What is TISAX?
TISAX (Trusted Information Security Assessment Exchange) allows organizations to assess information security based on common criteria and share the results with selected partners. The system is administered by the ENX Association, and assessments are conducted by independent audit providers approved by them.
The assessment is based on the VDA ISA (Information Security Assessment) catalog of requirements. It is developed and maintained by an ENX working group and published by the German Association of the Automotive Industry (VDA). The catalog is designed for managing information security within the automotive supply chain.
TISAX helps reduce the need for individual audits by various partners: your organization can share the results of a completed assessment with other TISAX participants via the ENX portal. The scope and objectives of the assessment must align with the specific requirements of your supply chain partner.
Is TISAX a certificate?
Although the term "TISAX certificate" is often used, TISAX is not a standard certification. Successfully assessed organizations are granted TISAX labels that correspond to their assessment objectives. These labels and the assessment results are made available on the ENX portal, where the organization grants access to selected partners.
Who needs TISAX?
TISAX may be relevant if your organization:
- supplies products or services to automotive manufacturers or their Tier 1 and Tier 2 suppliers;
- handles partners' technical drawings, design data, production information, or other confidential information;
- works with prototypes or provides related engineering, IT, or logistics services;
- as received a TISAX requirement in supplier selection documents or a contract;
- plans to begin collaborating with automotive manufacturers or other organizations in this industry's supply chain.
This requirement can also be relevant for smaller sub-suppliers: manufacturers of components, raw materials, metal, plastic, or electronics, as well as service providers. It can be requested by either an automotive manufacturer or another supply chain partner.
Automotive manufacturers and other supply chain partners want to ensure that the information they share is properly protected. A TISAX assessment helps your organization demonstrate this, and a successful result may be a prerequisite for collaboration.
How the TISAX assessment works?
It is worth starting your preparation by identifying the requirements applicable to your organization and the scope of the assessment. The process then involves the following steps:
Clarifying requirements. Determine which TISAX labels your organization needs, which locations must be included, and the deadline for the results. The assessment level is determined based on the assessment objectives.
- Registration on the ENX portal. Register your organization and the scope of the assessment. It is advisable to coordinate with an audit provider and discuss potential assessment dates in advance, while you are still in the preparation phase.
- Self-assessment according to VDA ISA. Applicable requirements are reviewed, evidence is gathered, and missing processes or security measures are identified.
- Remediation of gaps. Technical and organizational measures are implemented, responsibilities are assigned, and documentation is prepared.
- Independent assessment. An ENX-approved audit provider conducts the assessment. If non-conformities are identified, corrective actions and additional verification of their implementation may be required.
- Sharing results. Access is granted to selected partners via the ENX portal. TISAX labels are generally valid for three years; temporary labels have a shorter validity period.
What is the difference between AL2 and AL3?
AL2 and AL3 define the depth of the assessment. For AL2, the validity of the self-assessment is verified based on documents, evidence, and an interview, which is usually conducted remotely. AL3 involves a more comprehensive verification of requirement implementation, including checks of processes and conditions at the organization's physical sites.
It is important for your organization to clarify not only the assessment level but also the objectives and scope—which information, processes, and locations must be included. This is coordinated with the supply chain partner requiring TISAX compliance.
Which IT areas need to be prepared for a TISAX assessment?
Preparation involves both information security management and the practical operation of measures. Depending on the assessment objectives, the protection of prototypes or personal data may be relevant. In the IT environment, it is worth reviewing the following areas:
User and access management – account creation, granting, reviewing, and revoking permissions, and controlling administrator access.
- Workstation and mobile device security – updates, encryption, device management, and threat protection.
- Information security – data classification, storage, transmission, and access based on employee responsibilities.
- Network and IT asset management – equipment inventory, network diagrams, segmentation, and configuration documentation.
- Backups and business continuity – performing backups, recovery testing, and preparedness for system disruptions.
- Vulnerability and incident management – risk assessment, remediation of gaps, logging of events, and response procedures.
- Supplier and employee readiness – security requirements for external services, employee training, and knowledge verification.
The need for specific measures and tests depends on the applicable requirements and risk assessment. It is important to have evidence that the chosen measures are working: access review logs, recovery test reports, configurations, or other documents. Simply installing a measure does not demonstrate how it is managed on a daily basis.
How Heximus helps you prepare for a TISAX assessment?
We help technically prepare your IT environment for a TISAX assessment: we conduct a technical gap analysis, coordinate an action plan, and implement the necessary security changes. Based on the agreed scope, we help you prepare for the auditor's questions, explain the implemented solutions, and perform necessary technical adjustments.
We coordinate technical tasks with your team and other preparation consultants. We adapt solutions to your existing IT environment, first evaluating the capabilities of the technologies you already have. The official assessment is performed by an independent ENX-approved audit provider.
Read more about technical preparation and our work process on our TISAX compliance services page.
Where to start with TISAX preparation?
First, it is important for your organization to clarify which TISAX labels are required, as well as the assessment scope and timeline specified in your cooperation terms. Then, it is worth evaluating which processes and measures are already in place, what is missing, and who will be responsible for the preparation.
Preparation can take several months, so include both the implementation of measures and the time needed to gather evidence of their effectiveness in your plan. If TISAX assessment is required for planned automotive projects, it is worth starting the work even before receiving an invitation to tender.
If your organization needs to prepare for a TISAX assessment or you are planning to work with the automotive industry, contact Heximus for a free consultation. We will discuss your IT environment and where to begin your technical preparation.
Frequently asked questions about TISAX?
Is TISAX mandatory for all automotive industry suppliers?
No. The need for TISAX and specific requirements are usually determined by the automotive manufacturer or another partner in the supply chain. If an assessment is included in the supplier selection or contract terms, a successful result may be necessary for your organization to collaborate.
How long does TISAX preparation take?
The duration depends on the assessment scope, objectives, and the current maturity of your security management. Technical preparation with Heximus typically takes about 2–4 months. The overall process may take longer, as it requires planning organizational tasks, scheduling the independent assessment date, and addressing any potential non-conformities.
How much do TISAX assessment and preparation cost?
The total budget consists of ENX fees, services from an independent assessment provider, and preparation work: addressing gaps, preparing documentation, and implementing necessary technical measures. The amount depends on the scope, the number of locations, the assessment level, and the organization's initial state.
Does an ISO 27001 certificate replace a TISAX assessment?
No. ISO/IEC 27001 certification and TISAX assessment are different processes. An existing information security management system can facilitate preparation, but your organization must separately evaluate the applicable VDA ISA requirements and the conditions set by your partner.
Is it enough to install security tools for a TISAX assessment?
No. You also need clear processes, responsibilities, documentation, and evidence that security measures are functioning and being managed continuously.
