The Trusted Information Security Assessment Exchange (TISAX) is the framework German automobile companies use to verify data security across their supply chain. Assessments follow the requirements set out in the VDA ISA, which is itself based on ISO 27001. Companies then share their results with customers and partners. Activity logging is one of the technical areas an assessment covers, alongside data classification, encryption, and reporting.
In order to meet German automotive industry standards for data security, companies must have the ability to record and trace events that affect data security. TISAX standards also call for organizations to protect event records against modification, so if a security incident occurs, administrators can determine the cause and take the appropriate actions to remediate and protect proactively.
Detailed event logging also aids compliance efforts in general. Security logs are an effective way for organizations to demonstrate that they have implemented measures to satisfy other TISAX requirements, such as those calling for data protection, classification, or access control.
Data Security Intelligence
PKWARE’s Data Security Intelligence reporting allows security teams and audit personnel to monitor data discovery, classification, and protection activity across the organization. PKWARE provides activity logs that cannot be altered to indicate which files are protected, where the files are stored, and which users have accessed them. To make tracing events easy in the event of security incidents, administrators can filter data by time and event type, and search for specific terms within event logs.
PKWARE captures extensive information on administrative actions, user actions, and file activity, enabling organizations to maintain full audit trails on their sensitive data and meet TISAX standards.
Administrators can report and search on a wide variety of events:
- User account creation and user logins
- Policy creation and deletion
- Encryption key creation and deletion
- File encryption and decryption
- Key access requests and responses
Data Security Intelligence output can be viewed directly through the “Reporting” tab of the PK Protect console, picked up via SIEM agent, or retrieved via API for transformation and integration with the organization’s data.
Logs are also what an assessor reviews. Because the records cannot be altered, they stand as evidence that a control was in place and operating, rather than as a description of one. Companies use PKWARE endpoint protection capabilities to meet a range of TISAX standards from a single solution. That covers data classification, data protection, encryption key management, and activity logging. So the evidence for all four sits in one place.
Walk through the reporting process with one of our data experts. Request a demo here.