industry-specific-compliance

Industry-Specific Compliance Reference

Sector-specific security and data protection standards beyond general frameworks. Extensible per vertical.

TISAX (Trusted Information Security Assessment Exchange)

Automotive industry information security standard managed by ENX Association, based on VDA ISA questionnaire. Required by German OEMs (VW, BMW, Mercedes-Benz) for all suppliers handling sensitive information.

**Assessment Levels:**

| Level | Audit Type | Applies To | |-------|-----------|------------| | AL1 | Self-assessment only | Administrative/commercial info | | AL2 | Remote document review by auditor | Sensitive technical info, development docs | | AL3 | On-site audit + physical security checks | Physical prototypes, strictly confidential data |

**VDA ISA 6.0 Labels (Since April 2024):** Old "Info High"/"Info Very High" replaced by Confidential, Strictly Confidential, new Availability label. Prototype Protection retained. Main language switched to English.

**Key Standards Referenced:** ISO/IEC 27001:2022, BSI IT-Grundschutz, NIST CSF, IEC 62443 (for OT)

**Code-Level Checks:**

| # | Check | ISA Ref | |---|-------|---------| | TX-01 | Secure coding guidelines enforced (input validation, secure libs) | A.8.28 | | TX-02 | Code reviews include security review for vulnerabilities | A.8.28 | | TX-03 | Data classification labels applied to all shared data | Info Classification | | TX-04 | DLP controls prevent unauthorized data exfiltration | Data Protection | | TX-05 | SIEM/security monitoring active and alerting | Security Monitoring | | TX-06 | Prototype data access restricted with enhanced monitoring | Prototype Protection | | TX-07 | Business continuity plan for IT services documented and tested | Continuity | | TX-08 | Third-party/supplier security assessment completed | Supply Chain |

How to Use in Reviews

1. Identify automotive context (OEM integration, supplier portal, prototype handling) 2. Determine required TISAX assessment level (AL1/AL2/AL3) 3. Apply checks relevant to the assessment level 4. Focus on prototype protection for AL3 reviews 5. Report violations with check IDs (TX-01 through TX-08)

Not every check applies to every PR. Focus on items relevant to the specific changes.

Common Violations in Reviews

| Violation | Where It Hides | Detection | |-----------|---------------|-----------| | No data classification | Files/APIs without sensitivity labels | Check metadata, headers, documentation | | Prototype data exposed | Test fixtures, staging environments | Grep for prototype-related data | | Missing DLP | No outbound data controls | Check egress rules, API gateways | | No supplier assessment | Third-party libs without security review | Check vendor assessment records | | Weak code review | No security-specific review checklist | Check PR templates, review workflows |

Cross-References

• [german-it-security.md](german-it-security.md) — BSI IT-Grundschutz (referenced by VDA ISA), KRITIS, NIS2UmsuCG checks
• [sovereign-cloud-data-residency.md](sovereign-cloud-data-residency.md) — BSI C5, data residency for sovereign cloud deployments
• [compliance-checklists.md](compliance-checklists.md) — GDPR, SOC 2, PCI-DSS, HIPAA overlay checks

[Future] Healthcare (DiGAV / MDR)

German Digital Health Applications regulation + EU Medical Device Regulation. To be added when healthcare vertical is needed.

[Future] Energy (EnWG / IT-SiKat)

German Energy Industry Act + IT Security Catalog for energy operators. To be added when energy vertical is needed.