urn: urn:intuitem:risk:library:tisax-v5.1
locale: en
ref_id: TISAX v5.1
name: 'Trusted Information Security Assessment Exchange    '
description: 'VDA ISA provides the basis for

  - a self-assessment to determine the state of information security in an organization
  (e.g. company)

  - audits performed by internal departments (e.g. Internal Audit, Information Security)

  - a review in accordance with TISAX (Trusted Information Security Assessment Exchange,
  http://enx.com/tisax/)

  Source: https://portal.enx.com/isa5-en.xlsx

  '
copyright: "Publisher: VERBAND DER AUTOMOBILINDUSTRIE e.\_V. (VDA, German Association\
  \ of the Automotive Industry); Behrenstr.\_35; 10117\_Berlin; www.vda.de\n\xA9 2022\
  \ Verband der Automobilindustrie e.V., Berlin\nThis work has been licensed under\
  \ Creative Commons Attribution - No Derivative Works 4.0 International Public License.\
  \ In addition, You are granted the right to distribute derivatives under certain\
  \ terms."
version: 1
publication_date: 2024-06-18
provider: VDA
packager: intuitem
objects:
  framework:
    urn: urn:intuitem:risk:framework:tisax-v5.1
    ref_id: TISAX v5.1
    name: Trusted Information Security Assessment Exchange
    description: 'VDA ISA provides the basis for

      - a self-assessment to determine the state of information security in an organization
      (e.g. company)

      - audits performed by internal departments (e.g. Internal Audit, Information
      Security)

      - a review in accordance with TISAX (Trusted Information Security Assessment
      Exchange, http://enx.com/tisax/)

      Source: https://portal.enx.com/isa5-en.xlsx

      '
    min_score: 0
    max_score: 5
    scores_definition:
    - score: 0
      name: Incomplete
      description: A process is not available, not followed or not suitable for achieving
        the objective.
    - score: 1
      name: Performed
      description: An undocumented or incompletely documented process is followed
        and indicators exist that it achieves its objective.
    - score: 2
      name: Managed
      description: A process achieving its objectives is followed. Process documentation
        and process implementation evidence are available.
    - score: 3
      name: Established
      description: A standard process integrated into the overall system is followed.
        Dependencies on other processes are documented and suitable interfaces are
        created. Evidence exists that the process has been used sustainably and actively
        over an extended period.
    - score: 4
      name: Predictable
      description: An established process is followed. The effectiveness of the process
        is continually monitored by collecting key figures. Limit values are defined
        at which the process is considered to be insufficiently effective and requires
        adjustment. (Key Performance Indicators)
    - score: 5
      name: Optimizing
      description: A predictable process with continual improvement as a major objective
        is followed. Improvement is actively advanced by dedicated resources.
    implementation_groups_definition:
    - ref_id: must
      name: Requirements (must)
      description: Strict requirements without any exemptions.
    - ref_id: should
      name: Requirements (should)
      description: Must be implemented by the organization. In certain circumstances,
        however, there may be a valid justification for non-compliance with these
        requirements. In case of any deviation, its effects must be understood by
        the organization and it must be plausibly justified.
    - ref_id: high
      name: In case of high protection needs
      description: Must additionally be met if the tested subject has high protection
        needs.
    - ref_id: very_high
      name: In case of very high protection needs
      description: Must additionally be met if the tested subject has very high protection
        needs.
    - ref_id: SGA
      name: For Simplified Group Assessments (SGA)
      description: A simplified way to audit very large organizations with a high
        maturity. An example is the TISAX Simplified Group Assessment mechanism that
        is an option for TISAX Assessments of an assessment scope with a large number
        of sites.
    - ref_id: vehicle
      name: For vehicles classified as requiring protection
      description: Protects physical prototypes which are classified as requiring
        protection. Prototypes include vehicles, components and parts. The owner of
        the intellectual property for the prototype is considered the owner of the
        prototype. The owner's commissioning department is responsible for classifying
        the protection need of a prototype. For prototypes classified as requiring
        high or very high protection, the minimum requirements for prototype protection
        must be applied.
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1
      assessable: false
      depth: 1
      ref_id: '1'
      name: IS Policies and Organization
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1
      ref_id: '1.1'
      description: Information Security Policies
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.1.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.1
      ref_id: 1.1.1
      description: To what extent are information security policies available?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.1.1
      name: (must)
      description: "+ The requirements for information security have been determined\
        \ and documented:\n  - The requirements are adapted to the organization\u2019\
        s goals,\n  - A policy is prepared and is released by the organization.\n\
        + The policy includes objectives and the significance of information security\
        \ within the organization."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node6
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.1.1
      name: (should)
      description: "+ The information security requirements based on the strategy\
        \ of the organization, legislation and contracts are taken into account in\
        \ the policy.\n+ The policy indicates consequences in case of non-conformance.\
        \ \n+ Further relevant information security policies are prepared.\n+ Periodic\
        \ review and, if required, revision of the policies are established.\n+ The\
        \ policies are made available to employees in a suitable form (e.g. intranet).\n\
        + These policies (or extracts thereof) are provided to external business partners\
        \ depending on the respective case.\n+ Employees and external business partners\
        \ are informed of any changes relevant to them."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1
      ref_id: '1.2'
      description: Organization of Information Security
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2
      ref_id: 1.2.1
      description: To what extent is information security managed within the organization?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node9
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.1
      name: (must)
      description: "+ The scope of the ISMS (the organization managed by the ISMS)\
        \ is defined.\n+ The organization's requirements for the ISMS are determined.\n\
        + The organizational management has commissioned and approved the ISMS.\n\
        + The ISMS provides the organizational management with suitable monitoring\
        \ and control means (e.g. management review).\n+ Applicable controls have\
        \ been determined (e.g. ISO\_27001 Statement of Applicability, completed VDA\
        \ ISA catalog).\n+ The effectiveness of the ISMS is regularly reviewed by\
        \ the management."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2
      ref_id: 1.2.2
      description: To what extent are information security responsibilities organized?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node11
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.2
      name: (must)
      description: '+ Responsibilities for information security within the organization
        are defined, documented and assigned.

        + The responsible employees are defined and qualified for their task.

        + The required resources are available.

        + The contact persons are known within the organization and to relevant business
        partners.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node12
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.2
      name: (should)
      description: + There is a definition and documentation of an adequate information
        security structure within the organization.
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node13
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.2
      name: (for high protection needs)
      description: + An appropriate organizational separation of responsibilities
        should be established in order to avoid conflict of interests (separation
        of duties). (C, I, A)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2
      ref_id: 1.2.3
      description: To what extent are information security requirements taken into
        account in projects?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node15
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.3
      name: (must)
      description: + Projects are classified while taking into account the information
        security requirements.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node16
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.3
      name: (should)
      description: '+ The procedure and criteria for the classification of projects
        are documented.

        + During an early stage of the project, risk assessment is conducted based
        on the defined procedure and repeated in case of changes to the project.

        + For identified information security risks, measures are derived and taken
        into account in the project.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node17
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.3
      name: (for high protection needs)
      description: + The measures thus derived are reviewed regularly during the project
        and reassessed in case of changes to the assessment criteria. (C, I, A)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2
      ref_id: 1.2.4
      description: To what extent are the responsibilities between external IT service
        providers and the own organization defined?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node19
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.4
      name: (must)
      description: '+ The concerned services and IT services used are identified.

        + The security requirements relevant to the IT service are determined:

        + The organization responsible for implementing the requirement is defined
        and aware of its responsibility.

        + Mechanisms for shared responsibilities are specified and implemented.

        + The responsible organization fulfils its respective responsibilities.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node20
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.4
      name: (should)
      description: '+ In case of IT services, configuration has been conceived, implemented
        and documented based on the necessary security requirements.

