Look insideexample data
One supplier at a glance.
This is how Attestria shows where a supplier stands: maturity, deadlines and the work on evidence, for an example company. Every legal date comes with its source.
- Company
- Muster Präzisionstechnik GmbH (example)
- Industry
- Precision parts for automotive customers
- Size
- about 250 employees
- Goal
- TISAX AL3 with prototype protection
- As of
- 23 Oct 2026
01Maturity
Where does the company stand before the assessment?
Current and target level for each area of the VDA ISA catalogue, the largest gap first. Switch on the planned actions to see what they would change.
- Prototype protection: current 0.0, target 2.5 Prototype protection: after plan 2.0, target 2.5
- Operations security: current 1.8, target 2.8 Operations security: after plan 2.7, target 2.8
- Business continuity: current 2.0, target 3.0 Business continuity: after plan 3.0, target 3.0
- Compliance: current 1.5, target 2.5 Compliance: after plan 2.5, target 2.5
- Asset management: current 1.7, target 2.7 Asset management: after plan 2.3, target 2.7
- Access control: current 2.2, target 2.8 Access control: after plan 2.6, target 2.8
- Risk management: current 2.5, target 3.0 Risk management: after plan 3.0, target 3.0
- Suppliers: current 2.5, target 3.0 Suppliers: after plan 3.0, target 3.0
- Cryptography: current 2.7, target 3.0 Cryptography: after plan 3.0, target 3.0
- Policies and organisation: current 2.9, target 3.0 Policies and organisation: after plan 3.0, target 3.0
- Human resources: current 3.0, target 3.0 Human resources: after plan 3.0, target 3.0
- Physical security: current 2.5, target 2.5 Physical security: after plan 2.5, target 2.5
- Network security: current 3.0, target 3.0 Network security: after plan 3.0, target 3.0
- Incident management: current 3.0, target 3.0 Incident management: after plan 3.0, target 3.0
- Data protection: current 3.0, target 3.0 Data protection: after plan 3.0, target 3.0
Controls and levels of the example company (44 controls). After plan: the levels the actions in the calendar would reach.
02Deadlines
What is due when?
Audits, customer requests, actions and laws on one timeline. Pick an entry to see its dates, basis and source.
As of 23 Oct 2026
ISO 27001 certificate
Valid from 1 Mar 2025 to 28 Feb 2028, with a yearly surveillance audit.
Basis From the documents
ISO 27001: surveillance audit
Yearly per the certificate. The 2027 date is planned.
Basis Plan
ISO 27001: recertification
Planned before the certificate expires on 28 Feb 2028.
Basis Plan
Order the TISAX assessment
Ordered before 1 Jan 2027, the VDA ISA 6 catalogue still applies. After that, ISA2027 applies.
Basis Plan
TISAX assessment AL3 with prototype protection
Planned. Every action from the gap analysis should be finished before it.
Basis Plan
Needs first
- Archive policy v1.3 Within 30 days
- Reassess critical suppliers Within 30 days
- Approve the BCM handbook Within 30 days
- Acceptable-use policy with sign-off In progress
- Vulnerability and patch process In progress
- Mobile devices and teleworking Within 30 days
- Build a legal register Planned
- Close open risk treatments In progress
- Document secure development Planned
- Prototype protection concept Within 30 days
Needed before
- TISAX label, valid three years 12 Apr 2027 to 11 Apr 2030
TISAX label, valid three years
Labels are generally valid for three years. ENX advises starting the renewal at least a year before expiry.
Basis Plan
Needs first
- TISAX assessment AL3 with prototype protection Planned
TISAX pre-questionnaire customer B
35 controls, answered and approved.
Basis Plan
NIS2 supplier questionnaire customer A
Due on 30 Oct 2026.
Basis Plan
VDA ISA self-assessment customer B
Due on 27 Nov 2026.
Basis Plan
LkSG questionnaire customer C
Due on 29 Jan 2027.
