TISAX
The automotive industry security standard. Without a TISAX label you cannot join German carmakers’ supply chains.
ENX Association · VDA ISA
- What is at stake
- Required for automotive suppliers
Who it applies to
- Automotive suppliers
- Engineering and prototype design
- Logistics and services for carmakers
Typical timeline
3 to 6 months
ENX Association · VDA ISA
In detail
The entry ticket to the German automotive supply chain.
TISAX (Trusted Information Security Assessment Exchange) is the automotive industry’s security assessment mechanism, run by the ENX Association on behalf of Germany’s VDA. Volkswagen, BMW, Mercedes-Benz, Porsche and other OEMs require it of their suppliers.
The assessment is based on the VDA ISA catalogue, which builds on ISO 27001 and adds its own requirements for prototype protection, third-party connections and data protection.
Depending on the sensitivity of the information you handle, an assessment level of AL2 (usually remote) or AL3 (with an on-site visit) is required. Results are shared on the ENX platform and are valid for three years.
Real scenarios
Common situations.
A new customer requires it
An OEM asks for TISAX to award a project. We define the exact scope and assessment objectives you need.
Prototype protection
If you handle pre-series parts or vehicles, physical and transport security requirements are very demanding.
Engineering and design
Engineering firms receiving CAD drawings must show how they protect that confidential information.
What you get
What you will have at the end.
- Scope and assessment objectives
- VDA ISA self-assessment
- Implementation of required controls
- Prototype protection requirements
- Registration on the ENX portal
- Assessment support
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
TISAX
What we focus on
- 01
VDA ISA questionnaire
- 02
Prototype protection
- 03
Data protection
- 04
Assessment with an accredited provider
TISAX
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for TISAX cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Is TISAX a certification?
Technically not: it is an assessment whose result (label) is shared with partners you authorise on the ENX platform.
Does my ISO 27001 count?
It is a great base, but TISAX adds specific requirements and its own maturity scale. It needs adapting.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.