GKN Automotive is one of the world’s largest suppliers of driveline systems for the automotive industry, employing 25,000 people across 46 facilities in 21 countries. In Poland, it operates two manufacturing plants located in Oleśnica, near Wrocław. A company of this size faces countless challenges and threats to information security every day, which is why it places great emphasis on integrated management in this area.
In 2023, GKN Automotive carried out a project to implement the Information Security Management System compliant with VDA ISA TISAX®. This project included a zero audit for compliance with the standard, organizational and process adjustments, the launch of the ISMS, and a successful certification audit. All for One Poland was a partner in this project.
Managing information security at the enterprise level offers numerous advantages, allowing for the standardization of processes and proper scaling. GKN has a global security office. With such a process organization, a centrally implemented function can support multiple facilities across several countries.
However, it is still essential to involve a local team that can properly identify specific threats on-site and implement global processes. For standards like VDA ISA TISAX®, it is also necessary to ensure the physical security of facilities (such as access control systems, securing delivery areas, and employee training), which is practically impossible without the involvement of staff from the specific location.
In GKN Automotive Poland, such a corporate team has been established at the facility in Oleśnica. The team consists of key employees from the local IT and maintenance team, who, thanks to their knowledge and experience, were able to efficiently implement the specific requirements outlined in the global documentation. The challenge, however, was the proper interpretation of these requirements and their implementation in practical applications.
The solution that GKN Automotive opted for is the engagement of a Local Information Security Officer. This position is held by a consultant from All for One Poland, the company that partnered in the implementation of TISAX® requirements within the organization. As a member of the local team, they bring experience related to TISAX® requirements as well as systemic information security management and certification audit preparation.
Systemic information security management requires specific competencies. Even people who perform tasks in such areas on a daily basis, and who have knowledge and experience, may have problems interpreting requirements or applying procedures. In the case of TISAX®, this is particularly problematic as the standard provides examples of specific security measures, such as the installation of doors that meet the RC2 standard. On a plant-wide basis, the cost of such an operation would be enormous, and the impact on security would be negligible. However, not all areas require doors of this standard.
The involvement of an experienced consultant enabled GKN to cut unnecessary costs and concentrate on the most essential activities, leading to a successful certification audit by an external body and obtaining TISAX® certification.
The All for One consultant has become a permanent member of GKN Automotive Poland’s local information security team. In 2024, efforts will continue toward obtaining certification at the second location in Poland.
