MRIS for TISAX® ISA 2027, Information Security module. Edition 2.0, September 2026

Do your TISAX® controls still work when the attacker is an AI?

MRIS analyzes the 45 controls of the ISA 2027 Information Security module with their 330 requirements against AI-accelerated attacks. 74 individual findings show where protective effect weakens, and the Implementation Guide describes the hardening with 10 MHC and 6 standalone measures.

Download the analysis (PDF) Implementation Guide (PDF)

Free under CC BY-NC 4.0, no registration. What is analyzed is the requirement wording, not any specific organization’s implementation. Independent work, not authorized by ENX.

Select a cell to see the control, its classification and the hardening measure.

All 45 controls

45 controls: 4 robust, 26 partially degraded, 1 friction-only, 14 not affected. Classification for the normal case.

Ch. 1

Ch. 2

Ch. 3

Ch. 4

Ch. 5

Ch. 6

Ch. 7

Findings matrix

All 45 controls with their overall classification, the share of affected requirements and the 74 individual findings with their hardening reference. Some controls are classified differently at high protection requirements; this is noted for each.

Search controls and findings

45 of 45 controls

Findings matrix of the 45 controls of TISAX® ISA 2027, Information Security module
Control	Topic and findings	Classification	Affected
Chapter 1 Policies and organization 14 controls
1.1.1	Information security policies Policy review not event-driven (“periodic”) MHC-10	partially degraded	1/10
1.2.1	Information security management (ISMS) ISMS effectiveness review not event-driven MHC-10	partially degraded	1/7
1.2.2	Information security responsibilities Segregation of duties organizational only, not technically enforced standalone measure	not affectedat high protection requirement: partially degraded	0/7
1.2.3	Information security in projects	not affected	0/5
1.3.1	Inventory of information assets Asset inventory maintenance not event-driven MHC-10	partially degraded	1/3
1.3.2	Classification of information assets by protection requirement	not affected	0/4
1.3.3	Approval of external IT services AI agent can call external services without approval MHC-13 Approval sample check with no ongoing detection MHC-10	partially degraded	2/6
1.3.4	Approval of software AI coding assistant loads software packages without approval MHC-13 Same gap for specialist software (maintenance tools) MHC-13 Repository protection: signature check not mandatory MHC-13 Software approval review not event-driven MHC-10 Patch status known, but no response speed required MHC-09	partially degraded	5/8
1.4.1	Information security risk management Risk assessment still assumes a narrow attacker circle standalone measure Same gap at the level of the assessment criteria standalone measure	partially degraded	2/8
1.5.1	Compliance in procedures and processes Policy compliance review not event-driven MHC-10 Requirements compliance review not event-driven MHC-10 Group-wide audit plan with no trigger for new sites MHC-10	partially degraded	3/10
1.5.2	Independent review of the ISMS	not affected	0/5
1.6.1	Reporting of security events and observations Reporting system does not detect fragmented attack steps MHC-05	partially degraded	1/9
1.6.2	Handling of security events Incident handling purely human, no automation obligation MHC-11 Same gap in responding to reports MHC-11 Response time targets with no automation obligation to meet them MHC-11 Escalation mechanism itself remains human-borne MHC-11	partially degraded	4/13
1.6.3	Crisis preparedness Crisis detection designed for gradual, not rapid, escalation MHC-05 Crisis plan updating not event-driven MHC-10 Crisis scenarios do not include an AI-orchestrated multi-track attack standalone measure Crisis scenarios do not include an AI-orchestrated multi-track attack (editorial catalogue duplicate, see data quality note) standalone measure Communication strategy has no shortened response window MHC-05 Communication strategy has no shortened response window (editorial catalogue duplicate, see data quality note) MHC-05 Crisis plan assessment not event-driven MHC-10	partially degraded	7/19
Chapter 2 Human resources 4 controls
2.1.1	Qualification of staff for sensitive work Identity check vulnerable to a deepfake applicant identity MHC-15 Live interview vulnerable to a real-time deepfake MHC-15 References and testimonials more easily forged MHC-15	partially degraded	3/5
2.1.2	Staff commitment to information security	not affected	0/5
2.1.3	Awareness and training Awareness training designed around outdated phishing recognition markers MHC-15	partially degraded	1/7
2.1.4	Mobile working	not affectedat high protection requirement: robust	0/3
Chapter 3 Physical security 3 controls
3.1.1	Security zones and physical access Access control vulnerable to AI-supported pretence MHC-15 Visitor registration vulnerable to forged credentials MHC-15	partially degraded	2/9
3.1.3	Handling of supporting assets	not affectedat high protection requirement: robust	0/1
3.1.4	Mobile devices and storage media Encryption of mobile devices not mandatorily prescribed standalone measure	partially degradedat high protection requirement: robust	1/2
