ZF requires appropriate protection of information shared with suppliers. Depending on the type of business relationship, suppliers may be requested to provide evidence that an Information Security Management System (ISMS) has been assessed or certified by a recognized third party.

ZF also requires supplier services to be secured and available at any time. When needed, ZF may request a high or very high availability of the service to ensure ZF business continuity.

ISMS evidence helps to ensure that confidential information, technical documentation, intellectual property, personal data, prototype information and other sensitive business information are handled securely.

Compliance with this ISMS requirement may be demonstrated by:

• a valid TISAX assessment (or)
• where accepted by ZF, an ISO/IEC 27001:2022 certificate whose certified scope fully covers the relevant business relationship with ZF.

TISAX® (Trusted Information Security Assessment Exchange) is the automotive industry standard for assessing information security requirements and exchanging assessment results via the ENX platform. The ENX Association governs TISAX certification. Founded in 2000 by European automotive manufacturers, suppliers and national automotive associations, ENX defines and oversees industry standards.

For further information, please visit the ENX TISAX homepage:

ENX TISAX Homepage

Not every supplier needs to provide ISMS evidence.

The requirement applies to suppliers handling information, systems, processes, or products with increased confidentiality, integrity, or availability requirements.

The responsible ZF buyer will inform suppliers when ISMS evidence is required.

ZF accepts a valid TISAX assessment shared through the ENX portal. In specific cases, ZF may also accept a valid ISO/IEC 27001:2022 certificate if the certified scope covers the relevant locations, processes and activities related to the business relationship with ZF.

TISAX results must be shared with ZF using the ZF participant ID PLZRCC.

The applicable TISAX Assessment Objectives depend on the information, systems, products and activities involved in the business relationship with ZF. These objectives are derived from the Information Security Assessment (ISA) catalogue, which forms the basis of TISAX assessments and is maintained by the ENX Working Group ISA and published by the VDA.

The supplier shall monitor the validity of all ISMS evidence, including TISAX assessment results and/or ISO/IEC 27001:2022 certificates, and provide renewed evidence before the previous evidence expires. TISAX results shall be kept valid and available to ZF through the ENX portal, while renewed ISO/IEC 27001:2022 certificates shall be uploaded into SupplyOn (PM vendors) or ELSA (NPM vendors) in due time. Non-submission of relevant ISMS evidence when required may impact the supplier’s evaluation in the sourcing process.

Before renewing a TISAX assessment or ISO 27001 certification, suppliers should always review the latest ISMS ZF Requirements and the related downloadable instructions available in the ISMS section of the ZF Supplier Board and/or contact the responsible buyer to ensure that the renewed assessment or certification covers the business scope relevant to ZF.

Suppliers are responsible for the costs associated with their TISAX assessment and related audit activities unless otherwise agreed with ZF in writing.

Detailed requirements, including assessment objectives, assessment levels, ISO/IEC 27001:2022 acceptance criteria, validity expectations and evidence submission instructions, are provided in:

Information Security - ZF Requirements.