TISAX (Automotive)

Introduction: Why TISAX Matters for the Automotive Supply Chain

TISAX (Trusted Information Security Assessment Exchange) is the mechanism by which the automotive industry assures itself that information shared across its supply chain is protected to a common, mutually recognised standard. Governed by the ENX Association on behalf of the German Association of the Automotive Industry (VDA), TISAX allows a supplier to be assessed once and to share that assessment result with multiple original equipment manufacturers (OEMs) and tier-N partners, rather than undergoing a separate audit for each customer. For any organisation that designs, develops, manufactures, tests, transports or otherwise handles automotive information assets, prototypes, or personal data on behalf of a vehicle manufacturer, TISAX has become a de facto entry ticket to doing business.

This guide is written from the perspective of practising information security auditors and assessors who prepare organisations for TISAX. It walks through what TISAX is, who must comply, the structure of the underlying assessment catalogue (the VDA Information Security Assessment, or VDA ISA), a master control-by-control readiness checklist, scoping considerations, a phased implementation programme, the maturity scoring model, the assessment lifecycle, evidence expectations, roles, KPIs, common gaps and mappings to adjacent frameworks such as ISO/IEC 27001. The objective is to give a security, risk or compliance leader a defensible, auditor-grade roadmap to a successful TISAX label.

What is TISAX?

TISAX is not a certifiable standard in the way ISO/IEC 27001 is; rather, it is an assessment and exchange framework. It comprises three tightly coupled elements: the assessment catalogue (VDA ISA), the assessment procedure (defined by ENX in the TISAX assessment requirements and Participant Handbook), and the exchange platform (the ENX TISAX portal on which results, called labels, are shared under participant control). An organisation registers as a TISAX participant, defines its assessment scope and objectives, engages an ENX-approved audit provider, undergoes the assessment, and — on success — receives one or more TISAX labels that it can selectively share with its customers.

The substantive content is carried by the VDA ISA (Information Security Assessment), a spreadsheet-based catalogue of controls organised into criteria groups. The current generation, VDA ISA 6.x, structures its controls across three modules: Information Security, Prototype Protection, and Data Protection. Each control is expressed as a requirement with a maturity target, and the assessment measures the organisation's implemented maturity against that target on a defined scale.

A crucial concept is the assessment objective. Unlike a single certificate, TISAX lets a participant select assessment objectives that match the sensitivity of the information it handles — for example, high or very high protection needs for confidentiality and availability, protection of prototypes, connection to third parties, or handling of personal data. Each objective maps to a defined subset of the VDA ISA controls and to a required assessment level (AL 2 or AL 3), which in turn dictates the depth and rigour of the audit.

Who Must Comply with TISAX?

TISAX applies to any organisation in the automotive value chain that a customer OEM or tier supplier requires to demonstrate a defined level of information security. Compliance is contractual rather than statutory: the obligation flows down from purchasing terms and supplier onboarding requirements. In practice the population is broad.

• The trigger is almost always a customer contract clause or supplier portal requirement specifying a TISAX label at a stated assessment level and objective.
• An organisation may need multiple labels covering different sites or different objectives (for example, high protection plus prototype protection).
• Sub-suppliers frequently inherit the requirement: an OEM's tier 1 will flow TISAX down to its own critical tier 2 suppliers.
• There is no legal exemption; the only way to avoid TISAX is to not handle protected automotive information for a customer that requires it.

Structure of TISAX: Modules, Criteria and the VDA ISA Catalogue

The assessment content is defined by the VDA ISA. In the 6.x generation the catalogue is divided into three modules, each a worksheet of numbered controls. The Information Security module is mandatory for every assessment; the Prototype Protection and Data Protection modules apply only when the corresponding assessment objective is in scope. Within the Information Security module, controls are grouped into seven control domains (chapters). Each control has a unique identifier, a control question, an objective, and — for many — must, should and high/very-high requirement tiers.

The maturity of each control is rated on a six-point capability scale (levels 0 to 5) drawn from the ISA methodology. Assessment objectives translate into required maturity targets — typically an average target of 3 (established/managed) across applicable controls, with must-requirements fully met. The higher the protection need, the more controls are activated and the deeper the evidence expected.

Master Assessment Checklist: Control-by-Control Readiness

This is the operational heart of TISAX preparation. Below, each VDA ISA control domain is expanded with the specific requirement areas an assessor will examine, what to verify for each, and the typical evidence expected. Organisations should treat every row as a discrete readiness item and confirm both design (documented) and operating effectiveness (demonstrated over time). No control area is omitted; the Prototype Protection and Data Protection modules are included for organisations that select those objectives.

Domain 1 — Information Security Policies and Organisation

Domain 2 — Human Resources Security

Domain 3 — Physical Security and Business Continuity

Domain 4 — Identity and Access Management

Domain 5 — IT / Cyber Security (Operations, Cryptography, Development)

Domain 6 — Supplier Relationships (Supply Chain Security)

Domain 7 — Compliance

Prototype Protection Module (when Prototype objective is in scope)

Data Protection Module (when Data Protection objective is in scope)

Scoping the TISAX Assessment

Scoping in TISAX has a specific, portal-driven meaning. The participant defines a scope that determines which locations, processes and organisational units are covered by the label. ENX provides a standard scope definition (the default wording that most OEMs accept) and allows extended or custom scopes where needed. Getting scope right is the single most consequential early decision, because a label only covers what the scope describes.

