TISAX 6.1.1 – Contractors & Cooperation Partners

General Guidance for Organisations Working Toward a TISAX Label

The Problem

Many organisations hire contractors, consultants, freelancers, service partners, and cooperation partners. However, they often overlook applying the same information security controls to their external teams. TISAX requires a structured approach to manage all third parties with access to sensitive information. This requirement is not limited to IT service providers. By ensuring consistency, organisations can better protect their data from external risks.

During assessments, several common gaps frequently appear:

• Often, organisations perform risk assessments solely for IT suppliers, neglecting other contractor and partner categories.
• Another issue is the absence of requirements to cascade client security obligations to subcontractors, also known as “flow-down” clauses.
• In addition, some organisations lack a defined process to verify compliance with contractual information security requirements.
• Contractors are sometimes not required to flow down obligations to their subcontractors, which can create security gaps.
• Furthermore, oversight or review of service reports, deliverables, or contractor-created documentation is often missing.
• Many organisations also lack structured processes covering non-IT contractors, such as those handling cleaning, maintenance, logistics, or specialised tasks.

Consequently, these gaps weaken the security of the entire supply chain. In many cases, they also result in non-conformities during TISAX assessments, creating additional risks for the organisation.

Solution

To reach TISAX conformity, organisations need to implement a thorough third-party management process that covers all contractors and cooperation partners. For example, a robust solution should include the following elements:

• A Third‑Party Security Risk Assessment procedure covering every type of external partner, not just IT providers.
• Standardised contractual wording that:
  • Defines security requirements
  • Includes confidentiality obligations
  • Requires appropriate security measures
  • Mandates “flow‑down” of relevant client and organisational requirements
• Clear processes for:
  • Assessing contractor risk before engagement
  • Reviewing and monitoring contractor compliance
  • Handling deficiencies or incidents involving contractors
• A requirement that contractors:
  • Pass relevant security obligations to their own subcontractors,
  • Maintain documented evidence of compliance.
• A structured approach to reviewing service reports, performance records, and delivered documents to ensure they align with contractual security requirements.

As a result, this approach builds a lifecycle-based framework that protects sensitive information whenever an organisation works with external parties. Over time, such a framework becomes a key part of secure operations.

Deliverables

Organisations aiming for TISAX compliance must implement and maintain several important components. By focusing on these elements, they can meet key requirements and strengthen their security posture.

Policies & Procedures

• A Third‑Party Management Policy covering:
  • Scope (all contractors, partners, and suppliers)
  • Risk assessment requirements
  • Contractual security expectations
  • Monitoring and verification activities
  • Handling of subcontractors
• A Third‑Party Risk Assessment Procedure with:
  • Risk scoring
  • Categorisation of contractors
  • Required controls for each risk level
• Develop and maintain a Service Review Procedure. This should detail how contractor reports, deliverables, and performance are reviewed. It should also explain how they are evaluated over time.

Contractual Documentation

• Standard contract templates including:
  • Security requirements
  • Confidentiality clauses
  • Obligations to follow organisational and client security requirements
  • Mandatory flow‑down to subcontractors
  • Audit/verification rights
• NDA templates for all contractor types.

Oversight & Evidence

• Contractor risk assessment records.
• Evidence of contract reviews and approvals.
• Monitoring and compliance check logs.
• Records of reviewed service reports and deliverables.
• Documentation showing subcontractor requirements has been flowed down.

Supporting Tools

• A contractor register showing:
  • Contractor category
  • Assigned risk level
  • Contractual controls
  • Review dates
  • Subcontractor involvement

Outcomes

When organisations implement these controls, they achieve several key outcomes. These results not only improve security but also demonstrate a commitment to best practices.

• A consistent and structured approach to managing all contractors and cooperation partners.
• Clear evidence that security requirements are applied before, during, and after contractor engagements.
• Stronger protection of client and organisational information throughout the supply chain.
• Assurance that subcontractors are also bound by appropriate security requirements.
• Improved transparency and oversight through documented reviews and contractor performance checks.

Altogether, these outcomes show alignment with TISAX Maturity Level 3.0 and help reduce risks across the supply chain.

Benefits or Results

By adopting this approach, organisations gain a wide range of benefits. These advantages strengthen their position in the industry and improve overall trust.

• Stronger due diligence and reduced third‑party risk.
• Clear contractual protection that extends throughout the supply chain.
• Better visibility into contractor performance and compliance.
• Reduced the likelihood of TISAX non‑conformities related to supplier management.
• Greater trust and confidence from clients, especially those requiring inherited security controls.