        + The responsible staff is adequately trained.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node21
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.2.4
      name: (for high protection needs)
      description: '+ A list exists indicating the concerned IT services and the respective
        responsible IT service providers. (C, I, A)

        + The applicability of the VDA ISA controls has been verified and documented.
        (C, I, A)

        + The service configuration is included in the regular security assessments.
        (C, I, A)

        + Proof is provided that the IT service providers fulfil their responsibility.
        (C, I, A)

        + Integration into local protective measures (such as secure authentication
        mechanisms) is established and documented. (C, I, A)'
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1
      ref_id: '1.3'
      description: Asset Management
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3
      ref_id: 1.3.1
      description: 'To what extent are information assets identified and recorded? '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node24
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.1
      name: (must)
      description: "+ The information assets being of relevance to the organization\
        \ are identified and recorded.\n  - A person responsible for these information\
        \ assets is assigned.\n+ The supporting assets processing the information\
        \ assets are identified and recorded:\n  - A person responsible for these\
        \ supporting assets is assigned."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node25
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.1
      name: (should)
      description: "+ A catalog of the relevant information assets exists:\n  - The\
        \ corresponding supporting assets are assigned to each relevant information\
        \ asset,\n  - The catalog is subject to regular review."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3
      ref_id: 1.3.2
      description: To what extent are information assets classified and managed in
        terms of their protection needs?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node27
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.2
      name: (must)
      description: "+ A consistent scheme for the classification of information assets\
        \ with regard to the protection goal of confidentiality is available.\n+ Evaluation\
        \ of the identified information assets is carried out according to the defined\
        \ criteria and assigned to the existing classification scheme. \n+ Specifications\
        \ for the handling of supporting assets (e.g. identification, correct handling,\
        \ transport, storage, return, deletion/disposal) depending on the classification\
        \ of information assets are in place and implemented."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node28
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.2
      name: (should)
      description: + The protection goals of integrity and availability are taken
        into consideration.
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3
      ref_id: 1.3.3
      description: "To what extent is it ensured that only evaluated and approved\
        \ external IT services are used for processing the organization\u2019s information\
        \ assets?"
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node30
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.3
      name: (must)
      description: "+ External IT services are not used without explicit assessment\
        \ and implementation of the information security requirements:\n  - A risk\
        \ assessment of the external IT services is available,\n  - Legal, regulatory\
        \ and contractual requirements are considered.\n+ The external IT services\
        \ have been harmonized with the protection need of the processed information\
        \ assets."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node31
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.3.3
      name: (should)
      description: '+ Requirements regarding the procurement, commissioning and release
        associated with the use of external IT services are determined and fulfilled.

        + A procedure for release in consideration of the protection need is established.

        + External IT services and their approval are documented.

        + It is verified at regular intervals that only approved external IT services
        are used.

        '
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1
      ref_id: '1.4'
      description: IS Risk Management
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.4.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.4
      ref_id: 1.4.1
      description: To what extent are information security risks managed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node34
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.4.1
      name: (must)
      description: '+ Risk assessments are carried out both at regular intervals and
        in response to events.

        + Information security risks are appropriately assessed (e.g. for probability
        of occurrence and potential damage).

        + Information security risks are documented.

        + A responsible person (risk owner) is assigned to each information security
        risk. This person is responsible for the assessment and handling of the information
        security risks.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node35
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.4.1
      name: (should)
      description: "+ A procedure is in place defining how to identify, assess and\
        \ address information security risks within the organization.\n+ Criteria\
        \ for the assessment and handling of information security risks exist.\n+\
        \ Measures for handling information security risks and the persons responsible\
        \ for these are specified and documented:\n  - A plan of measures or an overview\
        \ of their state of implementation exists.\n+ In case of changes to the environment\
        \ (e.g. organizational structure, location, changes to regulations), reassessment\
        \ is carried out in a timely manner."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1
      ref_id: '1.5'
      description: Assessments
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5
      ref_id: 1.5.1
      description: To what extent is compliance with information security ensured
        in procedures and processes?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node38
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5.1
      name: (must)
      description: '+ Observation of policies is verified throughout the organization.

        + Information security policies and procedures are reviewed at regular intervals.

        + Measures for correcting potential non-conformities (deviations) are initiated
        and pursued.

        + Compliance with information security requirements (e.g. technical specifications)
        is verified at regular intervals.

        + The results of the conducted reviews are recorded and retained.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node39
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5.1
      name: (should)
      description: + A plan for content and framework conditions (time schedule, scope,
        controls) of the reviews to be conducted is provided.
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5
      ref_id: 1.5.2
      description: To what extent is the ISMS reviewed by an independent authority?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node41
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5.2
      name: (must)
      description: '+ Information security reviews are carried out by an independent
        and competent body at regular intervals and in case of significant changes.

        + Measures for correcting potential deviations are initiated and pursued.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node42
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.5.2
      name: (should)
      description: + The results of conducted reviews are documented and reported
        to the management of the organization.
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.6
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1
      ref_id: '1.6'
      description: Incident Management
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:1.6.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.6
      ref_id: 1.6.1
      description: To what extent are information security events processed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node45
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.6.1
      name: (must)
      description: "+ A definition of information security events/vulnerabilities\
        \ exists.\n+ A procedure for reporting and recording information security\
        \ events/vulnerabilities is defined and implemented. \n+ The following aspects\
        \ are considered:\n  - Reaction to information security events/vulnerabilities\n\
        \  - Report form and channel\n  - Processing body\n  - Feedback procedure\n\
        \  - Indications regarding technical and organizational measures (e.g. disciplinary\
        \ action).\n+ Procedures for ensuring traceability in case of information\
        \ security events/vulnerabilities are established and documented.\n+ Information\
        \ security events/vulnerabilities are assessed and documented in order to\
        \ ensure traceability.\n+ An adequate reaction to information security events/vulnerabilities\
        \ is given.\n+ A strategy for an adequate reaction to events of information\
        \ security violations:\n  - This includes escalation procedures, remedial\
        \ actions and communication to relevant internal and external bodies as well\
        \ as a procedure for deciding whether a cybercriminal attack will be prosecuted. "
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node46
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.6.1
      name: (should)
      description: '+ Information security events/vulnerabilities (problem management)
        are analyzed.

        + Measures to prevent further occurrence of similar information security events
        are defined and implemented.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node47
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:1.6.1
      name: (for high protection needs)
      description: + Requirements resulting from business relations (e.g. obligations
        of reporting to customers) are determined and implemented. (C, I, A)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:2
      assessable: false
      depth: 1
      ref_id: '2'
      name: Human Resources
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2
      ref_id: 2.1.1
      description: To what extent is the qualification of employees for sensitive
        work fields ensured?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node50
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.1
      name: (must)
      description: '+ Sensitive work fields and jobs are determined.

        + The requirements for employees with respect to their job profiles are determined
        and fulfilled.

        + The identity of potential employees is verified (e.g. checking identity
        documents).'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node51
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.1
      name: (should)
      description: '+ The personal suitability of potential employees is verified
        by means of simple methods (e.g. job interview).

        + An extended suitability verification depending on the respective work field
        and job is conducted. (e.g. assessment center, psychological analysis, checking
        of references, certificates and diploma, checking of certificates of conduct,
        checking of professional and private background).'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2
      ref_id: 2.1.2
      description: To what extent is all staff contractually bound to comply with
        information security policies?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node53
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.2
      name: (must)
      description: '+ A non-disclosure obligation is in effect.

        + An obligation to comply with the information security policies is in effect.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node54
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.2
      name: (should)
      description: '+ A non-disclosure obligation beyond the employment contract or
        order is in effect.

