TISAX: Information Security in the Automotive Industry

The idea is simple. A supplier is assessed once and shares the result with many customers. So no carmaker has to audit every supplier on its own. The VDA, the German automotive industry association, publishes the catalog. Since 2019, the ENX working group ISA has maintained it.

Is TISAX a certification?

Not formally, even though many people search for "TISAX certification". TISAX is an assessment. The result is not a certificate but a TISAX label. The label states that your information security management system meets a defined set of requirements. ENX does not issue a certificate on purpose, because results are shared through a standard exchange.

The result sits on the ENX platform. You decide which partners may see it. Nobody sees it without your consent. Note that you cannot revoke a permission once you have granted it.

Who needs TISAX?

No law requires TISAX. The demand comes from your customers. Many carmakers and large suppliers ask their partners for a TISAX label. It mainly affects:

• Suppliers that receive confidential design or project data
• Companies that handle prototypes, components or test vehicles
• Service providers such as engineering firms, agencies or IT vendors with access to customer data
• Processors that handle personal data for clients in the industry

Your customer sets the requirements. In most cases, they tell you which label they expect.

Assessment levels and assessment objectives

Assessment levels

The assessment level (AL) sets how deep the auditor goes:

• AL 1: mainly a self-assessment. Because trust is low, TISAX does not use AL 1.
• AL 2: The auditor checks your self-assessment for plausibility, reviews evidence and holds an interview. This usually happens by video call.
• AL 3: a full review with documents, observed processes and on-site visits.

Assessment objectives

The objective you choose sets the level you need. Each objective stands for a protection need. The TISAX Participant Handbook lists these objectives:

• Confidentiality: "Confidential" (AL 2) and "Strictly confidential" (AL 3)
• Availability: "High availability" (AL 2) and "Very high availability" (AL 3)
• Prototype protection: "Proto parts" and "Proto vehicles" (AL 3), "Test vehicles" and "Proto events" (AL 2)
• Data protection: "Data" (AL 2) and "Special data" for special categories of personal data (AL 3)

With ISA 6, these objectives for confidentiality and availability replaced the older "Info high" and "Info very high". For more on these terms, see the entry on security objectives.

Current catalog

On July 1, 2026, the VDA published the new version VDA ISA2027. It applies to TISAX assessments ordered from January 1, 2027. Assessments ordered before that still follow ISA 6. Existing labels stay valid until they expire.

The TISAX process step by step

1. Register with ENX: You sign up online and accept the terms of participation.
2. Define the scope: You choose the locations and the assessment objectives.
3. Self-assessment: You rate your company against the VDA ISA catalog and close gaps.
4. Choose an audit provider: An audit provider approved by ENX runs the assessment.
5. Assessment: The auditor reviews your ISMS at the chosen level.
6. Corrective actions: If there are gaps, you write a corrective action plan. The follow-up must take place within nine months of the initial assessment. For minor gaps, you can get temporary labels for up to nine months.
7. Label: Once all requirements are met, you receive the label.
8. Share with partners: You release the result to your customers on the ENX platform.

A TISAX label is generally valid for three years. After that, you go through the process again. If your scope changes a lot, for example after a move, the label can end sooner. Groups with at least three locations and a centrally run ISMS can also use the "Simplified Group Assessment".

TISAX vs. ISO 27001

Both review an ISMS. The VDA ISA catalog is aligned with ISO/IEC 27001 and maps to the 2022 version. But there are clear differences:

• Result: ISO 27001 ends with a certificate. TISAX ends with a label that you share with chosen partners.
• Scope: With ISO 27001, you define the scope yourself. With TISAX, it covers every part of the company that handles confidential information from automotive partners.
• Content: TISAX adds its own requirements for prototype protection and data protection.

An existing ISMS based on ISO 27001 is a good starting point. You can reuse many processes, policies and records.

TISAX and NIS2

Many suppliers belong to vehicle manufacturing. In Germany, this is part of the manufacturing sector in Annex 2 of the BSI Act (BSIG). Above a certain size, these companies fall under the NIS2 Directive.

The ENX working group ISA has compared TISAX with NIS2. Its view: a TISAX label covers the duties in Articles 20 and 21. That only holds if the assessment objectives reflect your real risk and all affected sites were assessed. You still have to meet national reporting duties on top.

How we can help

We help you prepare for TISAX. This includes setting the scope, the self-assessment and building missing ISMS processes. Learn more about our ISMS consulting. If you lack the capacity in-house, an external information security officer can help. The assessment itself is run by an approved audit provider.

Frequently asked questions

Is TISAX a certification?

No. TISAX is an assessment that results in a label. ENX does not issue a certificate. Even so, people often say "TISAX certification" in everyday use.

How long is a TISAX label valid?

Usually three years. After that, you start a new assessment. Temporary labels for minor gaps last up to nine months.

Is ISO 27001 enough instead of TISAX?

Usually not. If your customer asks for a TISAX label, an ISO 27001 certificate does not replace it. ISO 27001 does not cover prototype protection and data protection the way TISAX assesses them. But an ISO 27001 ISMS makes preparing much easier.