TISAX in plain English
Car manufacturers work with many suppliers and service providers and share sensitive information with them – design data, prototypes, production plans. In the past, each manufacturer audited its partners in its own way. For suppliers, that meant many similar audits.
TISAX solves this problem. The abbreviation stands for “Trusted Information Security Assessment Exchange.”
A comparison: instead of proving your creditworthiness to every bank separately, you present one generally recognized credit report. With TISAX, an approved audit provider assesses a company’s information security according to uniform rules. The result can then be shared with multiple customers.
TISAX is operated by the ENX Association on behalf of the VDA (German Association of the Automotive Industry). The first companies registered in 2016. Important: TISAX is not a law. It’s required by customers, often as a prerequisite for a contract.
How a TISAX assessment works
The basis is the VDA ISA (Information Security Assessment) requirements catalog, which is aligned with the ISO/IEC 27001 standard. The catalog is updated regularly. For assessments commissioned on or after January 1, 2027, version ISA2027 applies.
The process step by step:
- Registration: The company registers on the ENX portal, defines which locations will be assessed, and selects the assessment objectives. Which objectives apply depends on the information it processes – for example, confidential data, prototypes, or personal data.
- Self-assessment: Using the VDA ISA catalog, the company assesses its own maturity level. This is the best time to close gaps.
- Engaging an audit provider: An audit provider approved for TISAX carries out the assessment.
- Assessment: Depending on the protection needs, this is either a plausibility check of the self-assessment based on evidence and interviews (Assessment Level 2) or a comprehensive audit that includes an on-site inspection (Assessment Level 3).
- Follow-up: If the audit provider identifies deviations, the company draws up a corrective action plan and implements it.
- Sharing the result: The company receives the result in the form of TISAX labels, which are valid for up to three years. Via the ENX portal, it decides for itself which partners may see the result.
A practical example
A mid-sized plastics processor is set to develop interior parts for a new vehicle model. Before exchanging design data, the car manufacturer requires a TISAX label for handling confidential information and for prototype protection.
The company starts with the self-assessment and discovers that it lacks a documented procedure for handling technical vulnerabilities, and that access to the development area is barely controlled. By the time of the assessment, it has introduced regular vulnerability scans, commissioned a penetration test, and set up access control for the prototype workshop. The assessment goes off without any major deviations.
Why does this matter for businesses?
For many suppliers and service providers in the automotive industry, TISAX is the price of admission: without a valid label, there’s often no access to sensitive project data – and therefore no contract. This affects not only parts suppliers but also, for example, engineering service providers, agencies, or logistics companies that work with confidential information.
At the same time, TISAX is more than a box-ticking exercise. The requirements create a solid foundation for an ISMS – a systematic approach to managing information security – and make supply chain attacks harder. A TISAX label, however, is not an ISO/IEC 27001 certificate – and conversely, an ISO certification doesn’t automatically replace TISAX.
What businesses should do now
- Clarify requirements: Ask your customers which assessment objectives and which assessment level they expect.
- Start early: Depending on your starting point, preparation can take several months.
- Assess yourself honestly: Use the VDA ISA catalog to find gaps systematically.
- Check the catalog version: Find out which ISA version your assessment will be based on.
- Gather technical evidence: You should be able to prove that vulnerability management, network separation, and access protection work.
- Assign responsibility: Name one person to steer the process and keep an eye on deadlines.
How Rootsektor can help
The TISAX assessment itself is carried out by an approved audit provider. As a Germany-based security company, Rootsektor supplies you with solid technical evidence for it: our Penetration Testing services show whether vulnerability handling, network separation, and access protection work in practice, and physical tests check access to prototype areas. You can present our report and test certificate to your audit provider and your customers. You can read more about the industry’s requirements under Manufacturing & Industry.