TISAX: Information Security Assessments for Automotive Suppliers

TISAX, the Trusted Information Security Assessment Exchange, is how the automotive industry checks the information security of its suppliers. Instead of every carmaker auditing every supplier separately, suppliers are assessed once against the VDA Information Security Assessment (VDA ISA) catalogue by an accredited audit provider, and the result is shared with customers as a TISAX label through the ENX platform.

TISAX matters to software and IT companies as much as to parts makers: engineering service providers, design studios, connected car developers, data analytics firms and IT service providers handling confidential data or prototype information for automotive customers are often asked for a label. This guide explains the VDA ISA catalogue, assessment objectives and labels, assessment levels, the process, the new ISA2027 catalogue that applies from January 2027, and how to prepare.

What is TISAX?

TISAX was launched in 2017 by the German Association of the Automotive Industry (VDA) and is operated by the ENX Association, an industry body of manufacturers, suppliers and national associations. It consists of three parts: the VDA ISA catalogue of requirements, an assessment process run by ENX-accredited audit providers, and an exchange platform where companies share their assessment results with partners they choose.

TISAX is not a certification in the ISO sense. A company does not receive a certificate for the public; it receives labels that it can share with specific partners on the ENX platform. Partners can then see that the company has been assessed for the relevant objectives without seeing the full report, unless the company chooses to share more.

Who needs TISAX?

• Automotive suppliers of parts, systems and modules that receive confidential drawings or specifications.
• Engineering and development service providers, including software and embedded systems developers.
• Prototype handlers, such as test facilities, logistics firms and design studios.
• IT and software service providers hosting or processing customer data, including data protection relevant processing.
• Marketing and event agencies handling prototypes or confidential launch information.

Whether a label is needed, and which one, is decided by the customer based on what the supplier will handle.

Is it mandatory or voluntary?

TISAX is not required by law. It is a contractual requirement set by many automotive companies, particularly German manufacturers and their suppliers. Without the required label, a supplier may not be able to receive confidential data or prototypes, or win the contract.

The VDA ISA catalogue

The VDA ISA is based on ISO/IEC 27001 and ISO/IEC 27002 controls with automotive-specific additions. It is organised into modules:

• Information security: policies, organisation, people, physical security, identity and access, IT security and operations, supplier relationships and compliance, assessed against requirements for normal, high and very high protection needs.
• Prototype protection: physical and organisational requirements for protecting prototype parts, components, vehicles and events.
• Data protection: requirements for processing personal data on behalf of customers in line with the GDPR.

Each control has a maturity scale, and assessors look for a target maturity level, typically level three (established), meaning the process is documented, implemented and its effectiveness is monitored.

VDA ISA maturity levels

The information security module rates each control on a maturity scale adapted from process capability models. Level 0 means the control is incomplete or not in place; level 1 means it is performed but informally; level 2 means it is managed, with some planning and responsibility; level 3 means it is established, with documented processes that are followed and monitored for effectiveness; levels 4 and 5 describe predictable and optimising processes. TISAX generally targets level 3 for each control. A level 3 rating needs evidence that the process is documented, actually used across the scope, and checked, for example through reviews, metrics or internal audits. Many first-time assessments fall short not because controls are missing, but because they are informal and cannot be shown to work consistently.

Assessment objectives and labels

The supplier chooses assessment objectives based on customer requirements. Each successful objective results in a label. Common labels include:

Label	Covers
Info high	Handling information with high protection needs.
Info very high	Handling information with very high protection needs.
Availability high / very high	Services where availability is critical to the customer.
Proto parts	Protecting prototype parts and components.
Proto vehicles	Protecting prototype vehicles.
Test vehicles	Handling camouflaged test vehicles.
Proto events	Protecting prototypes at events and shoots.
Data / Special data	Processing personal data, or special categories of personal data, on behalf of customers.

Assessment levels

• Assessment level 1: a self-assessment. It is mainly used internally and generally does not lead to a TISAX label.
• Assessment level 2: a plausibility check by the audit provider, typically remote, reviewing the self-assessment and evidence and interviewing staff. Used for high protection needs.
• Assessment level 3: a thorough verification, usually including on-site inspection, used for very high protection needs and prototype protection.

The required level follows from the objectives: very high protection and prototype labels require level 3.

Scope and locations

TISAX assessments are tied to locations. The standard scope covers all processes, procedures and resources at the assessed sites that are relevant to the security of the customer's information and, where applicable, prototypes. Companies list the locations to include when registering, and labels apply to those locations. A company with several development centres can include several sites, but each must meet the requirements. Remote working, cloud services and subcontractors used by in-scope staff are part of the assessment because customer information flows through them. Defining scope carefully, and keeping customer work at assessed sites, avoids surprises during audits and when customers check which locations hold a label.

The assessment process

1. Registration on the ENX portal, accepting participation terms and defining the assessment scope and locations.
2. Choose an audit provider from the ENX list of accredited providers.
3. Self-assessment using the VDA ISA workbook, ideally with gap remediation before the audit.
4. Initial assessment by the audit provider at the required level.
5. Corrective action plan for any nonconformities, followed by a follow-up assessment if needed.
6. Labels issued and visible on the ENX platform once nonconformities are addressed.
7. Share results with chosen partners through the platform.
8. Reassessment before label expiry, generally every three years.

