What TISAX Actually Requires Before You Move Production Workloads to AWS, GCP, or Azure

TISAX assesses an automotive supplier’s information security practices rather than certifying its chosen cloud provider, so AWS, Azure, Google Cloud, and other providers’ own TISAX, ISO 27001, or C5 attestations cover only their portion of shared responsibility. Suppliers must obtain and share their own TISAX labels through the ENX exchange, with assessment objectives determining whether AL2 or the more comprehensive, on-site AL3 assessment is required; prototype data, strictly confidential information, special data, and very high availability generally require AL3. Cloud-based evidence must demonstrate data classification, documented processing locations, least-privilege IAM and access reviews, encryption and key custody, separation of prototype, production, and non-production environments, retained logs, tested restores, patching, change management, incident processes, and supplier due diligence, including GDPR processor obligations where personal data is involved. The article argues that providers remain responsible for physical infrastructure while customers retain responsibility for configurations, data, workload security, and audit evidence, including managed Kubernetes operations. It also contrasts SaaS platforms, bring-your-own-cloud platforms, and self-managed Kubernetes, contending that retaining cloud accounts, keys, data, logs, and regional choices in the supplier’s name can simplify control and evidence collection, while emphasizing that no platform itself makes an organization TISAX compliant.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.