        + Information security aspects are considered in the employment contracts
        of the staff.

        + A procedure for handling violations of said obligations is described.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2
      ref_id: 2.1.3
      description: To what extent is staff made aware of and trained with respect
        to the risks arising from the handling of information?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node56
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.3
      name: (must)
      description: + Employees are trained and made aware.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node57
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.3
      name: (should)
      description: "+ A concept for awareness and training of employees is prepared.\
        \ As a minimum, the following aspects are taken into account:\n  - Information\
        \ security policy,\n  - Reports of information security events,\n  - Reaction\
        \ to occurrence of malware,\n  - Policies regarding user accounts and login\
        \ information (e.g. password policy),\n  - Compliance issues of information\
        \ security,\n  - Requirements and procedures regarding the use of non-disclosure\
        \ agreements when sharing information requiring protection,\n  - Use of external\
        \ IT services.\n+ Target groups for training and awareness measures (e.g.\
        \ new employees, administrators, employees having access to customer networks)\
        \ are identified and taken into account in a training concept.\n+ The concept\
        \ has been approved by the responsible management.\n+ Training and awareness\
        \ measures are carried out both at regular intervals and in response to events.\n\
        + Participation in training and awareness measures is documented. \n+ Contact\
        \ persons for information security are known to employees."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2
      ref_id: 2.1.4
      description: To what extent is teleworking regulated?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node59
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.4
      name: (must)
      description: "+ The requirements for teleworking are determined and fulfilled.\
        \ The following aspects are considered:\n  - Secure handling of and access\
        \ to information (in both electronic and paper form) while considering the\
        \ protection needs and the contractual requirements applying to private (e.g.\
        \ home office) and public surroundings (e.g. during travels),\n  - Behavior\
        \ in private surroundings,\n  - Behavior in public surroundings,\n  - Measures\
        \ for protection from theft (e.g. in public surroundings),\n+ The organization\u2019\
        s network is accessed via a secured connection (e.g. VPN) and strong authentication."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node60
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.4
      name: (should)
      description: "+ The following aspects are considered:\n  - Measures for travelling\
        \ (e.g. viewing by authorities),\n  - Measures for travelling to security-critical\
        \ countries.\n+ Employee awareness."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node61
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.4
      name: (for high protection needs)
      description: + Protective measures against overhearing and viewing are implemented.
        (C)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node62
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:2.1.4
      name: Further information
      description: Contractual requirements include, for example, customer requirements
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:3
      assessable: false
      depth: 1
      ref_id: '3'
      name: Physical Security and Business Continuity
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3
      ref_id: 3.1.1
      description: To what extent are security zones managed to protect information
        assets?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node65
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.1
      name: (must)
      description: "+ A security zone concept including the associated protective\
        \ measures based on the requirements for the handling of information assets\
        \ is in place:\n  - Physical conditions (e.g. premises\_/ buildings\_/ spaces)\
        \ are taken into account in the definition of security zones,\n  - This also\
        \ includes delivery and shipping areas.\n+ The defined protective measures\
        \ are implemented.\n+ The code of conduct for security zones is known to all\
        \ persons involved."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node66
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.1
      name: (should)
      description: '+ Procedures for allocation and revocation of access rights are
        established.

        + Visitor management policies (including registration and escorting of visitors)
        are defined.

        + Policies for carrying along and using mobile IT devices and mobile data
        storage devices (e.g. registration before they are carried along, identification
        obligations) are defined and implemented.

        + Network/infrastructure components (own or customer networks) are protected
        against unauthorized access.

        + External properties used for storing and processing information assets are
        taken into account in the security zone concept (e.g. storage rooms, garages,
        workshops, test tracks, data processing centers).'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node67
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.1
      name: (for high protection needs)
      description: + Protective measures against simple overhearing and viewing are
        implemented. (C)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node68
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.1
      name: Further information
      description: "Focus point: Constructional and organizational measures\n+ Security\
        \ zone 1 (green): Area with constructional, technical or organizational or\
        \ staff-related security measures, not freely accessible, usually internal\
        \ scopes\n\n+ Security zone 2 (yellow): Area with additional protective measures,\
        \ protection of information assets with high protection needs, usually also\
        \ confidential scopes (e.g. development know-how)\n\n+ Security zone 3 (red):\
        \ Area of principally very high security requirements, protection of information\
        \ assets of very high protection needs, usually also strictly confidential\
        \ scopes (e.g. design)\n\nFocus point image recording devices\nArea\_1 (green):\
        \ Area with constructional, technical or organizational or personal security\
        \ measures, not freely accessible, usually internal scopes\n\nArea\_2 (yellow):\
        \ Area with additional protective measures, protection of information assets\
        \ with high protection needs, usually also confidential scopes (e.g. development\
        \ know-how)\n\nArea 3 (red): Area with principally very high security requirements,\
        \ protection of information assets with very high protection needs, usually\
        \ also strictly confidential scopes (e.g. design)"
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3
      ref_id: 3.1.2
      description: To what extent is information security ensured in exceptional situations?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node70
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.2
      name: (must)
      description: "+ Possible exceptional situations are identified and recorded.\n\
        + Potentially endangered infrastructure components (e.g. access points, IT\
        \ systems) are identified and recorded. \n+ Measures for limiting the impact\
        \ of threats are identified and implemented.\n+ For exceptional situations,\
        \ information security aspects are taken into consideration in methods, processes\
        \ and procedures."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node71
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.2
      name: (should)
      description: "+ Emergency plans are defined and reviewed regularly.\n+ Physical\
        \ security is generally maintained also in exceptional situations.\n+ IT services\
        \ are maintained also during exceptional situations\n  - Restoration of data\
        \ and applications by means of backup and redundancy concepts.\n+ Strategies\
        \ for avoiding permanent loss of information are defined.\n+ Adequate protective\
        \ measures (e.g. fire detection system, fire protection, water detector) are\
        \ implemented and regularly reviewed.\n+ A redundant supply for media (e.g.\
        \ electricity, communication connections) is provided.\n+ Consideration of\
        \ information security in Business Continuity Management.\n+ Information security\
        \ measures for events of crisis are tested regularly."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3
      ref_id: 3.1.3
      description: To what extent is the handling of supporting assets managed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node73
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.3
      name: (must)
      description: '+ The requirements for the handling of supporting assets (e.g.
        transport, storage, repair, loss, return, disposal) are determined and fulfilled. '
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node74
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.3
      name: (for high protection needs)
      description: "+ Supporting assets are protected. Disposal of supporting assets\
        \ is conducted in accordance with one of the relevant standards (e.g. ISO\_\
        21964, at least Security Level 4). (C)"
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3
      ref_id: 3.1.4
      description: To what extent is the handling of mobile IT devices and mobile
        data storage devices managed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node76
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.4
      name: (must)
      description: "+ The requirements for mobile IT devices and mobile data storage\
        \ devices are determined and fulfilled. The following aspects are considered:\
        \ \n  - Encryption,\n  - Access protection (e.g. PIN, password),\n  - Marking\
        \ (also considering requirements for use in the presence of customers)."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node77
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.4
      name: (should)
      description: '+ Registration of the IT devices.

