• SOC 2 Readiness
  • 24/7 Security Monitoring
  • Canadian-Based SOC

Manufacturing · Independent penetration test for TISAX · Scoping brief

Independent penetration testing for a TISAX Level 3 assessment.

A manufacturer in the final stage of a TISAX Level 3 assessment needed a penetration test from a party independent of the provider that manages its network.
Book a consultationAll case studies
A factory protected by a security shield

Scoping brief. This describes a problem a buyer brought to GuardsArm and how the engagement was scoped. It is not a record of delivered work, and no results are claimed. The organization is not named.

Organization
US automotive-supply manufacturer
Stage
Scoping brief
Sector
Manufacturing
Service
Independent penetration test for TISAX

The situation

A tubular metals manufacturer supplying automotive customers was in the final stage of a TISAX Level 3 assessment.

It needed a penetration test from a party independent of the provider that runs its network. Testing your own managed environment does not satisfy the separation of duties the standard expects.

How we scoped it

  • External testing of a VPN-only perimeter across two states
  • Internal testing of about 200 hosts across seven network segments and three sites, including directory services
  • One internal web application and a light-touch cloud identity review
  • A 100-user phishing exercise, excluding shared mailboxes
  • Production equipment observed passively only, so the plant floor is never put at risk
  • Testing scheduled over a plant shutdown weekend to avoid production impact
  • A full paperwork set: statement of work, mutual NDA, authorization letter and rules of engagement

What a buyer in this position should ask any provider

  1. Are you independent of our managed service provider?
  2. How do you treat operational technology?
  3. When do you test relative to our production schedule?

Planned deliverables

  • Technical report
  • Executive summary
  • Remediation tracker
  • Retest
  • Evidence suited to the TISAX assessor

More from the record

DeliveredHealthcare

Health Information Act compliance scoping assessment

Two clinics, one clear picture of their privacy and security position.

Two clinics under shared ownership had privacy documentation on file, and no independent check of whether day-to-day systems matched it.

Silverado Medical Clinic and Vanguard Medical Clinic

Read the case study
DeliveredSoftware

External penetration test and verification retest

No critical or high findings, and a retest that checked every fix.

J-SAS wanted an independent test of its internet-facing systems and proof that issues raised in a prior-year assessment had been dealt with.

J-SAS Inc.

Read the case study
DeliveredHealthcare software

External penetration test

Independent confirmation that last year's fixes held.

AbleSoft builds practice software used with patient records. It wanted independent confirmation of its current external position.

AbleSoft

Read the case study

Facing the same question?

Tell us what you need tested, monitored or evidenced. We will come back with a scope you can act on.
Book a consultationRequest a demo
Book Now