Journey to TISAX: Learn about the key differences between Assessment Level 2 (AL2) and Assessment Level 3 (AL3)!

Understanding TISAX Assessment Levels

Before we get into the differences between the assessment levels, let's briefly explain what each assessment level covers.

• TISAX - Assessment Level 2 (AL2): This level refers to a "basic protection" assessment. It focuses on basic cyber/information security measures and is appropriate for organizations that want to establish a basic level of security. AL2 is often considered the starting point for compliance with the cyber/information security requirements set forth by TISAX.
• TISAX - Assessment Level 3 (AL3): This level refers to an "enhanced protection" assessment. It goes beyond the basics and includes more comprehensive cyber/information security measures. AL3 is typically chosen or required by organizations that have higher data sensitivity and want stronger protection.

Key differences between AL2 and AL3

1. Scope of Assessment

• The assessment in AL2 primarily covers essential cyber/information security practices. It focuses on areas such as information security management, incident management, and basic technical security measures.
• An AL3 assessment is more extensive. It covers a broader range of cyber/information security practices, including advanced technical security measures, vendor relationships, and more rigorous incident management processes.

2. Rigor of Requirements

• AL2 covers a basic level of cyber/information security requirements. While important, these requirements are generally less stringent than those in AL3.
• AL3 requires organizations to meet higher cyber/information security standards. It includes more stringent controls and measures, making it more appropriate for organizations that handle particularly sensitive data or have a higher cyber/information security risk profile.

3. Provider expectations

• Organizations undergoing an AL2 assessment are expected to meet basic cyber/information security standards. For some suppliers or partners, this may be sufficient.
• Partners such as automakers (VW, BMW, FCA, etc.) often expect their counterparts to achieve an AL3 assessment, as this signifies a higher level of cybersecurity maturity and commitment to data protection.

4. Legal compliance

• An AL2 assessment helps organizations meet mandatory cyber/information security regulations, but it may not cover all the requirements of specific industry-specific or local regulations.
• An AL3 assessment is more likely to comply with and meet the stringent requirements of various regulations and provides a higher level of compliance assurance.

Select theSelect the right level for your organization

Determining the Assessment Level of your TISAX assessment depends on several factors, including the sensitivity of the data your organization processes, industry regulations, and risk tolerance. The following are some considerations for selecting an AL, If an Assessment Level is specified by a specific stakeholder, you must comply with their requirements.

• An AL2 assessment is a good starting point for organizations looking to establish a basic level of cyber/information security. It's ideal for vendors and partners who want to demonstrate their commitment to security.
• An AL3 assessment is the right choice if your organization handles highly sensitive data, operates in a highly regulated environment, or wants to adopt a robust cyber/information security posture. It provides assurance of a higher level of protection and compliance.

In conclusion...

TISAX assessments play an important role in enhancing cyber/information security within the automotive industry. By understanding the key differences between these assessment levels, organizations can make informed decisions about which level best suits their needs.

Ultimately, TISAX's goal is to promote a culture of cyber/information security excellence in the automotive industry, protect sensitive data, ensure regulatory compliance, and mitigate risk in an increasingly connected automotive environment. Whether you're starting at AL2 or aiming for AL3, your journey to a safer automotive industry starts with your choice to take a TISAX assessment.