        + Users are informed of missing data protection on mobile devices.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node78
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:3.1.4
      name: (for high protection needs)
      description: "+ General encryption of mobile data storage devices or the information\
        \ assets stored thereon: (C, I)\n  - Where this is technically not feasible,\
        \ information is protected by similarly effective measures."
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:4
      assessable: false
      depth: 1
      ref_id: '4'
      name: Identity and Access Management
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4
      ref_id: '4.1'
      description: Identity Management
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1
      ref_id: 4.1.1
      description: To what extent is the use of identification means managed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node82
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.1
      name: (must)
      description: "+ The requirements for the handling of identification means over\
        \ the entire lifecycle are determined and fulfilled. The following aspects\
        \ are considered:\n  - Creation, handover, return and destruction,\n  - Validity\
        \ periods,\n  - Traceability,\n  - Handling of loss."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node83
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.1
      name: (should)
      description: + Identification means can be produced under controlled conditions
        only.
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node84
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.1
      name: (for high protection needs)
      description: '+ The validity of identification means is limited to an appropriate
        period. (C, I, A)

        + A strategy of blocking or invalidation of identification means in case of
        loss is prepared and implemented as far as possible. (C, I, A)'
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1
      ref_id: 4.1.2
      description: To what extent is the user access to network services, IT systems
        and IT applications secured?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node86
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.2
      name: (must)
      description: '+ The procedures for user authentication have been selected based
        on a risk assessment. Possible attack scenarios have been considered (e.g.
        direct accessibility via the internet).

        + The procedures applied for user authentication comply with the current state
        of the art.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node87
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.2
      name: (should)
      description: "+ The user authentication procedures are defined and implemented\
        \ based on the business-related and security-relevant requirements:\n  - Users\
        \ are authenticated at least by means of strong passwords according to the\
        \ state of the art.\n+ Superior procedures are used for the authentication\
        \ of privileged user accounts (e.g. Privileged Access Management, two-factor\
        \ authentication)."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node88
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.2
      name: (for high protection needs)
      description: + Depending on the risk assessment, authentication procedure and
        access control have been enhanced by supplementary measures (e.g. permanent
        access monitoring with respect to irregularities or use of strong authentication,
        automatic logout or disabling in case of inactivity). (C, I, A)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node89
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.2
      name: (for very high protection needs)
      description: + Before gaining access to data of very high protection needs,
        users are authenticated by means of strong authentication (e.g. two-factor
        authentication) according to the state of the art. (C, I)
      implementation_groups:
      - very_high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1
      ref_id: 4.1.3
      description: 'To what extent are user accounts and login information securely
        managed and applied? '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node91
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.3
      name: (must)
      description: "+ The creating, changing and deleting of user accounts is conducted.\n\
        + Unique and personalized user accounts are used.\n+ The use of \u201Ccollective\
        \ accounts\u201D is regulated (e.g. restricted to cases where traceability\
        \ of actions is dispensable).\n+ User accounts are disabled immediately after\
        \ the user has resigned from or left the organization (e.g. upon termination\
        \ of the employment contract).\n+ User accounts are regularly reviewed.\n\
        + The login information is provided to the user in a secure manner.\n+ A policy\
        \ for the handling of login information is defined and implemented. The following\
        \ aspects are considered:\n  - No disclosure of login information to third\
        \ parties\n  - not even to persons of authority\n  - under observation of\
        \ legal parameters\n  - No writing down or unencrypted storing of login information\n\
        \  - Immediate changing of login information whenever potential compromising\
        \ is suspected\n  - No use of identical login information for business and\
        \ non-business purposes\n  - Changing of temporary or initial login information\
        \ following the 1st login   - Requirements for the quality of authentication\
        \ information (e.g. length of password, types of characters to be used).\n\
        + The login information (e.g. passwords) of a personalized user account must\
        \ be known to the assigned user only. "
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node92
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.1.3
      name: (should)
      description: '+ A basic user account with minimum access rights and functionalities
        is existent and used.

        + Default accounts and passwords pre-configured by manufacturers are disabled
        (e.g. by blocking or changing of password).

        + User accounts are created or authorized by the responsible body.

        + Creating user accounts is subject to an approval process (four-eyes principle).

        + User accounts of service providers are disabled upon completion of their
        task.

        + Deadlines for disabling and deleting user accounts are defined.

        + The use of default passwords is technically prevented.

        + Where strong authentication is applied, the use of the medium (e.g. ownership
        factor) is secure.

        + User accounts are reviewed at regular intervals. This also includes user
        accounts in customers'' IT systems.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:4.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4
      ref_id: '4.2'
      description: Access Management
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:4.2.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.2
      ref_id: 4.2.1
      description: To what extent are access rights assigned and managed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node95
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.2.1
      name: (must)
      description: "+ The requirements for the management of access rights (authorization)\
        \ are determined and fulfilled. The following aspects are considered:\n  -\
        \ Procedure for application, verification and approval,\n  - Application the\
        \ minimum (\u201Cneed-to-know\u201D) principle.\n+ The access rights granted\
        \ for normal and privileged user accounts and technical accounts are verified\
        \ at regular intervals also within IT systems of customers."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node96
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.2.1
      name: (should)
      description: "+ Strategies for authorizing access to information are prepared.\n\
        + Authorization roles are used.\n+ Rights are allocated on a need-to-use basis\
        \ and according to the role and/or area of responsibility. \n+ Normal user\
        \ accounts are not granted privileged access rights.\n+ The access rights\
        \ of a user account are adapted after the user has changed (e.g. to another\
        \ field of responsibility)."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node97
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.2.1
      name: (for high protection needs)
      description: + The access rights are approved by the responsible internal Information
        Officer. (C, I, A)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node98
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.2.1
      name: (for very high protection needs)
      description: "+ Prevention of unauthorized persons gaining access and information\
        \ (privileged users): (C)\n  - Information is stored in encrypted form at\
        \ content level (e.g. file level).\n  - Where encryption is not feasible,\
        \ information shall be protected by similarly effective measures. \n+ Existing\
        \ access rights are regularly reviewed at shorter intervals (e.g. quarterly)\
        \ (C)"
      implementation_groups:
      - very_high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node99
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:4.2.1
      name: Further information
      description: + In case of externally operated IT infrastructure (e.g. server)
        and/or cloud solutions, compliance with the encryption requirements according
        to control question 5.1.1 is ensured.
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5
      assessable: false
      depth: 1
      ref_id: '5'
      name: "IT Security\_/ Cyber Security"
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5
      ref_id: '5.1'
      description: Cryptography
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1
      ref_id: 5.1.1
      description: To what extent is the use of cryptographic procedures managed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node103
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.1
      name: (must)
      description: '+ All cryptographic procedures used (e.g. encryption, signature,
        and hash algorithms, protocols, applications) provide the security required
        by the respective application field according to the state of the art.

        + The legal parameters for the use of cryptography are taken into account.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node104
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.1
      name: (should)
      description: "+ Preparation of technical rules containing requirements for encryption\
        \ in order to protect information according to its classification.\n+ A concept\
        \ for the application of cryptography is defined and implemented. The following\
        \ aspects are considered:\n  - Cryptographic procedures,\n  - Key strengths,\n\
        \  - Procedures for the complete lifecycle of cryptographic keys, including\
        \ generation, storage, archiving, retrieval, distribution, deactivation, renewal\
        \ and deletion.\n+ An emergency process for restoring key material is established."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node105
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.1
      name: (for high protection needs)
      description: + Key sovereignty requirements (particularly in case of external
        processing) are determined and fulfilled. (C, I)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1
      ref_id: 5.1.2
      description: To what extent is information protected during transfer?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node107
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.2
      name: (must)
      description: "+ The network services used to transfer information are identified\
        \ and documented. \n+ Policies and procedures in accordance with the classification\
        \ requirements for the use of network services are defined and implemented.\n\
        + Measures for the protection of transferred contents against unauthorized\
        \ access are implemented."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node108
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.2
      name: (should)
      description: '+ Measures for ensuring correct addressing and correct transfer
        of information are implemented.