Chapter 4 Identity and access management 4 controls
4.1.1	Identification means Locking of lost credentials not immediate or automated MHC-03	not affectedat high protection requirement: partially degraded	0/2
4.1.2	User access and authentication “State of the art” does not enforce phishing resistance MHC-03 Password strength ineffective against real-time phishing MHC-03 Privileged accounts: simple 2FA without phishing resistance suffices MHC-03 List of options allows fulfilment without phishing resistance MHC-03 Two-factor example carries no phishing-resistance obligation MHC-03	friction-only	1/7 (friction) + 4/7 (degraded)
4.1.3	User accounts and login information Account review not event-driven MHC-10 Possession factor (SMS OTP) vulnerable to SIM swapping MHC-03 Account review in customer systems not event-driven MHC-10	partially degraded	3/17
4.2.1	Assignment of access rights Access rights review not event-driven MHC-10 Shorter review interval remains periodic, not event-driven MHC-10	partially degradedat high protection requirement: 2/10 affected	1/7
Chapter 5 IT security 15 controls
5.1.1	Cryptographic procedures	robust	0/3
5.1.2	Protection during transfer Transport protection with no mandatory minimum encryption standard standalone measure Remote access: VPN protects the transport path, not authentication MHC-03	partially degraded	2/6
5.2.1	Change management	not affected	0/6
5.2.2	Separation of development, test and production	robust	0/3
5.2.3	Protection against malware Signature-based malware protection weak against AI-generated variants MHC-05 Virus scanner example signals signature-based detection MHC-05 Same signature detection limit in file scanning MHC-05 Full scan periodic and signature-based — a double weakness MHC-05 Encrypted content bypasses gateway inspection MHC-05	partially degraded	5/10
5.2.4	Event logging and analysis Log review does not detect fragmented attack patterns MHC-05	partially degraded	1/8
5.2.5	Vulnerability management Vulnerability assessment underestimates the shortened exploit window MHC-09 Patch management with no mandatory speed SLA MHC-09	partially degraded	3/6
5.2.6	Technical system and service audits Remediation deadline (“appropriate timeframe”) indefinite MHC-09 Audit cycle leaves the patch gap open between reviews MHC-09 Scan frequency only periodic even at very high MHC-09	partially degradedat high protection requirement: 3/10 affected	2/8
5.2.7	Network management Lateral movement detection not behaviour-based MHC-05 Remote access risk imports the authentication gap from 4.1.2 MHC-03	partially degradedat high protection requirement: 2/5 affected	1/4
5.2.8	IT service continuity planning Contingency plan updating not event-driven MHC-08 Backup protection with no immutability requirement (integrity) MHC-08 Same gap, confidentiality side MHC-08	partially degradedat high protection requirement: 3/15 affected	1/5
5.2.9	Backup and recovery Review of the backup concept not event-driven MHC-10	not affectedat high protection requirement: partially degraded	0/3
5.3.1	Information security in new or further developed IT services Test data: no re-identification-resistant anonymization required standalone measure	partially degraded	1/10
5.3.2	Requirements for network services	robust	0/5
5.3.3	Return and deletion with external services	not affected	0/2
5.3.4	Protection in shared external services	robust	0/2
Chapter 6 Supplier relationships 3 controls
6.1.1	Information security with contractors and partners Supplier reports with no independent counter-check MHC-14 Self-declaration or attestation sufficient as evidence MHC-14 Review frequency good, evidence authenticity problem remains MHC-14 Same evidence authenticity gap in contract review MHC-14	partially degradedat high protection requirement: 4/10 affected	1/5
6.1.2	Non-disclosure agreements NDA handling procedure not event-driven MHC-10	partially degraded	1/9
6.1.3	Responsibilities between external IT service providers and the organization Service provider configuration checked periodically rather than continuously MHC-10 Unspecified evidence with no independent verification MHC-14 Authentication mechanisms carry no phishing-resistance obligation MHC-03	not affectedat high protection requirement: partially degraded	0/7
Chapter 7 Compliance 2 controls
7.1.1	Compliance with regulatory and contractual provisions	not affected	0/3
7.1.2	Protection of personal data	not affected	0/3

“Affected” shows how many requirements of a control are affected in the normal case. The control topics are MRIS working titles, not the wording of the VDA ISA catalog.

Four analysis criteria

Every requirement is checked against four shifts in attack reality. If its protective assumption does not hold up against one of them, it loses effect.

Attacker patience: AI attackers work on a target indefinitely, in parallel and without fatigue.
Time compression: Minutes, not days, pass between initial access and damage.
Aggregation resistance: Fragmented individual steps stay below every reporting and detection threshold.
Capability decoupling: Attack capability no longer depends on the actor’s resources.

