Asia
Hong Kong
Support for clients across China, South East Asia, South Asia, Central Asia and the Middle East, in English and Chinese.
01 / Overview
Helping companies pass through TISAX preparation efficiently
RASOO Certification Consulting focuses on TISAX consulting, coaching, gap analysis, management system development, assessment-day support and corrective action support for automotive supply chain companies worldwide. Our clients include component manufacturers, software development companies, engineering service providers, electrical and electronic suppliers, testing laboratories, logistics providers, and cloud and data processing companies — all of whom need to meet vehicle manufacturer and Tier-1 requirements for information security, prototype protection and data compliance.
TISAX is an information security assessment mechanism widely recognised in the automotive industry. More and more vehicle manufacturers and large suppliers ask their partners to obtain a TISAX label. For companies planning to enter the European automotive supply chain, take part in OEM tenders, or handle development data, prototype parts, test data or sensitive commercial information, a TISAX label has become one of the key conditions of entry.
RASOO uses a professional, systematic and efficient consulting method to take clients from a standing start to a completed TISAX assessment — reducing the difficulty of preparation, shortening the preparation cycle and helping to reduce the risk of findings during the assessment.
Assessment levelsAL 2 · AL 3 scoping support
BasisVDA ISA catalogue
DeliveryRemote, worldwide
LanguagesEnglish & Chinese
02 / About Us
An independent consulting firm built around automotive assessment logic
RASOO Certification Consulting works with a number of certification and assessment bodies, and maintains companies and representative offices in the Asian region (Hong Kong), the European region (the United Kingdom) and the North American region (the United States). Our core business is TISAX certification consulting.
RASOO is a consulting firm. Assessments themselves are carried out by audit providers accredited for that purpose — never by your consultant.
Europe
United Kingdom
Support for European projects, OEM and Tier-1 requirement interpretation, and European time-zone coordination.
North America
United States
Support for North American sites and for groups running assessments across several regions at once.
What sets our service apart
1
Global remote delivery
RASOO provides remote consulting to clients in different countries and regions without geographic limits. Online collaboration saves clients both time and cost.
2
Familiar with automotive assessment logic
We understand what automotive supply chain customers care about: information security, development data, sample management, prototype protection and confidentiality of customer material — so preparation is aimed at the right places.
3
From documents to daily practice
We do not stop at writing procedures. We work on how the process actually runs and on the evidence it produces, so the system is genuinely workable.
4
A project cycle you can control
Every client gets a detailed project plan with tasks, owners and deliverables for each stage, so progress stays visible.
5
Tailored to your maturity level
Whether you already run ISO/IEC 27001, IATF 16949 or ISO 9001, or are building an information security system for the first time, the coaching plan is built around where you actually are.
6
English and Chinese support
For international projects we support documents, training, meetings and assessment preparation in both English and Chinese, so cross-border teams stay aligned.
03 / Who we serve
Which companies our TISAX consulting suits
Wherever your company sits — China, South East Asia, Europe, the Americas or elsewhere — RASOO can support you through remote consulting and online project management.
- Automotive component manufacturers
- Automotive electronics, electrical, sensor and chip related companies
- Software development, embedded systems, automated driving and smart cockpit companies
- Engineering design, R&D outsourcing, and test and validation service providers
- Tooling, sample part and prototype manufacturers
- Logistics, warehousing and supply chain service providers
- Cloud services, data processing and IT outsourcing companies
- Chinese and global companies aiming to enter the European automotive supply chain
- Suppliers who have already been asked by a customer to provide a TISAX label
- Companies planning to take part in projects within the supply chains of automotive groups and Tier-1 suppliers such as Volkswagen, BMW, Mercedes-Benz, Audi, Porsche, Stellantis, Bosch, Continental and ZF
Third-party company names above are used only to describe the type of supply chain project a client may be preparing for. They are trademarks of their respective owners, and no affiliation, endorsement or partnership is implied.
04 / Services
Six services that carry a TISAX project end to end
Each one can be bought on its own, or run as a single project from scoping through to label.
Step 1
Readiness & scope assessment
Before anything is written, we work out what actually has to be assessed: objectives, sites, level and audit mode. Getting this wrong is the most expensive mistake in a TISAX project.
- Information security assessment objectives confirmed
- Prototype protection requirements judged
- Data protection requirements identified
- Assessment scope boundary defined
- Sites and locations included in scope analysed
- Whether AL 2 or AL 3 applies
- Whether on-site or remote assessment support is needed
- Customer requirements matched against real business activity
Step 2
Gap analysis against VDA ISA
We review your current information security management against the VDA ISA requirements and hand back a plain answer to four questions: what is missing, how to fix it, who owns it and when it is due.