        + Electronic data exchange is conducted using content or transport encryption
        according to the respective classification. '
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node109
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.2
      name: (for high protection needs)
      description: "+ Information is transported or transferred in encrypted form:\
        \ (C)\n  - Where encryption is not feasible, information must be protected\
        \ by similarly effective measures."
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node110
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.1.2
      name: (for very high protection needs)
      description: + Information is transported or transferred in content-encrypted
        form. (C)
      implementation_groups:
      - very_high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5
      ref_id: '5.2'
      description: Operations Security
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2
      ref_id: 5.2.1
      description: 'To what extent are changes managed? '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node113
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.1
      name: (must)
      description: + Information security requirements for changes to the organization,
        business processes, IT systems are determined and applied.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node114
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.1
      name: (should)
      description: '+ A formal approval procedure is established.

        + Changes are verified and assessed for their potential impact on the information
        security.

        + Changes affecting the information security are subjected to planning and
        testing.

        + Procedures for fall-back in fault cases are taken into account.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node115
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.1
      name: (for high protection needs)
      description: + Compliance with the information security requirements is verified
        during and after the changes are applied. (C, I, A)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2
      ref_id: 5.2.2
      description: To what extent are development and testing environments separated
        from operational environments?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node117
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.2
      name: (must)
      description: '+ The IT systems have been subjected to risk assessment in order
        to determine the necessity of their separation into development, testing and
        operational systems.

        + A segmentation is implemented based on the results of risk analysis.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node118
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.2
      name: (should)
      description: "+ The requirements for development and testing environments are\
        \ determined and implemented. The following aspects are considered:\n  - Separation\
        \ of development, testing and operational systems,\n  - No development and\
        \ system tools on operational systems (except those required for operation),\n\
        \  - Use of different user profiles for development, testing and operational\
        \ systems."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2
      ref_id: 5.2.3
      description: To what extent are IT systems protected against malware?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node120
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.3
      name: (must)
      description: '+ Requirements for protection against malware are determined.

        + Technical and organizational measures for protection against malware are
        defined and implemented.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node121
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.3
      name: (should)
      description: "+ Unnecessary network services are disabled.\n+ Access to network\
        \ services is restricted to necessary access by means of suitable protective\
        \ measures (see examples).\n+ Malware protection software is installed and\
        \ updated automatically at regular intervals (e.g. virus scanner).\n+ Received\
        \ files and programs are automatically inspected for malware prior to their\
        \ execution (on-access scan).\n+ The entire data contents of all systems is\
        \ regularly inspected for malware.\n+ Data transferred by central gateways\
        \ (e.g. e-mail, internet, third-party networks) is automatically inspected\
        \ by means of protection software:\n  - Encrypted connections are taken into\
        \ account.\n+ Measures to prevent protection software from being deactivated\
        \ or altered by users are defined and implemented.\n+ Case-related staff awareness\
        \ measures.\n+ For IT systems operated without the use of malware protection\
        \ software, alternative measures (e.g. special resilience measures, few services,\
        \ no active users, network isolation) are implemented. "
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2
      ref_id: 5.2.4
      description: To what extent are event logs recorded and analyzed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node123
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.4
      name: (must)
      description: '+ Information security requirements regarding the handling of
        event logs are determined and fulfilled.

        + Security-relevant requirements regarding the logging of activities of system
        administrators and users are determined and fulfilled.

        + The IT systems used are assessed regarding the necessity of logging.

        + When using external IT services, information on the monitoring options is
        obtained and considered in the assessment.

        + Event logs are checked regularly for rule violations and noticeable problems
        in compliance with the permissible legal and organizational provisions.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node124
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.4
      name: (should)
      description: '+ A procedure for the escalation of relevant events to the responsible
        body (e.g. security incident report, data protection, corporate security,
        IT security) is defined and established.

        + Event logs (contents and meta data) are protected against alteration. (e.g.
        by a dedicated environment).

        + Adequate monitoring and recording of any actions on the network that are
        relevant to information security are established.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node125
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.4
      name: (for high protection needs)
      description: '+ Information security requirements relevant to the security during
        the handling of event logs, e.g. contractual requirements, are determined
        and implemented. (C, I, A)

        + Cases of access during connection and disconnection of external networks
        (e.g. remote maintenance) are logged. (C, I, A)'
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node126
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.4
      name: (for very high protection needs)
      description: + Logging of any access to data of very high protection needs as
        far as technically feasible and as permissible according to legal and organizational
        provisions. (C, I)
      implementation_groups:
      - very_high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2
      ref_id: 5.2.5
      description: 'To what extent are vulnerabilities identified and addressed? '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node128
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.5
      name: (must)
      description: '+ Information on technical vulnerabilities for the IT systems
        in use is gathered (e.g. information from the manufacturer, system audits,
        CVS database) and evaluated (e.g. Common Vulnerability Scoring System CVSS)

        + Potentially affected IT systems and software are identified, assessed and
        any vulnerabilities are addressed.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node129
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.5
      name: (should)
      description: '+ An adequate patch management is defined and implemented (e.g.
        patch testing and installation).

        + Risk minimizing measures are implemented as necessary.

        + Successful installation of patches is verified in an appropriate manner.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2
      ref_id: 5.2.6
      description: To what extent are IT systems technically checked (system audit)?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node131
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.6
      name: (must)
      description: '+ Requirements for auditing IT systems are determined.

        + The scope of the system audit is specified in a timely manner.

        + System audits are coordinated with the operator and users of the IT systems.

        + The results of system audits are stored in a traceable manner and reported
        to the relevant management.

        + Measures are derived from the results.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node132
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.6
      name: (should)
      description: '+ System audits are planned taking into account any security risks
        they might cause (e.g. disturbances).

        + System audits are carried out by trained experts.

        + Suitable tools (e.g. vulnerability scanners) are available for system audits.

        + Within a reasonable period following completion of the audit, a report is
        prepared.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2
      ref_id: 5.2.7
      description: 'To what extent is the network of the organization managed?


        '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node134
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.7
      name: (must)
      description: '+ Requirements for the management and control of networks are
        determined and fulfilled.

        + Requirements regarding network segmentation are determined and fulfilled.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node135
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.7
      name: (should)
      description: "+ Procedures for the management and control of networks are defined.\n\
        + For network segmentation, the following aspects are considered:\n  - Limitations\
        \ for connecting IT systems to the network,\n  - Use of security technologies,\n\
        \  - The increased risk due to network services accessible via the internet,\n\
        \  - Technology-specific separation options when using external IT services,\n\
        \  - Adequate separation between own networks and customer networks while\
        \ considering customer requirements."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node136
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.2.7
      name: (for high protection needs)
      description: "+ Extended requirements for the management and control of networks\
        \ are determined and implemented. The following aspects are considered: (C,\
        \ I, A)\n  - Authentication of IT systems on the network,\n  - Access to the\
        \ management interfaces of IT systems is restricted."
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5
      ref_id: '5.3'
      description: System acquisitions, requirement management and development
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3
      ref_id: 5.3.1
      description: To what extent is information security considered in new or further
        developed IT systems?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node139
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.1
      name: (must)
      description: '+ The information security requirements associated with the design
        and development of IT systems are determined and taken into account.

        + The information security requirements associated with the acquisition or
        extension of IT systems and IT components are determined and taken into account.

        + Information security requirements associated with changes to developed IT
        systems are taken into account.

        + System approval tests are carried out under consideration of the information
        security requirements.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node140
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.1
      name: (should)
      description: "+ Requirement specifications are prepared under consideration\
        \ of the information security requirements.\n+ Requirement specifications\
        \ are reviewed against the information security requirements.\n+ The IT system\
        \ is reviewed for compliance with specifications prior to productive use.\n\
        + The use of productive data for testing purposes is avoided as far as possible\
        \ (if applicable, anonymization or pseudonymization):\n  - Where productive\
        \ data are used for testing purposes, it shall be ensured that the test system\
        \ is provided with protective measures comparable to those on the operational\
        \ system,\n  - Requirements for the lifecycle of test data (e.g. deletion,\
        \ maximum lifetime on the IT system),\n  - case-related specifications for\
        \ the generation of test data are defined."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3
      ref_id: 5.3.2
      description: To what extent are requirements for network services defined?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node142
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.2
      name: (must)
      description: + Requirements regarding the information security of network services
        are determined and fulfilled.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node143
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.2
      name: (should)
      description: '+ A procedure for securing and using network services is defined
        and implemented.