Eight patterns behind the 74 findings

Most findings recur across chapters. The most frequent: wording such as “regularly” mandates no event-driven response mechanism. The last column shows whether other frameworks already solve the pattern.

Pattern clusters of the individual findings
Pattern	Findings	Controls	Dominant criterion	Status in other frameworks
Periodic rather than event-driven review1.1.1, 1.2.1, 1.3.1, 1.3.3, 1.3.4, 1.5.1, 1.6.3, 4.1.3, 4.2.1, 5.2.9, 6.1.2, 6.1.3	19	12	Time compression	Partially addressed industry-wide
Collapse of the patch gap window / ransomware resilience1.3.4, 5.2.5, 5.2.6, 5.2.8	9	4	Time compression	Patch deadlines resolved, backup immutability open
Missing phishing-resistant authentication4.1.1, 4.1.2, 4.1.3, 5.1.2, 5.2.7, 6.1.3	10	6	Capability decoupling / time compression	Partially addressed industry-wide
AI-supported identity and document forgery2.1.1, 2.1.3, 3.1.1, 6.1.1, 6.1.3	11	5	Capability decoupling	Suppliers partially addressed; personnel and access TISAX®-original
Signature-based detection versus AI-generated malware5.2.3	5	1	Capability decoupling	Predominantly original
Aggregation resistance1.6.1, 1.6.3, 5.2.4, 5.2.7	4	4	Aggregation resistance	Predominantly original
Autonomous AI agents bypass approval processes1.3.3, 1.3.4	4	2	Capability decoupling	Universally unresolved
Missing automation obligation in response1.6.2	4	1	Time compression	Addressed de facto industry-wide
Individual findings (no recurring pattern)1.2.2, 1.4.1, 1.6.3, 3.1.4, 5.1.2, 5.3.1	8	6	—	–

Reference frameworks: NIST CSF 2.0, BSI C5:2026, DORA, CRA, NIS2 Directive and IR, ISA/IEC 62443-2-1.

The eight patterns in detail: comparison with six frameworks and consequences for hardening

Classification per chapter

58% of controls lose part of their protective effect, mostly because periodic wording mandates no event-driven mechanism. Only one control loses its core effect entirely: 4.1.2, the pure password factor without a second factor.

Robust: 4; 9%; Keeps working structurally: cryptographic or architectural hardness.
Partially degraded: 26; 58%; Works with limitations and needs flanking hardening.
Friction-only: 1; 2%; The classic implementation loses its standalone protective effect and must be replaced or redesigned.
Not affected: 14; 31%; Neutral towards the AI threat and remains important unchanged.

Classification per chapter in the normal case
Chapter	Controls	Robust	Partially degraded	Friction-only	Not affected
1 Policies and organization	14	–	10	–	4
2 Human resources	4	–	2	–	2
3 Physical security	3	–	2	–	1
4 Identity and access management	4	–	2	1	1
5 IT security	15	4	8	–	3
6 Supplier relationships	3	–	2	–	1
7 Compliance	2	–	–	–	2

Chapter 3 contains one more control without requirements of its own (3.1.2, superseded by 1.6.3, 5.2.8 and 5.2.9).

Leverage: which measure carries how many findings

Number of individual findings (of 74) that each MHC carries, according to the findings table of the analysis. MHC-16 is an original addition without a TISAX® finding and becomes relevant as soon as several AI agents work together in production.

Coverage breadth per MHC in the TISAX® context
Measure	Findings	Controls	Character
MHC-10 Continuous control monitoring and policy as code	17	12	broad, cross-process
MHC-05 Behaviour-based detection and kill chain correlation	11	5	detection/correlation
MHC-03 Phishing-resistant multi-factor authentication	10of which 1 friction-only	6	identity/access
Standalone measures (6, see below)	8	6	no recurring pattern
MHC-09 AI-supported security testing in the pipeline	6	3	vulnerability/patch management
MHC-15 AI-resistant identity verification in personnel/access	6	3	personnel/facility
MHC-14 Independent verification of supplier evidence	5	2	supply chain/contract
MHC-11 SOAR-based tier 1 automation	4	1	incident response
MHC-13 AI agent governance and harness security	4	2	AI agent governance
MHC-08 Immutable backups and recovery validation	3	1	backup/recovery
MHC-16 Multi-agent integrity	0original	0	AI agent governance, forward-looking

Implementation Guide: hardening with 10 MHC and 6 standalone measures

The TISAX® Implementation Guide describes every MHC in the same structure as the ISO/IEC 27001 guide: hardening control statement, purpose and threat reference, organizational and technical implementation, examples, maturity path, measurement and audit evidence, typical mistakes, and scope and residual risk.