- Maturity of the information security management system
- Policies and procedure documents
- Organisational roles and responsibilities
- Risk management process
- Personnel security management
- Physical security and access control
- IT systems and network security
- Supplier management process
- Incident management and emergency response
- Business continuity, backup and restore
- Prototype protection measures
- Data protection and privacy compliance measures
Step 3
Management system documentation
We build the information security documentation set that TISAX preparation calls for — adapted to your structure, processes and IT environment rather than dropped in from a template.
- Information security manual and policy
- Roles and responsibilities document
- Asset management, risk assessment and treatment procedures
- Access control, password and account management
- IT operations, backup and restore, malware protection
- Vulnerability and patch management
- Supplier information security management
- Joiner, mover and leaver security process
- Incident management and business continuity
- Physical security and prototype protection rules
- Data protection and personal data handling
- Training, internal audit and management review records
Step 4
Remote coaching & online support
Meetings, interviews, document review, training and evidence checks all run online. No repeated site visits to host, no travel budget to defend.
- Online project kick-off meeting
- Remote gap analysis interviews
- Video coaching sessions
- Remote document review and revision
- Online employee training
- Remote review of evidence material
- Online mock assessment
- Question and answer coaching before the assessment
- Support during the assessment itself
- Guidance on closing corrective actions afterwards
Step 5
Evidence pack & mock audit
Assessors look at what you did, not only at what you wrote. We assemble the evidence pack, then run a rehearsal so the first hard question is not asked on assessment day.
- Training records, risk assessment records, asset inventory
- Access approval records and door access permission lists
- Supplier evaluation records and confidentiality agreements
- Backup test, vulnerability scan and patch records
- Incident drill records and visitor registers
- Internal audit, management review and corrective action tracking
- Prototype protection inspection records
- Clause-by-clause check against VDA ISA
- Management, IT and business department interview rehearsal
- Sampling of documents and records, and predicted findings
Step 6
Assessment support & label
We stand behind you during the assessment and stay until every open point is closed and the label process is complete.
- Preparation meeting before the assessment
- Assessment material organised and indexed
- Coaching on answering assessor questions
- Help understanding what an assessor is really asking
- Judging the risk behind a potential finding
- Background support during the assessment days
- Review after the assessment
- Root cause analysis of findings and corrective action plans
- Owners assigned, evidence collected, response documents written
- Communication support with the audit provider until points are closed
05 / Scope
What the consulting covers in detail
RASOO's TISAX consulting covers the whole preparation process. The three blocks below set out the detail behind the headline services.
We look at your organisation size, business type, customer requirements, the kinds of information assets you hold and your assessment goal, then help you decide the right assessment scope and level. This covers confirmation of information security assessment objectives, judgement of prototype protection requirements, identification of data protection requirements, definition of the assessment scope boundary, analysis of which sites and locations belong in scope, whether AL 2 or AL 3 applies, whether on-site or remote assessment support is required, and how customer requirements map onto your actual business.
Getting this right at the start prevents the three classic problems: the wrong scope, an unnecessary or insufficient level, and preparation aimed in the wrong direction.
Based on the VDA ISA requirements, we carry out a full gap analysis of your current information security management and identify the distance between where you are and what TISAX preparation requires.
- Information security management system maturity assessment
- Information security policy and procedure document check
- Organisational roles and responsibilities assessment
- Risk management process assessment
- Personnel security management check
- Physical security and access control check
- IT system and network security assessment
- Supplier management process check
- Incident management and emergency response capability
- Business continuity, backup and restore assessment
- Prototype protection measures assessment
- Data protection and privacy compliance assessment
The output is a clear remediation list and implementation road map, so the whole team knows what is still missing, how to fill it, who is responsible and when it has to be finished.
Documents are customised to your real situation. Templates that stay generic tend to fail the moment an assessor asks how the process actually runs, so we adapt each one to your structure, processes, IT environment and assessment objective.
- Information security management manual
- Information security policy
- Information security organisation and responsibilities
- Information asset management procedure
- Risk assessment and risk treatment procedure
- Access control management procedure
- Password and account management rules
- IT operations management rules
- Backup and restore management rules
- Malware protection management rules
- Vulnerability and patch management rules
- Supplier information security management procedure
- Joiner, in-service and leaver security process
- Security incident management procedure
- Business continuity management procedure
- Physical security management rules
- Prototype protection management rules
- Data protection and personal information handling rules
- Training and awareness record templates
- Internal audit and management review record templates
Following the gap analysis, we help you build and run the management processes and technical controls that TISAX preparation calls for. The working principle is simple: it has to be executable, it has to produce evidence, and it has to hold up during the assessment.
- Information asset identification and classification
- Information security risk assessment
- Permission approval and account management
- Visitor management and area control
- Document and data classification
- Passing security requirements down to suppliers
- Employee confidentiality agreements and security undertakings
- Information security training
- Security incident reporting mechanism
- Backup and restore testing
- Prototype receipt, storage, transport and disposal control
- Project data access permission control
- Meeting, photography and outgoing material rules
- Remote working and mobile device security
06 / Process
The eight steps of a RASOO TISAX project
The order matters: each step produces the input the next one needs.
