Automotive Supply Chain Security Benchmark
Yi-Fong Metal Industry Achieves TISAX Certification via SGS Assessment
Under the comprehensive guidance of Winners Consulting, Yi-Fong Metal Industry successfully passed SGS Taiwan assessment and obtained the TISAX (Trusted Information Security Assessment Exchange) label — the essential cybersecurity credential for entry into European automotive OEM supply chains.
Challenge
As a Taiwanese automotive metal component manufacturer supplying European OEMs, Yi-Fong Metal faced increasing cybersecurity requirements from European automotive customers. TISAX certification had become a mandatory prerequisite to maintain supply chain relationships. The company needed to build a complete VDA ISA-compliant information security management system without disrupting manufacturing operations, and pass third-party on-site assessment.
Winners Consulting Approach
TISAX Gap Analysis
Comprehensive gap assessment of existing security posture against VDA ISA 6.0 questionnaire, identifying high-risk gaps and prioritizing remediation.
System Documentation
Building TISAX-compliant information security policies, access control, supplier management, and incident response documentation — auditable and operational.
Internal Audit Simulation
Mock assessment exercises to familiarize staff with the SGS evaluation process, identify remaining gaps, and ensure high pass rates in formal assessment.
SGS On-site Support
Winners consultants accompanied the SGS Taiwan on-site assessment, providing real-time responses to assessor questions to ensure smooth completion.
Results
「Winners Consulting's deep expertise in automotive supply chain security certification — from system implementation to on-site support — helped us achieve TISAX certification on schedule, securing our European OEM partnerships.」
⚠️ VDA ISA2027 Published — Assessments Ordered by End-2026 May Still Use ISA 6.0.3
VDA ISA2027 was published in July 2026 and applies to all TISAX assessments ordered from 1 January 2027. Key changes: prototype protection is rebuilt into two labels, Basic (AL2) and Facilities (AL3), and 44 of the 46 information security controls were revised. Assessments ordered by 31 December 2026 may still be completed under ISA 6.0.3.
FAQ
How long does TISAX certification take?
Typically 4-9 months from gap analysis to label issuance, depending on existing security maturity. Winners helps accelerate the implementation process; most clients complete certification within 6 months.
What's the difference between TISAX and ISO 27001?
TISAX uses the VDA ISA questionnaire and is designed specifically for automotive supply chains, including automotive-specific requirements like prototype protection and data protection at assessment levels (AL1/AL2/AL3). ISO 27001 is a general information security standard. The two overlap significantly — organizations with ISO 27001 can substantially shorten TISAX implementation.
Why choose SGS for TISAX assessment?
SGS is one of the largest inspection, verification, testing and certification companies globally, and an ENX-authorized TISAX assessment body (TPEF). SGS Taiwan offers localized assessment services in Taiwan, enabling efficient communication for Taiwanese automotive suppliers.
Will VDA ISA2027 affect existing labels?
No. Existing labels keep their validity (up to three years). Assessments ordered from 1 January 2027 follow ISA2027; the catalogue for your next reassessment depends on when it is ordered.
What does Winners TISAX advisory include?
Full scope: VDA ISA gap analysis, policy documentation, employee training, internal audit simulation, and SGS on-site assessment support. Winners provides end-to-end advisory from kickoff to label issuance.
Ready to Start TISAX Certification?
Assessments ordered by 31 December 2026 may still use ISA 6.0.3; from 2027, ISA2027 applies. Winners offers a free TISAX gap analysis to assess your readiness and timeline.
Book Free TISAX Gap Analysis →