Prioritization for TISAX®

The basis is the Threat Priority Score: threat relevance × business impact × exposure × control gap. The order deliberately differs from the ISO guide: here MHC-09 and MHC-13 are in P0.

P0 immediate

MHC-03 Phishing-Resistant MFACloses the single friction-only finding of the entire analysis.
MHC-08 Immutable BackupsA technically clearly delineated, established measure (object lock/WORM) with low implementation effort and high leverage against ransomware; unlike for MHC-09, C5:2026 formulates no binding immutability requirement here — the urgency follows from the threat landscape, not from an already existing external standard.
MHC-09 AI-Assisted Security TestingClosing the patch gap: C5:2026 already requires a defined, CVSS-bound deadline framework (OPS-25.01AC) — low implementation effort, high leverage.
MHC-13 AI Agent GovernanceThe largest standalone gap — no external framework yet supplies a solution, urgency rises with every day of ungoverned AI agent deployment.

P1 next

MHC-10 Continuous Control MonitoringThe greatest coverage breadth, but higher change-management effort across 12 controls.
MHC-14 Independent Verification of Supplier EvidenceA contract clause addition is comparatively simple but takes full effect only with the next review cycle.
MHC-11 SOAR and Tier-1 AutomationBuilds on MHC-09/MHC-03; more effective once those are already taking hold.

P2 risk-based

MHC-15 AI-Resistant Identity Verification for Staff/AccessHigh effort (an HR/site security process change), an original development with no external template.
MHC-05 Behavior-Based DetectionThe technically most demanding measure (EDR/XDR product selection, building UEBA correlation), presupposes a partly existing SIEM basis.
MHC-16 Multi-Agent IntegrityOriginal and forward-looking — relevant once several agents communicate with each other in production; presupposes MHC-13.

Standalone measures without a recurring pattern

Eight findings in six controls cannot be assigned sensibly to an MHC. The guide recommends targeted supplements for them:

Standalone measures
Control	Finding	Recommended supplement
1.2.2	Segregation of duties underminable by an AI-enabled dual role	Enforce critical segregation of duties additionally at system level (separate system rights, four-eyes approval within the system itself), not only organizationally
1.4.1	The risk assessment methodology assumes a narrowly limited circle of perpetrators — both at the level of the assessment itself and of the underlying assessment criteria	Extend the methodology with a reassessment obligation on a significantly widened circle of perpetrators (AI accessibility of a capability), not only on new individual vulnerabilities — applies equally to the assessment outcome and the assessment criteria
1.6.3	AI-orchestrated scenarios not provided for in crisis planning	Extend the crisis scenario catalogue by at least one AI-orchestrated, multi-track escalation scenario (see also MHC-05)
3.1.4	PIN/password as the sole fallback option with no encryption obligation	Encryption of mobile devices/storage media as a minimum requirement, irrespective of protection requirement level
5.1.2	Unspecific measures for remote access with no minimum standard	Encryption as a mandatory minimum standard already at the must level, not only from high onward
5.3.1	Re-identification of pseudonymized data through AI correlation	Extend the pseudonymization methodology with a re-identification risk assessment that takes account of AI-supported correlation methods

Download the Implementation Guide (PDF, English)

What MRIS does and deliberately does not do

MRIS provides

An effectiveness analysis of all 45 controls with 330 requirements of the ISA 2027 Information Security module
A gap analysis against NIST CSF 2.0, C5:2026, DORA, CRA, NIS2 and ISA/IEC 62443-2-1
Implementation guidance for 10 MHC with maturity paths and audit evidence
A Threat Priority Score and a roadmap from P0 to P2

MRIS deliberately does not provide

Not part of the official TISAX® assessment process, not authorized by ENX
No substitute for a maturity assessment by an accredited audit provider
No analysis of any specific organization’s implementation; the wording is analyzed
Prototype Protection and Data Protection are outside the scope of this analysis

A market comparison currently exists only for the ISO context; TISAX® is not scored there as a separate data point. Market comparison on the ISO page

Downloads

Publications on MRIS for TISAX®
Publication	Edition	Date	License	Files
Analysis, Part I	2.0	September 2026	CC BY-NC 4.0	DE EN
Implementation Guide	2.0	September 2026	CC BY-NC 4.0	DE EN

TISAX® is a registered trademark of the ENX Association; the ENX Association administers TISAX® on behalf of the VDA. This analysis is an independent, privately produced work with no affiliation to the ENX Association or the VDA, neither part of the official TISAX® assessment process nor authorized by ENX, and no substitute for a maturity assessment by an accredited audit provider. No legal or certification advice; use at your own responsibility.