At the beginning of the project, together with the department heads, all processes and the information security assets used were recorded for the asset inventory and a risk assessment was carried out. At the same time, key users were defined who would be responsible for the TISAX requirements in the respective departments in future. In order to get an idea of the current status of information security within the Willi Elbe Group, they were interviewed, which was followed by a GAP analysis based on the VDA-ISA catalogue. The analyses carried out up to this point were used to define initial measures, from which the tasks of the key users and departments could be defined.

During this time, it is important to familiarise employees with the topic of information security and its importance for the company. To raise awareness not only among the key users, but also across the entire workforce, mandatory online training courses were implemented for all employees via the SoSafe platform. These courses explain how to ensure information security in everyday working life and how to deal with threats such as phishing.

The coordination of the seven locations was a particular challenge. With an Information Security Management System (ISMS) based on the Q.wiki software from Modell Aachen GmbH, we ensured that all TISAX-related policies and documents are centrally accessible to all employees. The information security assets, risks and measures are also integrated in this system and linked to one another. This clearly organized administration simplifies future maintenance compared to extensive Excel lists. Even the approval process for all documents is embedded in the ISMS so that the document owners, the ISO and finally the management can review the content and publish it company-wide by using a role assignment. To be able to implement the guidelines at each site, the ISMS was set up in English. For employees who do not speak English, selected documents were translated into their respective native languages, which, in the case of the Willi Elbe Group, meant five additional languages. t quickly became essential that, in addition to the central Information Security Officer (ISO), a Local Information Security Officer (LISO) was needed at each site to ensure the exchange of knowledge and implementation of the necessary measures. In addition, the LISO is responsible for ensuring compliance with information security at the individual plants. For this purpose, suitable employees were selected by the management level, for whom a special training concept was developed.

To prepare the Willi Elbe Group for the TISAX audit, internal audits were previously carried out by the ISO and the LISOs to assess the status of previous implementations regarding information security and, if necessary, to define further measures to meet the requirements.

Eventually, the audit by the TÜV Süd took place in the beginning of the year, which, thanks to the good cooperation of all employees and despite the challenges, led to an excellent result with a full score in the maturity level and no non-conformities. Looking ahead, it is important that, despite successfully acquiring the TISAX label, information security is continuously reviewed and improved in an iterative PDCA cycle. This is ensured by an annual internal audit so that in three years the TISAX labels can be confirmed to the Willi Elbe Group without any non-conformities.