Changes to TISAX Labels Accompanying ISA 6 Release

Together with ISA version 6 becoming effective, we will also implement some changes to TISAX Assessment Objectives and the respective TISAX Labels. This affects the existing “Info High” and “Info Very High” labels as well as the prototype protection labels. The changes for the “Info” labels follow the path already laid out in New TISAX labels for availability.

In the beginning of 2023, ENX has introduced new labels for availability to TISAX. This was the beginning of a split of the “Info” (“Info High” and “Info Very High”) labels. We have made that split to acknowledge that the security requirement profile for providing production parts or key infrastructure for production is very different to handling customer’s trade secrets appropriately.

Since ISA 6 comes with additional requirements targeted to reduce availability risks and as such are targeted to those production parts and infrastructure providers, we will now conclude the split and introduce “Confidential” and “Strictly Confidential” as the logical addition to the already existing “availability” labels.

Before we get into the details, we will make a short excursion to the transition. Since the changes are closely related to the ISA 6 release, we have also set April 1st 2024 as the effective date for the new labels. This is perfectly in line with the release of ISA version 6. The rules for the transition defined around that effective date are the same as in previous changes:

1. Locations that already have a “Info High” or “Info Very High” label will automatically get the Confidential and for very high also Strictly Confidential label as additional labels. The original “Info High” and “Info Very High” label will stay valid. No further action is necessary.
2. New TISAX Assessment Proceedings ordered before April 1st 2024 will still be conducted using the “Info” TISAX Assessment Objectives. Once the assessment becomes eligible for TISAX Labels, all locations will automatically get the Confidential and for very high also strictly confidential label as additional labels.
3. New TISAX Assessment Proceedings ordered after April 1st, 2024, can no longer use the “Info High” or “Info Very High” TISAX Assessment Objective. All remaining “Info High” and “Info Very High” objectives in already registered TISAX Scopes will automatically be converted to “confidential” and “high availability” or “strictly confidential” and “very high availability” respectively. If you only need one of the two TISAX labels, let your audit provider know and he will remove the unnecessary TISAX Assessment Objectives.
4. Assessment activities related to an existing assessment such as corrective action plan assessments, follow-ups or scope extensions will remain unaffected they will be conducted using the same Assessment Objectives as the original assessment.
5. If you think the new labels fit better to your organization and needs, you may be able to optionally switch to the new labels for assessment activities executed after April 1st, 2024. To find out if a switch is possible and what conditions apply, please get in touch with your audit provider.

In contrast to the availability labels, that are designed for production parts suppliers and infrastructure providers that we need to keep our industry’s production running, confidentiality labels are designed for those suppliers, that handle our trade secrets that keep our industry competitive.

ISA 6 adds significant additional requirements to keep the supply chain and the necessary underlying infrastructure reliable and secure. Fulfilling some of those requirements requires significant resources. Committing those resources is appropriate if the impact of an outage is having a high impact up in the supply chain.

However, in many cases trade secrets are shared outside of an environment where such a level of availability is needed. This is why we need a differentiation between companies that are necessary to keep production running and companies that protect trade secrets. This allows us to target requirements that lead to keep the production running to production parts suppliers and target requirements that keep trade secrets secure to companies that handle trade secrets. Splitting the Info Labels into Confidentiality and Availability does exactly this.

The first step of the change was already implemented at the beginning of 2023. We are now taking the second step of the split. The new confidentiality labels follow the same logic as the availability labels and cover a subset of the requirements of the old “Info” labels.

As the “Info” and availability labels, the confidentiality labels do refer to the “Information Security” tab of ISA and include all baseline requirements (“must” and “should”). In this regard, all these labels are 100% identical, these baseline requirements are always applicable for any of the confidentiality and availability TISAX Labels.

On top of that, the confidentiality labels include all additional requirements (for high and very high protection need) that are tagged with the letter “C” for confidentiality. This is fully analogue to the availability labels, that require the letter “A” for availability.

If we take the new ISA 6 control 1.6.3 as an example, all additional requirements (high and very high) are tagged with an “A” only. Since the tag does not contain a C these requirements are not applicable for confidentiality. This means, if you only select “Confidential” TISAX Assessment Objective, the auditor will not document any non-conformities regarding those requirements.

A different example is control 4.2.1, where the requirement is tagged with “C”, “I”, and “A”. Since this tag includes a “C”, these requirements are applicable for an assessment that includes confidentiality.

We want to keep TISAX as simple as possible. Every TISAX Assessment Objective and every TISAX Label is one more thing that a participant needs to understand. This is why we try to keep the number of TISAX Labels to a minimum. With confidentiality and availability combined being identical to the Info labels, retiring the label is possible without any drawbacks. Accordingly, we have decided to retire the Info TISAX Assessment Objectives.

You might have already noticed that the introduction of new and retirement of the old labels will not introduce additional assessment efforts.

In fact, an assessment according to “Info Very High” would have been 100% identical to an assessment that combines both “Strictly Confidential” and “Very High Availability”.

If any confidentiality or availability labels are used without their respective counterparts, the number of requirements to be assessed effectively decrease which will lead to slightly less assessment effort.