Information security for automotive suppliers (TISAX)

The request comes from your customer, not from an authority — and usually with a deadline that was set without knowing where you stand today. The consequence of missing it is not a fine but the risk of being dropped from the supply chain.

We prepare you for a TISAX assessment against the VDA ISA catalogue. If the deadline you were given cannot be met, we say so at the start, together with what you can put to your customer: a timeline with milestones, the measures already in place and an interim arrangement for the period until the assessment.

What TISAX is

TISAX is an assessment and exchange scheme for information security in the automotive industry, run by the ENX Association. A supplier is assessed against the VDA ISA catalogue, the information security requirements published by the German Association of the Automotive Industry (VDA). The result is a label that you share with your customers through the ENX portal, so that one assessment can serve several customers instead of a separate questionnaire for each.

You do not choose the assessment level yourself. Your customer sets it, according to how sensitive the information is that it entrusts to you:

• AL1 — a self-assessment; the audit provider only confirms that it exists.

• AL2 — an assessment carried out largely remotely: the auditor checks your evidence and holds interviews, testing whether your self-assessment is plausible. The weight of the preparation lies in the documentation and in whether the processes actually run.

• AL3 — an assessment on site, including an inspection of the premises. Physical security is verified, not only documents — access control, zones and the handling of visitors. The step from AL2 to AL3 is not a small one.

Besides information security, the customer may require the protection of prototypes and, where you process personal data on its behalf, data protection. Which of these you need follows from the customer's request.

TISAX concerns a supplier and its customers. Audits of dealers, workshops, branches or subsidiaries across several countries are a different thing — see Automotive network audits.

What you get

• A defined scope and protection objectives, based on the information your customer entrusts to you.

• A list of deviations from the VDA ISA catalogue, with priorities and a realistic timeline.

• A completed information security management system, including risk management and processes.

• The sector-specific requirements added — prototype protection and physical security at a level the standard alone does not require.

• Evidence and a self-assessment prepared so that the assessment can pass at the first attempt.

• Help in choosing a provider and with registration on the ENX portal.

How the preparation runs

1. Scope and protection objectives. Which sites, which processes and which objectives. A wrongly set scope is the most expensive mistake in the whole project: either you pay for more than you need, or the result does not cover what the customer asked for.

2. Gap analysis against VDA ISA. Your current state compared with the catalogue, giving the list of deviations.

3. Building the management system. Documentation, risk management, processes and physical measures. This is the longest phase, and the only one that cannot be skipped.

4. Self-assessment and evidence. Completing the catalogue and preparing the evidence the auditor will ask for.

5. Accompanying you through the assessment. The accredited provider performs it; we are present at the interviews and help you deal with any findings.

After the label, the system has to be maintained. Without ongoing upkeep, the whole preparation is repeated before renewal — a cost that can be avoided.

Where our role ends

The assessment itself may only be performed by an audit provider accredited by the ENX Association, and nobody who prepares you for it may also perform it. The independence of the assessment is the point of the whole scheme, so this is not an obstacle but the condition of its value.

We are not an ENX-accredited provider. We prepare you and accompany you. You order the assessment directly from an accredited provider and pay for it separately from the preparation; the contract is yours, precisely so that the assessment stays independent.

From ISA 6 to ISA2027

Assessments ordered from 1 January 2027 are carried out against the new catalogue, VDA ISA2027, the successor to ISA 6.

• The date the assessment is ordered decides, not the date it takes place. An assessment ordered before that date can still be performed against ISA 6.

• Labels already issued stay valid for their full validity period, which is up to three years. Nobody requires you to repeat the assessment early.

• If your deadline leaves room, it is worth building the documentation with ISA2027 in mind. It is the same work, done once instead of twice.

TISAX and ISO/IEC 27001 as one system

The VDA ISA catalogue builds on ISO/IEC 27001. If you already run a working information security management system, a large part of the work is done: policy, risk management, assets, access rights, suppliers, incidents, continuity and training carry over directly.

What has to be added are the specifics of the automotive industry — above all prototype protection and physical security at a level the standard does not require. At AL3 this is the core of the preparation.

If you have neither yet, consider building one management system that covers both from the start. The extra effort compared with TISAX alone is smaller than it seems. An ISO/IEC 27001 certificate is issued by an accredited certification body, not by us.

Both frameworks expect risks to the information in scope to be identified, assessed and treated. The short check on our risk analysis page has a TISAX option and shows what to deal with first.

TISAX® is a registered trademark of the ENX Association; we use the name for identification only.