        + The requirements are agreed in the form of SLAs.

        + Adequate redundancy solutions are implemented.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node144
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.2
      name: (for high protection needs)
      description: + Procedures for monitoring the quality of network traffic (e.g.
        traffic flow analyses, availability measurements) are defined and carried
        out. (A)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3
      ref_id: 5.3.3
      description: 'To what extent is the return and secure removal of information
        assets from external IT services regulated? '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node146
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.3
      name: (must)
      description: + A procedure for the return and secure removal of information
        assets from each external IT service is defined and implemented.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node147
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.3
      name: (should)
      description: + A description of the termination process is given, adapted to
        any changes and contractually regulated.
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3
      ref_id: 5.3.4
      description: To what extent is information protected in shared external IT services?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node149
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.4
      name: (must)
      description: + Effective segregation (e.g. segregation of clients) prevents
        access to own information by unauthorized users of other organizations.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node150
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:5.3.4
      name: (should)
      description: "+ The provider\u2019s segregation concept is documented and adapted\
        \ to any changes. The following aspects are considered:\n  - Separation of\
        \ data, functions, applications, operating system, storage system and network,\n\
        \  - Risk assessment for the operation of external software within the shared\
        \ environment."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:6
      assessable: false
      depth: 1
      ref_id: '6'
      name: Supplier Relationships
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:6.1.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:6
      ref_id: 6.1.1
      description: 'To what extent is information security ensured among contractors
        and cooperation partners?


        '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node153
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:6.1.1
      name: (must)
      description: '+ Contractors and cooperation partners are subjected to a risk
        assessment with regard to information security.

        + An appropriate level of information security is ensured by contractual agreements
        with contractors and cooperation partners.

        + Where applicable, contractual agreements with clients are passed on to contractors
        and cooperation partners.

        + Compliance with contractual agreements is verified.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node154
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:6.1.1
      name: (should)
      description: '+ Contractors and cooperation partners are contractually obliged
        to also pass on any requirements regarding an appropriate level of information
        security also to their subcontractors.

        + Service reports and documents by contractors and cooperation partners are
        reviewed.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node155
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:6.1.1
      name: (for high protection needs)
      description: + Proof is provided that the information security level of the
        supplier is adequate for the protection needs of the information (e.g. certificate,
        attestation, internal audit). (C, I, A)
      implementation_groups:
      - high
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node156
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:6.1.1
      name: Further information
      description: "Within the context of VDA ISA, the term contractor includes both\
        \ classic suppliers and subcontractors but also classic service providers,\
        \ freelancers or other partner companies. It also includes cooperation partners\
        \ (e.g. academic institutions, institutes).\n\nThe explanations below describe\
        \ a possible procedure for fulfilling the requirements:\n\nIdentification\
        \ of contractors and specification of protection needs and security requirements:\n\
        At first, all contractors must be identified (e.g. via the list of creditors\
        \ of the accountants department) in order to gain an initial overview. \n\
        For all contractors, the respective protection needs should be specified and\
        \ the security requirements derived according to their tasks and the relevance\
        \ to own and customer\u2019s processes. \nGenerally, a large number of contractors\
        \ is found not to require the assignment of relevant protection needs and\
        \ to be therefore not subject to security requirements (e.g. suppliers of\
        \ office stationary). \n\nEnsuring implementation by the contractor:\nIn the\
        \ next step, the applicable requirements must be made known to all security-relevant\
        \ contractors in a suitable manner and (contractually) fixed as being mandatory.\
        \ Finally, a decision should be made as to how the implementation of the security\
        \ requirements can be appropriately verified. For this purpose, adequate verification\
        \ processes and procedures should be defined according to the respective risk\
        \ (and the associated protection needs). Their purpose is to ensure that contractors\
        \ implement the necessary requirements.\n\nEstablishment in standard processes:\n\
        The insights gained should be used to develop a comprehensible procedure and\
        \ to integrate it into the existing processes of the B2B\_/ supplier management.\
        \ This starts with the selection of the contractor, where aspects of information\
        \ security should already be taken into account alongside criteria such as\
        \ quality, adherence to delivery dates, credit rating etc. The procurement\
        \ process should be such that the relevance of information security has already\
        \ been taken into account beforehand (with respect to the procurement decision;\
        \ contract design; inspection requirements).\nFurthermore, it is recommended\
        \ to incorporate information security aspects into existing processes for\
        \ supplier evaluation which have already been established by e.g. an existing\
        \ quality management system.\nContractually specified deliverables (e.g. availability\
        \ requirements) should be verified at regular intervals. This can be done\
        \ by e.g. regular analysis of service reports and SLAs.  "
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:6.1.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:6
      ref_id: 6.1.2
      description: To what extent is non-disclosure regarding the exchange of information
        contractually agreed?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node158
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:6.1.2
      name: (must)
      description: '+ The non-disclosure requirements are determined and fulfilled.

        + Requirements and procedures for applying non-disclosure agreements are known
        to all persons passing on information in need of protection.

        + Valid non-disclosure agreements are concluded prior to  forwarding sensitive
        information.

        + The requirements and procedures for the use of non-disclosure agreements
        and the handling of information requiring protection are reviewed at regular
        intervals.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node159
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:6.1.2
      name: (should)
      description: "+ Non-disclosure agreement templates are available and checked\
        \ for legal applicability.\n+ Non-disclosure agreements include the following\
        \ information:\n  - the persons/organizations involved,\n  - the type of information\
        \ covered by the agreement,\n  - the subject of the agreement,\n  - the validity\
        \ period of the agreement,\n  - the responsibilities of the obliged party.\n\
        + Non-disclosure agreements include provisions for the handling of sensitive\
        \ information beyond the contractual relationship.\n+ Options of demonstrating\
        \ compliance with specifications (e.g. review by an independent third party\
        \ or audit rights) are defined.\n+ A process for monitoring the validity period\
        \ of temporary non-disclosure agreements and initiating their extension in\
        \ due time is defined and implemented."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:7
      assessable: false
      depth: 1
      ref_id: '7'
      name: Compliance
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:7.1.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:7
      ref_id: 7.1.1
      description: To what extent is compliance with regulatory and contractual provisions
        ensured?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node162
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:7.1.1
      name: (must)
      description: '+ Legal, regulatory and contractual provisions of relevance to
        information security (see examples) are determined at regular intervals.

        + Policies regarding compliance with the provisions are defined, implemented
        and communicated to the responsible persons.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node163
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:7.1.1
      name: (should)
      description: + The integrity of records in accordance with the legal, regulatory
        or contractual provisions and business requirements is considered.
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:7.1.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:7
      ref_id: 7.1.2
      description: 'To what extent is the protection of personally identifiable data
        taken into account when implementing information security? '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node165
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:7.1.2
      name: (must)
      description: '+ Legal and contractual information security requirements regarding
        the procedures and processes in the processing of personally identifiable
        data are determined.

        + Regulations regarding the compliance with legal and contractual requirements
        for the protection of personally identifiable data are defined and known to
        the entrusted persons.