Basis Plan
EcoVadis questionnaire customer D
VSME data request customer A
Under the CSRD value-chain cap: information within the VSME standard.
Basis Plan
Evidence key rotation
Rotation logs uploaded and approved.
Basis Plan
Controls CR-03
Reassess critical suppliers
Evidence for ongoing supplier monitoring.
Basis Plan
Controls SUP-02
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Close open risk treatments
Several treatments in the risk register are still open.
Basis Plan
Controls RM-02
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Vulnerability and patch process
No document yet. Draft since 12 Oct 2026.
Basis Plan
Controls VM-01
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Acceptable-use policy with sign-off
So far only mentioned in passing in the asset procedure.
Basis Plan
Controls AM-03
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Approve the BCM handbook
Version 0.9 is a draft. The restore tests should follow the backup policy (quarterly).
Basis Plan
Controls BC-01OPS-05
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Archive policy v1.3
The old version names no ISB and contradicts v2.1.
Basis Plan
Controls ORG-05
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Prototype protection concept
Secure areas, photo rules, secrecy with partners.
Basis Plan
Controls PT-01PT-02
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Mobile devices and teleworking
Rules for device management and for working from home.
Basis Plan
Controls MD-01
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Build a legal register
Applicable laws and standards with owners.
Basis Plan
Controls COMP-02
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Document secure development
For systems and scripts built in-house.
Basis Plan
Controls SD-01
Needed before
- TISAX assessment AL3 with prototype protection 8 Mar 2027 to 12 Mar 2027
Access recertification (quarterly)
Q1 2026 done per the record. Further quarters on the policy cadence.
Basis From the documents
- 27 Mar 2026
- 3 Jul 2026
- 2 Oct 2026
- 18 Dec 2026
- 26 Mar 2027
- 25 Jun 2027
- 24 Sep 2027
- 17 Dec 2027
Restore test (quarterly)
Quarterly per backup policy v1.3.
Basis From the documents
- 20 Mar 2026
- 19 Jun 2026
- 30 Sep 2026
- 11 Dec 2026
- 19 Mar 2027
- 18 Jun 2027
- 17 Sep 2027
- 10 Dec 2027
Management review (yearly)
Last held on 12 Jan 2026.
Basis From the documents
- 12 Jan 2026
- 18 Jan 2027
Internal ISMS audit
Last held in November 2025.
Basis Plan
Awareness training 2026
Completion in 2025 was 92%.
Basis Plan
German NIS2 act in force
Makers of motor-vehicle parts (NACE C29) with 50 or more employees are important entities.
Basis Law or standard
Source BGBl. 2025 I Nr. 301
NIS2: register with the BSI
CSRD Omnibus in force
Caps data requests to companies with up to 1,000 employees.
Basis Law or standard
Source Directive (EU) 2026/470
AI Act: general application
Annex III high-risk duties apply only from 2 Dec 2027.
Basis Law or standard
Source European Commission: AI Act
CRA: reporting duties
Report actively exploited vulnerabilities and severe incidents for products with digital elements.
Basis Law or standard
VDA ISA2027 for new assessments
Machinery Regulation applies
AI Act: high-risk (Annex III)
Postponed by Regulation (EU) 2026/1744.
Basis Law or standard
CRA: full application
All duties for products with digital elements.
Basis Law or standard
Arrow keys move from entry to entry.
03Evidence
How is the work on evidence going?
Every day of the last twelve months: documents uploaded, reviews and approvals. The peaks follow the customer requests in the calendar.
69 active days · Busiest week from 22 Jun 2026: 28 actions28 active days · Busiest week from 22 Jun 2026: 28 actions63 active days · Busiest week from 19 Oct 2026: 13 actions49 active days · Busiest week from 20 Jul 2026: 12 actions
Arrow keys move from day to day.
Next step
See what the officer does for your team.
A first call takes 20 minutes. Afterwards you will know whether a pilot suits your team.