-
01
Project kick-off and requirement confirmation
Our consultants hold a kick-off meeting with you to confirm the certification goal, customer requirements, business scope, sites involved, assessment level, project timeline and the responsibilities of both sides.
Deliverables Project plan · task and owner matrix · schedule · required document list · recommended certification route
-
02
Registration and scope confirmation coaching
We help you understand and complete the preparation around the TISAX platform: organisation registration preparation, assessment scope confirmation, assessment objective selection, advice on selecting an audit provider, support in discussing audit quotations, and coordination of the assessment plan.
The point is to set the right route from day one, so that registration details, scope or objective choices do not create risk later in the assessment.
-
03
VDA ISA self-assessment coaching
A TISAX assessment is normally based on the VDA ISA questionnaire. We take you through the requirements item by item and guide the self-assessment: interpretation of each control, how the maturity scoring works, what evidence is needed, where the risk points are, how to design improvement measures, and how to complete the self-assessment sheet.
The aim is that your team understands the assessment logic behind each requirement, rather than simply filling in a form.
-
04
Building and implementing the processes
Based on the gap analysis, we help you establish and put into practice the management processes and technical controls required — from asset classification and risk assessment through access approval, visitor control, supplier requirements, training and incident reporting, to prototype handling and mobile device security.
We work to the principle that a control must be executable, must produce evidence and must survive an assessment, which avoids the common trap of documents without implementation.
-
05
Evidence material preparation
During the assessment, the assessor examines not only your documents but also the evidence that they were followed. We help assemble the complete evidence pack: training records, risk assessment records, asset inventories, permission approvals, supplier evaluations, backup tests, vulnerability or patch records, incident drills, visitor registers, door access lists, confidentiality agreements, internal audit and management review records, prototype protection checks and corrective action tracking.
Everything is checked for completeness before the assessment so your team can answer with confidence.
-
06
Mock audit (pre-audit)
Before the formal assessment we can run a mock audit: a clause-by-clause check against VDA ISA, simulated interviews with management, IT and business departments, sampling of documents and records, on-site or remote evidence checks, prediction of potential findings, and a question-and-answer rehearsal.
Afterwards you receive a problem list with remediation advice, so the last round of optimisation happens before the assessor arrives.
-
07
Support during the formal assessment
During the assessment itself we can provide accompanying support: a preparation meeting, organisation of assessment material, coaching on answering questions, help interpreting what the assessor is asking, judgement on the risk behind potential findings, background support through the assessment days, and a review afterwards.
The goal is straightforward — that your team faces the assessment with more confidence and better organisation.
-
08
Corrective actions and obtaining the label
If findings or improvement requirements come out of the assessment, we support root cause analysis, corrective action planning, additional evidence and closure: cause analysis, corrective measures, assignment of responsibility, evidence preparation, writing the response documents, communication support with the audit provider, closing the open points, and support through the process of obtaining the TISAX label.
07 / Outcomes
What clients typically have at the end
- A defined TISAX assessment scope and objective
- A completed VDA ISA self-assessment
- An information security management system that matches assessment requirements
- Improved information security, prototype protection and data protection controls
- A complete set of assessment evidence
- Better information security awareness among employees
- Lower risk of findings during the assessment
- Corrective actions completed and closed after the assessment
- A TISAX label obtained
- Customer entry, tender and supply chain compliance requirements met
08 / Timing
Why it pays to start before the customer asks
Many companies only begin preparing for TISAX once a customer has already asked for it. That usually means a short deadline, missing records, incomplete processes, unfamiliar staff and IT controls that are not yet in place. When preparation is thin, the assessment can be delayed, remediation drags on, and in some cases the customer project itself is affected.
Starting earlier helps you:
- Respond faster to vehicle manufacturer and Tier-1 requirements
- Compete more strongly for a place in the international automotive supply chain
- Protect sensitive customer information and development data
- Reduce the risk of information leakage
- Bring internal information security management into order
- Strengthen customer trust
- Lay a foundation for the compliance requirements that come next
09 / Coverage
Regions we serve
Remote delivery means our service area is not limited by where our offices sit. Select a region to see the countries and territories covered.
