At the beginning of the project, all processes and the information security assets used in them were recorded for the asset inventory, and a risk assessment was conducted together with the department heads. At the same time, key users were defined who will be responsible for the TISAX requirements in their respective departments in the future. To get an idea of the current state of information security in the Willi Elbe Group, these key users were interviewed, followed by a GAP analysis based on the VDA-ISA catalog. Based on the analyses carried out up to this point, initial measures were defined, from which the tasks of the key users and departments were derived.

During this time, it is important to familiarize employees with the topic of information security and its significance for the company. However, to sharpen the awareness not only of the key users but of the entire workforce, mandatory online training sessions were introduced for all employees via the SoSafe platform. These explain how information security is ensured in everyday work and how to deal with threats such as phishing.

Coordinating the seven locations presented a particular challenge. With an Information Security Management System (ISMS) based on the Q.wiki software from Modell Aachen GmbH, we ensured that all policies and documents regarding TISAX are centrally accessible to all employees. Information security assets, risks, and measures were also included in this system and linked to each other. This clear management significantly facilitates maintenance in the future compared to extensive Excel lists. Even the approval process for all documents is stored in the ISMS, so that with the help of role assignment, the page responsible persons, the ISO, and finally the management can review the content and publish it company-wide. To be able to implement the guidelines at each location, the ISMS was built in English. For employees who do not speak English, selected documents were translated into the respective national language, which in the case of the Willi Elbe Group means five additional languages. It quickly became clear that in addition to the centrally acting Information Security Officer (ISO), a Local Information Security Officer (LISO) is needed per location, who is responsible for knowledge exchange and the implementation of necessary measures, and who is accountable for compliance with information security in the individual plants. Suitable employees were selected from the management level for this purpose, for whom a special training concept was developed.

To prepare the Willi Elbe Group for the TISAX audit, internal audits were previously conducted by the ISO and LISOs to check the status of previous implementations in terms of information security and, if necessary, define further measures to ensure that the requirements are met.

Finally, at the beginning of the year, the audit was conducted by TÜV Süd, which, thanks to the good cooperation of all employees and despite the challenges, led to an excellent result with full marks in maturity level and without any deviations. Looking to the future, it is important that despite successfully acquired TISAX labels, information security continues to be reviewed and improved in an iterative PDCA cycle. This is ensured in an annual internal audit, so that in three years’ time, the TISAX labels can be confirmed to the Willi Elbe Group without any deviations.