas for prototype protection. Retain dates, versions, approvals and the location or system covered.
A screenshot without context may show a setting but leave its scope unclear. Accompany it with an explanation of the system, capture date and relevant configuration.
Protect customer information, personal data and credentials when sharing evidence. Agree an appropriate transfer method with your assessment provider.
Prepare for follow-up and maintain the improvement
Before requesting follow-up, review every action against the original finding. Confirm implementation is complete, security measures are in place, evidence is ready for the external assessment and affected staff understand the revised process. Keep finding classification distinct from assessment levels and your organisation's maturity level.
The ENX TISAX FAQs explain that assessment of a corrective action plan is optional. Agree the route with your assessment provider: organisations that don't need a temporary label can proceed directly to follow-up if they can implement actions without prior plan approval. Participants can share assessment results through the ENX platform.
A temporary TISAX label may be available following an overall minor non-conformity result and an appropriately assessed plan. It expires nine months after the initial closing meeting and can't be renewed. Customer acceptance isn't automatic, so confirm contractual requirements with customers.
After closure, use continuous monitoring and internal audit to check security measures remain effective throughout a regular TISAX label's maximum three-year validity. Training and regular reviews help sustain cybersecurity capabilities across the automotive industry. Check participant information and label availability on the ENX platform where applicable.
AKRUP's Rudolph & Hellmann case study describes a 12-month preparation programme that achieved AL3 labels across two UK locations. The work involved IT, HR, operations and management, illustrating the cross-functional coordination needed for sustainable controls.
Key takeaways for assessment-response teams
Confirm classifications, requirement references and affected scope before allocating actions.
Address root causes, with separate measures for immediate risk containment.
Apply ENX's timing rules and leave capacity for verification and follow-up.
Keep evidence traceable to individual findings, showing that implemented security measures work across the affected scope.
Maintain revised controls through normal business processes after closure.
Frequently asked questions
Can ISO 27001 corrective actions cover TISAX findings?
An existing information security management system can support tracking, root-cause analysis and review. However, each response must address the applicable VDA ISA requirements and TISAX scope, with evidence that the relevant security measures have been implemented. ISO 27001 certification alone doesn't demonstrate that a TISAX non-conformity is resolved.
Does an approved action plan close a finding?
Plan approval establishes that the proposed response is appropriate, but closure requires implementation and verification through follow-up assessment. Keep internal task completion separate from the assessor's closure decision. Use the ENX platform to access or share assessment results as required, and confirm any outstanding evidence requirements before arranging follow-up.
Make corrective actions part of normal security management
Effective TISAX corrective actions give your organisation a clear route to verified improvement. The strongest response combines root-cause analysis, accountable delivery and evidence that revised controls work.
Keep findings open internally until they are formally resolved. Once verified, maintain the revised security measures through your normal compliance process.
If you would like to find out more information or require any of our services please Contact Us and complete the contact form.
Comments