Where do you start on the road to TISAX when you have no information security policy yet? Start from the foundations before you open the VDA ISA catalogue: establish what the customer requires, understand which information you protect and where it is, then build a basic policy, assign accountability and implement further controls step by step. This checklist walks you through the first 10 steps.
Canonical definition: An information security management system (ISMS) is the set of policies, processes and controls with which an organisation manages the protection of the confidentiality, integrity and availability of its information in an orderly way – and which is the foundation of a TISAX assessment.
This article is for automotive companies that hear “you need TISAX” and do not yet have any formal information security. Instead of throwing you straight into the deep end of VDA ISA, it lays out an orderly path of first steps.
How to start TISAX – key takeaways:
- TISAX assesses information security maturity against the VDA ISA catalogue – but before you enter it, you need the foundations this article covers.
- The first step is not technology but establishing with the customer which label and assessment level it requires – that determines how far you must go.
- You cannot protect information you do not know about – inventorying your information and where it is stored is the foundation of everything else.
- A basic security policy, assigned accountability and employee awareness are the skeleton on which further controls are built.
- TISAX requires maturity backed by evidence – document what you implement from the start, because the assessor checks practice, not declarations.
- Patronusec guides automotive companies from scratch – from a first policy to TISAX assessment readiness.
Table of Contents
Why don’t you start from the VDA ISA catalogue?
You do not start from the VDA ISA catalogue because it is a maturity assessment tool, not a guide to building security from scratch. A company with no policy that opens VDA ISA as its first step sees hundreds of requirements without context or a foundation – and usually gets stuck. First you must build the basics that this catalogue will then assess.
VDA ISA (Information Security Assessment) is the catalogue against which TISAX scores your maturity. It assumes you already have some information security foundation – policies, processes, assigned accountability – and checks at what maturity level they operate. For a company that has this foundation, the catalogue is a map. For a company that does not, it is a wall.
The right order is the reverse of the intuitive one. Instead of “let’s read the requirements and tick them off”, the right approach is: “let’s build basic order in information security, then measure its maturity against VDA ISA”. The first steps do not require knowing the catalogue – they require understanding what you protect, why and who is responsible for it.
The VDA ISA catalogue is a thermometer, not a medicine – it measures a security maturity you must first acquire. A company without a policy that starts from the catalogue confuses measurement with construction.
Checklist: the first 10 steps to information security
The checklist below walks a company with no policy through the first 10 steps in an orderly sequence. Each step builds the foundation for the next – do not skip, because the order matters.
Establish the customer requirement. Ask the automotive customer directly: which TISAX label and which assessment level (Assessment Level) does it expect. This is the first step, because it determines how far you must go. The requirement is usually in the contract or communicated via the ENX platform.
Identify which information you protect. List the types of sensitive information you process: customers’ technical data, project documentation, prototypes, personal data. You cannot protect something you have not identified.
Map where that information is. Establish in which systems, on which devices and in which locations you store and process sensitive information. This is your map of the terrain to protect.
Appoint a person responsible for information security. Assign clear accountability – even in a small company, someone must own the topic, with the authority to make decisions. Without this, security remains nobody’s job.
Write a basic information security policy. Create a concise, leadership-approved document defining how the company protects information: access rules, data handling, incident reporting. It is the foundation the rest refers back to.
Order your access control. Establish who has access to which information, and introduce the principle of least necessary access. Remove unnecessary access, ensure unique accounts and strong authentication.
Ensure basic technical hygiene. Introduce software updates, backups, device protection and encryption of sensitive data. This is the technical minimum the assessor will check.
Train your employees. Build basic awareness: how to recognise phishing, how to handle data, how and to whom to report incidents. People are the first line of defence, and their awareness is a requirement assessed in TISAX.
Introduce an incident reporting and handling process. Establish what an employee should do when they suspect an incident, who handles it and how it is documented. Even a simple, working process is better than none.
Document everything from the start. From the first step, record what you implement and how it works. TISAX requires maturity backed by evidence – documentation created as you go is far easier than one reconstructed before the audit.
After completing this checklist, you have a foundation on which you can reliably measure maturity against VDA ISA and plan the further road to the required level.
How do these steps connect to TISAX requirements?
The above steps connect to TISAX directly, because they address the fundamental areas the VDA ISA catalogue assesses: governance and accountability, information and access management, employee awareness and incident handling. By building them from scratch, you simultaneously build the maturity foundation TISAX then scores.
How the checklist maps to the assessment areas:
- Steps 4-5 (accountability and policy) build the governance foundation – a core area assessed in every TISAX audit.
- Steps 2-3, 6 (identification, mapping, access) are the basis of information management and access control.
- Steps 7 (technical hygiene) and 9 (incidents) address the requirements of operational security and response.
- Step 8 (awareness) directly addresses the employee training and awareness requirement.