Asia — 48 countries
- China
- Mongolia
- North Korea
- South Korea
- Japan
- Philippines
- Vietnam
- Laos
- Cambodia
- Myanmar
- Thailand
- Malaysia
- Brunei
- Singapore
- Indonesia
- Timor-Leste
- Nepal
- Bhutan
- Bangladesh
- India
- Pakistan
- Sri Lanka
- Maldives
- Kazakhstan
- Kyrgyzstan
- Tajikistan
- Uzbekistan
- Turkmenistan
- Afghanistan
- Iraq
- Iran
- Syria
- Jordan
- Lebanon
- Israel
- Palestine
- Saudi Arabia
- Bahrain
- Qatar
- Kuwait
- United Arab Emirates
- Oman
- Yemen
- Georgia
- Armenia
- Azerbaijan
- Türkiye
- Cyprus
Europe — 44 countries and 2 territories
- Finland
- Sweden
- Norway
- Iceland
- Denmark
- Faroe Islands
- Estonia
- Latvia
- Lithuania
- Moldova
- Belarus
- Russia
- Ukraine
- Poland
- Czechia
- Slovakia
- Hungary
- Germany
- Austria
- Switzerland
- Liechtenstein
- United Kingdom
- Ireland
- Netherlands
- Belgium
- Luxembourg
- France
- Monaco
- Romania
- Bulgaria
- Serbia
- North Macedonia
- Slovenia
- Croatia
- Montenegro
- Bosnia and Herzegovina
- Albania
- Greece
- Italy
- Malta
- Vatican City
- San Marino
- Spain
- Portugal
- Andorra
- Gibraltar
Africa — 54 countries and 7 territories
- Egypt
- Libya
- Tunisia
- Algeria
- Morocco
- Sudan
- South Sudan
- Ethiopia
- Eritrea
- Somalia
- Djibouti
- Kenya
- Tanzania
- Uganda
- Rwanda
- Burundi
- Seychelles
- Chad
- Central African Republic
- Cameroon
- Equatorial Guinea
- Gabon
- Republic of the Congo
- Democratic Republic of the Congo
- São Tomé and Príncipe
- Mauritania
- Senegal
- Gambia
- Mali
- Burkina Faso
- Guinea
- Guinea-Bissau
- Cabo Verde
- Sierra Leone
- Liberia
- Côte d'Ivoire
- Ghana
- Togo
- Benin
- Niger
- Nigeria
- Zambia
- Angola
- Zimbabwe
- Malawi
- Mozambique
- Botswana
- Namibia
- South Africa
- Eswatini
- Lesotho
- Madagascar
- Comoros
- Mauritius
North America — 23 countries and 17 territories
- Canada
- United States
- Mexico
- Guatemala
- Belize
- El Salvador
- Honduras
- Nicaragua
- Costa Rica
- Panama
- Bahamas
- Cuba
- Jamaica
- Haiti
- Dominican Republic
- Antigua and Barbuda
- Saint Kitts and Nevis
- Dominica
- Saint Lucia
- Saint Vincent and the Grenadines
- Grenada
- Barbados
- Trinidad and Tobago
South America — 12 countries and 2 territories
- Colombia
- Venezuela
- Guyana
- Suriname
- Ecuador
- Peru
- Bolivia
- Brazil
- Chile
- Argentina
- Uruguay
- Paraguay
Oceania — 16 countries and 8 territories
- Australia
- New Zealand
- Palau
- Federated States of Micronesia
- Marshall Islands
- Kiribati
- Nauru
- Papua New Guinea
- Solomon Islands
- Vanuatu
- Fiji
- Tuvalu
- Samoa
- Tonga
- Cook Islands
- Niue
If a customer has already asked you for a TISAX label, the clock has started
Contact RASOO for an initial discussion and advice on your certification route, at no charge. We can help you work out whether TISAX applies to you, confirm a suitable assessment objective and scope, assess your current gaps, build an implementation plan, coach your team remotely through preparation, support the formal assessment and close corrective actions — through to obtaining the TISAX label.
RASOO Certification Consulting — making TISAX preparation clearer, faster and easier to control.
Two versions of our summary
English
RASOO provides professional global TISAX consulting services for automotive supply chain companies. Through remote consulting, gap analysis, documentation support, VDA ISA self-assessment guidance, mock audits, audit support and corrective action assistance, we help clients efficiently prepare for TISAX assessments and obtain TISAX labels. Our services are suitable for automotive suppliers, software developers, engineering service providers, prototype manufacturers, testing service providers and companies handling confidential customer information.
中文
RASOO 咨询公司专业提供全球 TISAX 认证咨询服务。我们通过远程辅导、差距分析、体系文件建设、VDA ISA 自评估指导、模拟审核、正式审核陪跑及整改支持，帮助汽车产业链企业高效完成 TISAX 认证准备并获取 TISAX Label。无论您是零部件制造商、软件开发商、工程服务商，还是原型件、测试数据或客户机密信息的处理方，RASOO 都可以为您提供专业、灵活、高效的认证咨询方案。
10 / Contact Us
Tell us where you are in the process
Send the form, or message the office for your region directly on WhatsApp or by email.
Asia
Hong Kong office
WhatsApp+852 6660 8230
Emailasia@rasoogroup.com
English and Chinese · Hong Kong time