• Standard scope: the ENX-defined boilerplate that covers all processes handling the participant's own and its customers' information security requirements at the listed locations — the most widely accepted option.
• Extended / custom scope: used where an organisation wants to narrow or specifically describe coverage; may reduce acceptance by some customers and requires careful justification.
• Locations: every physical site that handles in-scope information must be listed; multi-site organisations may use a group assessment with sampling.
• Assessment objectives: select all that apply — for example high or very high need for confidentiality/availability, prototype protection, data connection to third parties, and data protection — as these drive the applicable controls and assessment level.
• Assessment level (AL 2 or AL 3): determined by protection need; AL 3 requires on-site assessment and evidence inspection, AL 2 permits a plausibility-based (often remote) approach.
• Exclusions: any excluded process, system or location must be explicitly stated and justified; unstated exclusions invalidate the assurance.

Implementation Approach: A Phased Programme

A structured, phased approach de-risks TISAX and typically spans three to nine months depending on maturity and scope. The following five phases move an organisation from registration to label award and ongoing maintenance.

Phase 1 — Initiation and Registration

• Activities: confirm customer requirements (objective + level), register on the ENX TISAX portal, obtain the participant ID, define the scope and locations, appoint a programme sponsor and project lead, and acquire the current VDA ISA workbook.
• Deliverables: TISAX participant registration, agreed scope statement, selected assessment objectives and level, project charter and plan.

Phase 2 — Gap Assessment (Self-Assessment)

• Activities: complete the VDA ISA self-assessment, rating current maturity of every applicable control; identify gaps against target maturity; produce a prioritised remediation backlog and risk-based roadmap.
• Deliverables: completed VDA ISA self-assessment workbook, gap analysis report, remediation plan with owners and dates, indicative budget.

Phase 3 — Remediation and ISMS Build

• Activities: implement or uplift policies, procedures and technical controls; establish or align the ISMS; deploy IAM, logging, backup, vulnerability and change processes; run awareness training; execute prototype/data-protection specific controls where applicable.
• Deliverables: approved policy set, operating procedures, configured technical controls, training completion records, updated risk register and Statement of Applicability-equivalent.

Phase 4 — Internal Validation and Evidence Preparation

• Activities: run an internal audit/mock assessment, verify operating effectiveness over a sufficient window, collate the evidence library indexed to each control, remediate residual findings, and re-score the self-assessment.
• Deliverables: internal audit report, evidence index/library, closed corrective actions, assessment-ready self-assessment reaching target maturity.

Phase 5 — Formal Assessment and Label Award

• Activities: engage an ENX-approved audit provider, undergo the initial assessment (remote and/or on-site per AL), address any minor/major non-conformities within the corrective-action window, and receive the TISAX label; then share it selectively with customers.
• Deliverables: assessment report, corrective action plan (if required), TISAX label(s) published on the portal, customer sharing configured, surveillance/maintenance plan.

Maturity and Scoring Model

The VDA ISA rates each control on a six-level capability maturity scale adapted from established process-maturity models. The assessment compares the achieved maturity of each control against the target maturity for the selected objective (commonly a target level of 3). A weighted result must meet or exceed the target, with all must-requirements satisfied, for the label to be granted.

For most TISAX objectives the aggregate target is level 3, meaning controls must be defined, documented and consistently applied. Higher protection needs (very high) and certain critical controls may attract stricter expectations. Deviations below target on individual controls are recorded as findings; must-requirement failures generally block the label until corrected.

Assessment and Audit Approach

The TISAX assessment lifecycle is defined by ENX and executed by an approved audit provider. The steps below describe a typical initial assessment through to label maintenance.

1. Register on the ENX TISAX portal, define scope, objectives and assessment level, and obtain the participant/scope IDs.
2. Complete and submit the VDA ISA self-assessment to the required target maturity.
3. Select and contract an ENX-approved TISAX audit provider (the participant chooses and pays the provider directly).
4. Undergo the initial assessment: for AL 2, largely evidence-based and often remote; for AL 3, on-site inspection, interviews and control walkthroughs.
5. Receive the assessment result: if requirements are met, a temporary label may be issued pending final report; if minor or major non-conformities exist, they enter a corrective-action plan.
6. Implement corrective actions within the defined window (typically up to nine months for the plan) and undergo a follow-up review where required.
7. On successful closure, the audit provider confirms results and the participant is issued the TISAX label(s) with a three-year validity.
8. Share the label selectively with customers via the ENX portal; only recipients you authorise can view your result.
9. Maintain the ISMS through the validity period; significant scope changes, new locations or higher objectives trigger re-assessment before expiry.
10. Plan re-assessment ahead of the three-year expiry to maintain continuous label coverage.