- Step 10 (documentation) prepares you for a key element of the assessment: evidence that the practice genuinely works.
The last sentence is key. TISAX requires relevant requirements to reach maturity level 3 or higher, backed by real evidence – a policy without evidence of implementation is not enough. That is why documenting from the first step (step 10) is not a formality but an investment: it turns your daily practice into the evidence the assessor will look for.
This approach also protects against the most common trap for companies starting from scratch: building “paper” security that exists in documents but not in practice. The checklist deliberately mixes documents (policy, process) with genuine action (access, hygiene, training), because TISAX checks both.
Patronusec Insight: In our project experience, companies starting from scratch most often make one of two opposite mistakes. Either they get stuck trying to tackle the whole VDA ISA catalogue at once without a foundation, or they quickly build “paper” policies with no cover in genuine practice – and fail the audit on a lack of evidence. The right path is in the middle: order the foundation in a logical sequence, implement genuinely and document as you go. We recommend treating the first steps as building the organisation’s habits, not as producing documents – because it is habits, not paper, that pass the audit.
How to plan the road from first steps to a TISAX assessment?
You plan the road from first steps to a TISAX assessment in stages: first the foundation from the checklist, then measuring maturity against VDA ISA, then closing gaps to the required level, and finally the audit. The pace depends on the starting point and the required assessment level.
The recommended stage sequence:
- Foundation (the 10-step checklist). Build basic order in information security before entering the catalogue.
- Measurement (the VDA ISA self-assessment). Measure the foundation’s maturity against VDA ISA 6.0 and identify gaps to the required level.
- Closing gaps (remediation). Raise maturity where it falls short of level 3 on MUST requirements, ensuring real evidence of implementation.
- Registration and audit. Register on the ENX platform, choose an accredited audit provider and go through the assessment at the required level (AL2 or AL3).
- Exchange and maintenance. Share the result with selected partners and maintain maturity – the label is valid for 3 years.
A realistic expectation about pace: a company starting completely from scratch needs time to build the foundation before an assessment makes sense. Trying to speed up by skipping the foundation usually ends in “paper” security that does not pass the audit. It is better to plan the road with real time to spare, especially when the customer requires a higher level (AL3).
Patronusec guides automotive companies through this whole road within its TISAX service – from a first policy, through building the foundation and measuring maturity, to audit readiness and passing it.
FAQ – How to start TISAX
Do I need an ISMS before I start TISAX?
You do not need a finished, formal system at the outset, but you do need an information security foundation TISAX will assess: policies, assigned accountability, access control and awareness. A company completely without these basics builds them first (the checklist in this article) and only then measures maturity against VDA ISA. The foundation is a condition for a meaningful assessment.
Where exactly do I start when I have no policy?
From establishing the customer requirement (which label and assessment level) and from understanding which information you protect and where it is. These are the first three checklist steps. Only on this basis does writing a policy and implementing controls make sense. Starting from documents without understanding what and where you protect leads to “paper” security.
Can a small company without an IT department manage TISAX?
Yes, though it usually needs support. TISAX does not require a large IT department but genuine, mature information security matched to the company’s scale. Small companies successfully obtain labels – the key is ordering the foundation in a logical sequence and genuine implementation, not the size of the team. An advisor helps translate the requirements to the company’s scale.
How long does preparation from scratch take?
It depends on the starting point and the required assessment level. A company completely without a policy needs time to build the foundation (the checklist) before an assessment makes sense – trying to skip this stage usually ends in a failed audit. A higher level (AL3) requires more preparation than AL2. It is worth planning with real time to spare, not under the pressure of the customer’s nearest deadline.
Is a policy alone enough to pass TISAX?
No. TISAX requires maturity level 3 on relevant MUST requirements, backed by real evidence that the practice is applied. A policy document without evidence of implementation will not pass – the assessor checks genuine operation, not declarations. That is why the checklist mixes documents with genuine action and recommends documenting the practice from the first step.
How does Patronusec help a company starting from scratch?
We guide you through the whole road: from establishing the customer requirement and building a first policy, through ordering the foundation in a logical sequence, to measuring maturity against VDA ISA and preparing for the audit. We help you avoid both common traps – getting stuck in the catalogue and building “paper” security. After a free call we present a realistic plan.
Receommended reading
A reading path for starting your information security journey in automotive:
- TISAX – top 5 things to do and 5 to avoid – the next step: how to pass the certification itself once you have a foundation.
- NIS2 – cybersecurity risk management – a related regime that may cover automotive suppliers.
- How to prepare a good phishing simulation – practically building employee awareness (checklist step 8).
Starting information security and TISAX – free consultation
Patronusec guides automotive companies from scratch – from a first information security policy to TISAX assessment readiness. Book a free consultation to establish where to start in your specific situation and which assessment level your customer requires.