        + Processes and procedures for the protection of personally identifiable data
        are taken into account in the information security management system.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8
      assessable: false
      depth: 1
      ref_id: '8'
      name: Prototype Protection
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8
      ref_id: '8.1'
      description: Physical and Environmental Security
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      ref_id: 8.1.1
      description: To what extent is a security concept available describing minimum
        requirements regarding the physical and environmental security for prototype
        protection?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node169
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.1
      name: (must)
      description: "+ A security concept under consideration of the following aspects\
        \ is established: \n - stability of outer skin,\n - view and sight protection,\n\
        \ - protection against unauthorized entry and access control,\n - intrusion\
        \ monitoring,\n - documented visitor management,\n - client segregation."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node170
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.1
      name: (should)
      description: + Perimeter security.
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      ref_id: 8.1.2
      description: To what extent is perimeter security existent preventing unauthorized
        access to protected property objects?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node172
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.2
      name: (must)
      description: + Unauthorized access to properties is not possible.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node173
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.2
      name: (should)
      description: "+ Suitable barriers are in place such as:\n  - artificial barriers\
        \ (fence systems, walls),\n  - technical barriers (detection),\n  - natural\
        \ barriers (growth, vegetation)."
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      ref_id: 8.1.3
      description: To what extent is the outer skin of the protected buildings constructed
        such as to prevent removal or opening of outer-skin components using standard
        tools?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node175
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.3
      name: (must)
      description: + Unauthorized access to buildings/security areas is not possible.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node176
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.3
      name: (should)
      description: '+ Solid construction (masonry, concrete, reinforced concrete or
        prestressed concrete).

        + Windows and doors in the outer skin are to be built in compliance with RC2
        or better.'
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      ref_id: 8.1.4
      description: To what extent is view and sight protection ensured in defined
        security areas?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node178
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.4
      name: (must)
      description: + Unauthorized viewing of new developments needing high or very
        high protection is not possible.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node179
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.4
      name: (should)
      description: '+ Sight protection through relevant glass surfaces is ensured.

        + View into defined security areas through open doors/gates/windows is prevented. '
      implementation_groups:
      - should
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node180
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.4
      name: (for vehicles classified as requiring protection)
      description: + The spatial situation is also suitable for protecting vehicles
        classified as requiring protection against unauthorized view.
      implementation_groups:
      - vehicle
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      ref_id: 8.1.5
      description: To what extent is the protection against unauthorized entry regulated
        in the form of access control?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node182
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.5
      name: (must)
      description: "+ At least one of the following three requirements must be implemented:\n\
        \  - mechanical locks with documented key assignment,\n  - electronic access\
        \ systems with documented authorization assignment,\n  - personal access control\
        \ including documentation."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node183
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.5
      name: (for vehicles classified as requiring protection)
      description: + The spatial situation is also suitable for protecting vehicles
        classified as requiring protection against unauthorized access.
      implementation_groups:
      - vehicle
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      ref_id: 8.1.6
      description: To what extent are the premises to be secured monitored for intrusion?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node185
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.6
      name: (must)
      description: "+ Intrusion monitoring of the premises to be secured is ensured:\n\
        \  - An intrusion detection system exists which complies with DIN\_EN\_50131\
        \ or conforms to VDS or similar and functions with alarm tracking to a certified\
        \ security service or control unit (e.g. according to DIN\_77200, VdS\_3138),\n\
        \  - or 24/7 guarding by a certified security service.\n+ Alarm plans are\
        \ available.\n+ Timely alarm processing is ensured."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      ref_id: 8.1.7
      description: To what extent is a documented visitor management in place?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node187
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.7
      name: (must)
      description: '+ Registration obligation for all visitors.

        + Documented non-disclosure obligation prior to access.

        + Publication of security and visitor regulations.

        + Country-specific legal provisions regarding data protection are to be observed.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.8
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1
      ref_id: 8.1.8
      description: To what extent is on-site client segregation existent?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node189
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.8
      name: (must)
      description: "+ Spatial separation by staff-related or technical measures is\
        \ in effect according to the following aspects:\n  - customers, and/or\n \
        \ - projects,\n  - where segregation is not in effect, explicit approval by\
        \ the customer is required."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node190
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.1.8
      name: (for vehicles classified as requiring protection)
      description: + The spatial situation is also suitable for implementing client
        segregation for vehicles classified as requiring protection.
      implementation_groups:
      - vehicle
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8
      ref_id: '8.2'
      description: Organizational Requirements
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2
      ref_id: 8.2.1
      description: To what extent are non-disclosure agreements/obligations existent
        according to the valid contractual law?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node193
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.1
      name: (must)
      description: "+ A non-disclosure agreement: \n  - between contractor and customer\
        \ (company level),\n  - with all employees and project members (personal obligation).\n\
        + Country-specific legal provisions regarding data protection are to be observed."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2
      ref_id: 8.2.2
      description: To what extent are requirements for commissioning subcontractors
        known and fulfilled?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node195
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.2
      name: (must)
      description: "+ Approval by the original customer.\n+ contractually valid non-disclosure\
        \ agreement exists:\n  - between contractor and subcontractor (company level),\n\
        \  - with all employees and project members of the subcontractor (personal\
        \ obligation).\n+ Ensuring compliance with the security requirements of the\
        \ actual customer (proof is obtained).\n+ Proof of the subcontractor\u2019\
        s compliance with minimum requirements for prototype protection (e.g. certificate,\
        \ attestation) is provided."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2
      ref_id: 8.2.3
      description: To what extent do employees and project members evidently participate
        in training and awareness measures regarding the handling of prototypes?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node197
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.3
      name: (must)
      description: "+ Ensuring execution of trainings\_/ awareness programs by the\
        \ management.\n+ Training of employees and project members when joining the\
        \ project regarding the handling of prototypes.\n+ Regular (at least annual)\
        \ training of employees regarding the handling of prototypes.\n+ Ensuring\
        \ knowledge among employees and project members regarding the respective protection\
        \ needs and the resulting measures within the company.\n+ Mandatory participation\
        \ of each employee and project member in the trainings and awareness measures.\n\
        + The completed measures are to be documented. \n+ The training concept for\
        \ prototype protection is an integral part of the general training concept\
        \ (see also control question 2.1.3 Information Security)."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2
      ref_id: 8.2.4
      description: To what extent are security classifications of the project and
        the resulting security measures known?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node199
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.4
      name: (must)
      description: '+ Ensuring that the security classification and requirements in
        relation to the project progress are made known to each project member.

        + Consideration of step-by-step plans, measures for secrecy and camouflage,
        development policies.

        + The requirements are considered as a requirement regarding the information
        security of the project (see Controls 1.2.3 and 7.1.1 Information Security).'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2
      ref_id: 8.2.5
      description: To what extent is a process defined for granting access to security
        areas?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node201
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.5
      name: (must)
      description: '+ Responsibilities for access authorization are clearly specified
        and documented.

        + A process for new assignments, changes and revocations of access rights
        is in place.

        + Code of conduct in case of the loss/theft of access control means.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2
      ref_id: 8.2.6
      description: To what extent are regulations for image recording and handling
        of created image material existent?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node203
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.6
      name: (must)
      description: '+ Approval procedures for image recording.

        + Specification for classification/categorization of image material.

        + Secure storage of image material.

        + Secure deletion/disposal of image material no longer required.

        + Secured transmission/shipping of image material to authorized recipients
        only.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2
      ref_id: 8.2.7
      description: To what extent is a process for carrying along and using mobile
        video and photography devices in(to) defined security areas established?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node205
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.2.7
      name: (must)
      description: '+ Specification for carrying along (e.g. sealed/unsealed, etc.).

