At the beginning of the project, all processes and the information security assets used in them were recorded for the asset inventory together with the department heads, and a risk assessment was carried out. At the same time, key users were defined who will be responsible for the TISAX requirements in their respective departments in the future. To get an idea of the current state of information security in the Willi Elbe Group, these key users were interviewed, followed by a GAP analysis based on the VDA ISA catalog. Based on the analyses conducted up to this point, initial measures were defined, from which the tasks of the key users and departments were derived.

During this time, it is important to familiarize employees with the topic of information security and its significance for the company. However, to sharpen not only the awareness of key users but that of the entire workforce, mandatory online training sessions were introduced via the SoSafe platform for all employees. These explain how information security is ensured in daily work and how to deal with threats such as phishing.

A particular challenge was the coordination of the seven locations. With an Information Security Management System (ISMS) based on the Q.wiki software from Modell Aachen GmbH, we ensured that all guidelines and documents regarding TISAX are centrally accessible to all employees. Information security assets, risks, and measures were also incorporated into this system and linked to each other. This clear management significantly facilitates maintenance in the future compared to extensive Excel lists. Even the approval process for all documents is stored in the ISMS, so that with the help of role assignment, the page administrators, the ISO, and finally the management can review the content and publish it company-wide. To implement the guidelines at each location, the ISMS was built in English. For employees who do not speak English, selected documents were translated into the respective national language, which in the case of the Willi Elbe Group means five additional languages. It quickly became clear that in addition to the centrally acting Information Security Officer (ISO), a Local Information Security Officer (LISO) is needed for each location, who is responsible for knowledge exchange and implementation of necessary measures, and is accountable for compliance with information security in the individual plants. Suitable employees were selected from the management level for this purpose, for whom a special training concept was developed.

To prepare the Willi Elbe Group for the TISAX audit, internal audits were previously conducted by the ISO and LISOs to check the status of previous implementations in terms of information security and, if necessary, define further measures to ensure that the requirements are met.

Finally, at the beginning of the year, the audit by TÜV Süd took place, which, thanks to the good cooperation of all employees and despite the challenges, led to an excellent result with a full score in maturity level and without deviations. Looking to the future, it is important that despite successfully acquired TISAX labels, information security is continuously reviewed and improved in an iterative PDCA cycle. This is ensured in an annual internal audit, so that in three years’ time, the TISAX labels can be confirmed to the Willi Elbe Group without deviations.