Evidence Request List

Assessors expect a curated evidence library indexed to each VDA ISA control. The categorised list below reflects what is typically requested. Provide both documented design and records demonstrating operating effectiveness over a representative period.

• Governance: IS policy, ISMS scope, roles/RACI, ISO appointment, management review minutes, risk methodology, risk register and treatment plan.
• Asset and classification: asset inventory, information classification scheme and handling rules, data flow/scope diagrams.
• HR security: screening records, NDAs, training plans and completion reports, JML procedure and sample tickets, disciplinary policy.
• Physical and BCM: site zoning plans, access-control and visitor logs, CCTV coverage, maintenance/UPS test records, BIA, continuity and DR test reports.
• Identity and access: IAM policy, provisioning/approval records, MFA configuration, privileged-access inventory and logs, access recertification reports.
• IT/cyber operations: cryptography and key-management records, change tickets and CAB minutes, backup and restore-test logs, SIEM/log configuration and retention, malware/EDR coverage, vulnerability scans and patch SLAs, network diagrams and firewall rulebase.
• Secure development: secure SDLC policy, code review records, SAST/DAST reports, environment segregation and repository access matrix, test-data management.
• Supplier and cloud: supplier security clauses, risk assessments, sub-processor register, service reviews, cloud due-diligence and configuration.
• Compliance: legal/regulatory register, records retention schedule, internal audit plan and reports, corrective-action tracker.
• Prototype (if in scope): prototype security concept, area access logs, camouflage/covered-transport records, event and test-drive security plans.
• Data protection (if in scope): DPAs, RoPA, TOM documentation, DSR and breach procedures, sub-processor authorisations, transfer safeguards.

Roles and Responsibilities

KPIs to Track

• Percentage of applicable VDA ISA controls meeting target maturity (level 3 or above).
• Number and severity of open non-conformities and days to closure against the corrective-action window.
• Security awareness training completion rate and phishing-simulation failure rate.
• Mean time to detect and mean time to remediate security incidents.
• Patch and vulnerability remediation within SLA (critical/high percentage closed on time).
• Access recertification completion rate and count of orphaned or excessive-privilege accounts.
• Backup success rate and restore-test pass rate.
• Supplier assessments completed versus in-scope suppliers, and flow-down coverage.
• Percentage of assets inventoried and classified.
• Days remaining to label expiry and re-assessment readiness status.
• For prototype scope: prototype-area access violations and camouflage/transport compliance.
• For data protection scope: breach notification timeliness and DSR response within statutory deadlines.

Readiness Checklist

• Customer-required assessment objective(s) and level (AL 2 / AL 3) confirmed against contract
• Registered on the ENX TISAX portal with participant ID and defined scope
• Current VDA ISA workbook obtained and self-assessment completed
• IS policy approved by top management and communicated
• ISMS scope, roles and responsibilities defined and allocated
• Risk assessment performed with a treatment plan endorsed by management
• Asset inventory and information classification in place
• HR controls (screening, NDAs, training, JML) operating and evidenced
• Physical and prototype-area protections implemented where in scope
• IAM with least-privilege, MFA and periodic access reviews operating
• Logging, backup/restore-testing, malware, vulnerability and change management operating
• Network segmentation and secure development practices in place
• Supplier security requirements agreed and flowed down
• Data protection module controls implemented where in scope
• Internal audit / mock assessment completed and findings closed
• Evidence library indexed to every applicable control and demonstrating operating effectiveness
• ENX-approved audit provider engaged and assessment scheduled
• Corrective-action and label-maintenance/re-assessment plan established

Common Gaps Auditors Find

• Scope and objective mismatch: the registered objective/level does not match what the customer actually requires, so the label is rejected.
• Documentation without operating evidence: policies exist but records showing consistent operation over time are missing, capping maturity below level 3.
• Weak access reviews: no periodic recertification, orphaned accounts and unmanaged privileged access.
• Immature supplier management: no flow-down of security requirements and no evidence of supplier risk assessment or review.
• Backup restores never tested: backups run but no restore evidence, so continuity claims are unproven.
• Incomplete asset and classification coverage: shadow IT and unclassified information undermine the whole control set.
• Logging without monitoring: events are collected but not reviewed, and retention is undefined.
• Prototype protection treated too lightly: physical, transport, camouflage and event controls under-specified relative to the objective.
• Data protection module underestimated: DPAs, RoPA and TOMs incomplete when the data-protection objective is selected.
• No independent internal audit before the formal assessment, so findings surface late and costly.
• Vulnerability and patch SLAs undefined or unmet, with no evidence of timely remediation.

TISAX Mapped to Other Frameworks

TISAX and the VDA ISA are heavily aligned with ISO/IEC 27001 and its control set, which makes an existing ISO 27001 ISMS a strong foundation. The mapping below orients teams that hold other certifications; note that alignment is conceptual and does not replace the VDA ISA's automotive-specific and prototype/data-protection requirements.

Frequently asked questions

Need help with TISAX?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.