        + Specification for use (e.g. phone calls, photography, etc.).'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8
      ref_id: '8.3'
      description: Handling of vehicles, components and parts
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.3.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.3
      ref_id: 8.3.1
      description: To what extent are transports of vehicles, components or parts
        classified as requiring protection arranged according to the customer requirements?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node208
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.3.1
      name: (must)
      description: "+ A process for obtaining customer-specific requirements for the\
        \ transport of vehicles, components and parts classified as requiring protection\
        \ is described and implemented. \n+ The security requirements defined by the\
        \ customer are known and observed.\n+ The logistics/transport companies explicitly\
        \ approved by the customer are commissioned.\n+ A process for reporting any\
        \ security-relevant events to the customer is described and implemented."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.3.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.3
      ref_id: 8.3.2
      description: To what extent is it ensured that vehicles, components and parts
        classified as requiring protection are parked/stored in accordance with customer
        requirements?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node210
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.3.2
      name: (must)
      description: + The customer-specific requirements for parking/storage are verifiably
        known and observed.
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8
      ref_id: '8.4'
      description: Requirements for trial vehicles
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4
      ref_id: 8.4.1
      description: To what extent are the predefined camouflage regulations implemented
        by the project members?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node213
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4.1
      name: (must)
      description: '+ The requirements for using the respective camouflage are known
        to the project members.

        + Any changes to the camouflage are made upon documented agreement with the
        customer.

        + A process for the immediate reporting of any damages to the camouflage is
        described and implemented.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4
      ref_id: 8.4.2
      description: To what extent are measures for protecting approved test and trial
        grounds observed/implemented?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node215
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4.2
      name: (must)
      description: "+ A process for obtaining customer-specific requirements for the\
        \ use of trial vehicles classified as requiring protection on test and trial\
        \ grounds is described and implemented. \n+ The following aspects must be\
        \ known to users of test and trial grounds: \n  - a current list of customer-approved\
        \ test and trial grounds\n  - code of conduct for ensuring undisturbed trial\
        \ operation \n  - customer-defined protective measures These are implemented."
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4
      ref_id: 8.4.3
      description: To what extent are protective measures for approved test and trial
        drives in public observed/implemented?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node217
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.4.3
      name: (must)
      description: '+ A process for obtaining customer-specific requirements for the
        operation of trial vehicles classified as requiring protection on public roads
        is described and implemented.

        + Protective measures defined by the customer are known and observed.

        + The code of conduct in case of special incidents (e.g. breakdown, accident,
        theft...) is known and observed.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8
      ref_id: '8.5'
      description: Requirements for events and shootings
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.5.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.5
      ref_id: 8.5.1
      description: To what extent are security requirements for presentations and
        events involving vehicles, components or parts classified as requiring protection
        known?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node220
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.5.1
      name: (must)
      description: '+ A process for obtaining customer-specific requirements for presentations
        and events involving vehicles, components or parts classified as requiring
        protection is described and implemented.

        + Established and customer-approved security concepts (organizationally, technically,

        staff-related).

        + Code of conduct in case of special incidents.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:8.5.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.5
      ref_id: 8.5.2
      description: To what extent are the protective measures for film and photo shootings
        involving vehicles, components or parts classified as requiring protection
        known?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node222
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:8.5.2
      name: (must)
      description: '+ A process for obtaining customer-specific requirements for film
        and photo shootings involving vehicles, components or parts classified as
        requiring protection is described and implemented.

        + Proof of approval for the presumably used premises.

        + Established and customer-approved security concepts (organizationally, technically,

        staff-related).

        + Code of conduct in case of special incidents. '
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:9
      assessable: false
      depth: 1
      ref_id: '9'
      name: Data Protection
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:9.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:9
      ref_id: '9.1'
      description: To what extent is the implementation of data protection organized?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node225
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:9.1
      name: (must)
      description: "+ Appointment of a data protection officer where legally required,\
        \ otherwise appointment of a person responsible for data protection\n+ Organizational\
        \ implementation of data protection\n    - Integration of the data protection\
        \ officer into the corporate structure\n    - Voluntary or obligatory appointment\
        \ of a data protection officer\n    - Full-time or part-time data protection\
        \ officer\n    - Internal or external data protection officer\n    - Support\
        \ of the data protection officer by directly assigned employees (department\
        \ \u201CData Protection\u201D) depending on the company size\n    - Support\
        \ of the data protection officer by data protection coordinators in the company\
        \ departments depending on the size of the company (e.g. Marketing, Sales,\
        \ Human Resources, Logistics, Development, etc.)"
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:9.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:9
      ref_id: '9.2'
      description: To what extent are organizational measures taken in order to ensure
        that personally identifiable data is processed in conformance with legislation?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node227
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:9.2
      name: (must)
      description: "+ Specification of data protection principles (processing of personally\
        \ identifiable data) in a documented company-internal data protection policy\
        \ (e.g. company-internal guideline).\n+ Implementation of company-internal\
        \ steering committees or responsibilities - in collaboration with the data\
        \ protection officer - addressing topics relevant to data protection.\n+ Implementation\
        \ of a process which ensures the involvement of the data protection officer\
        \ in any topics relevant to data protection (e.g. in the context of a data\
        \ protection impact assessment). \n+ Documentation of work processes when\
        \ processing personally identifiable data.\n+ Documentation of statements\
        \ and comments of the data protection officer regarding data protection law\
        \ assessments.\n+ Implementation of a process by means of which - in case\
        \ a subcontracting processor is commissioned - the processor is by contractual\
        \ or other legal provisions subject to the same data protection obligations\
        \ as specified by contract between the responsible person and the processor.\
        \ \n+ Company-internal work instructions or manuals in specific task fields\
        \ concerning the processing of personally identifiable data.\n+ Employees\u2019\
        \ (and, if applicable, subcontractors\u2019) confidentiality obligation.\n\
        + Implementation of technical and organizational measures for supporting the\
        \ controller in handling data subject rights as far as feasible and appropriate\
        \ for processing.\n+ Implementation of reporting processes for immediately\
        \ informing the customer, under consideration of any subcontractors, so the\
        \ legal reporting deadlines for data protection incidents can be observed.\n\
        + Documentation of subcontracting relationships including contractual regulations\
        \ with relevant subcontractors, where any right to inspect the contractual\
        \ regulation is in any case limited to the subcontractor\u2019s obligations\
        \ concerning data protection.  \n+ Implementation of a process for the documentation\
        \ of instructions in terms of data protection legislation.\n+ Ability to implement\
        \ deletion concepts.\n+ Implementation of a procedure for regular review,\
        \ assessment and evaluation of TOM. "
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:9.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:9
      ref_id: '9.3'
      description: To what extent is it ensured that the internal processes or workflows
        are carried out according to the currently valid data protection regulations
        and that these are regularly subjected to a quality check?
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node229
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:9.3
      name: (must)
      description: '+ Proof of regular review and optimization of the data protection
        management system (e.g. certification).

        + Measures for observing confidentiality and integrity when transferring personally
        identifiable data.

        + Adequate protection mechanisms for reducing unauthorized access to personally
        identifiable data.

        + Obligatory training of employees entrusted with the processing of personally
        identifiable data of the customer (e.g. classroom training, WBT).

        + Ensuring implementation of contracts and customer instructions.'
      implementation_groups:
      - must
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:9.4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:9
      ref_id: '9.4'
      description: 'To what extent are the relevant processing procedures documented
        with regard to their admissibility according to data protection law?

        '
    - urn: urn:intuitem:risk:req_node:tisax-v5.1:node231
      assessable: true
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:tisax-v5.1:9.4
      name: (must)
      description: '+ Documentation of essential activities associated with the processing
        of personally identifiable data in accordance with legal requirements.

        + Customer support for the execution of data protection impact assessments
        and the documentation of their results.

        + Informing the customer when detecting unlawful data processing, where applicable,
        under consideration of different national legislations.'
      implementation_groups:
      - must