ISA2027: the new catalogue

On 1 July 2026, the VDA published the ISA2027 catalogue, which applies to TISAX assessments ordered from 1 January 2027. Assessments ordered before then use ISA 6, which has applied to orders since 1 April 2024. Catalogues are now named after the year they become mandatory, with a new version expected each summer for the following year. According to ENX, ISA2027:

• Updates mappings to NIST CSF 2.0 and ISO/IEC 27001:2022, clarifies IEC 62443 mappings and removes references to ISO/IEC 27001:2013.
• Formally defines how listed aspects must be considered, so organisations must be able to explain their implementation decisions.
• Broadens the definition of projects and distinguishes more clearly between events and incidents.
• Names managers and organisational leaders explicitly as a target group for awareness.
• Strengthens supply chain security: organisations with high protection needs must document, review and monitor supplier compliance more closely, and for very high protection needs suppliers must show adequate security through a TISAX label, equivalent third-party assessment or supplier audit.
• Consolidates the prototype protection module into two domains and adds controls on traceability and lifecycle tracking, and on disposal, recycling or return of protected items.

Existing labels remain valid for their full period; the new catalogue applies at the next assessment. ENX says the annual release cycle does not increase how often companies must be reassessed, but organisations should review each new catalogue for changes that affect their controls, especially in supplier management.

What software and IT suppliers should focus on

• Access control: role-based access, MFA, joiner-mover-leaver processes and access reviews for customer data and repositories.
• Classification and handling of customer information, including in development and test environments.
• Secure development: code review, dependency management and security testing.
• Encryption in transit and at rest, and key management.
• Logging and monitoring of access to sensitive data.
• Supplier management, including cloud providers and subcontractors, which ISA2027 emphasises.
• Incident management with customer notification.
• Mobile device and remote work security.
• Data protection for any personal data processed for customers.

Prototype protection in practice

Prototype labels require physical and organisational controls that many software companies have never needed. Typical expectations include a defined protected area with access control and visitor management, CCTV or equivalent monitoring where required, rules for photography and mobile phones, secure storage, procedures for transporting prototypes and covering them during transit, non-disclosure agreements and training for staff and visitors, and, under ISA2027, traceability of protected items through their lifecycle and controlled disposal or return. If a software team only receives prototype hardware occasionally, it may be simpler to work at the customer's premises or a dedicated, assessed lab rather than bring prototypes into general offices.

Preparing your team for the audit

Assessors interview people, not just documents. Staff in scope should know the information classification scheme, how to handle customer data, how to report incidents and whom to ask. Process owners should be ready to show records, such as access reviews, training completion, vulnerability scans and supplier assessments, and explain decisions where controls are implemented differently from the catalogue's examples, which ISA2027 makes explicit. A short internal rehearsal of interviews and evidence walkthroughs before the real assessment usually reveals gaps that can still be fixed.

Documentation you will need

• ISMS policies and procedures aligned with the VDA ISA.
• Completed VDA ISA self-assessment.
• Scope definition and site list.
• Risk assessment and treatment.
• Evidence of controls: access reviews, training records, logs, test reports.
• Supplier assessments and contracts.
• Corrective action plans and follow-up evidence.
• Prototype protection procedures, if applicable.

Timeline and cost considerations

Preparation typically takes three to nine months, depending on whether an ISO/IEC 27001 ISMS already exists. Costs include ENX registration fees, audit provider fees that depend on scope, sites and assessment level, internal effort and any remediation. Organisations with ISO/IEC 27001 can reuse much of their ISMS but must cover automotive-specific requirements and any prototype controls.

Benefits

• Access to automotive customers that require a label before sharing confidential work.
• One assessment shared with many customers, reducing repeated audits and questionnaires.
• A structured security programme aligned with ISO/IEC 27001, which helps beyond automotive.
• Clear expectations for prototype and data protection, reducing the risk of costly leaks.

Common mistakes

• Choosing the wrong objectives without confirming customer requirements.
• Underestimating level 3 on-site verification for very high protection.
• Policies without evidence of implementation and monitoring.
• Ignoring subcontractors and cloud providers.
• Letting labels expire during active projects.

Best practices, tools and technologies

• Build on an ISO/IEC 27001 ISMS where possible.
• Use the VDA ISA workbook as the master control list and map evidence to each control.
• Segregate customer projects in repositories, environments and storage.
• Automate access reviews and log collection.
• Plan reassessment six months before label expiry.

We build software and environments with access control, encryption, audit logging and secure development practices that fit TISAX requirements through our custom software development and maintenance and support services.

How TISAX relates to other frameworks

Framework	Relationship
ISO/IEC 27001	Foundation of the VDA ISA; certification helps but does not replace TISAX.
GDPR	Basis for the data protection module.
NIS2	Applies to many automotive manufacturers as essential or important entities, increasing supplier scrutiny.
Cyber Resilience Act	Product security requirements for digital products, including some automotive components.
UNECE R155 and ISO/SAE 21434	Vehicle cybersecurity regulations and engineering standard, separate from TISAX's organisational focus.

Real-world example

An Indian engineering services company develops infotainment software for a German tier-one supplier, receiving confidential specifications and occasional prototype hardware. The customer requires Info high and Proto parts labels. The company already holds ISO/IEC 27001, so it maps its ISMS to the VDA ISA, adds a secure prototype lab with access control and CCTV, segregates the customer's repositories and test environments, and completes a level 3 assessment. Labels are shared with the customer through the ENX platform, and reassessment is planned under ISA2027.

Next steps

1. Confirm required labels with your customer.
2. Register on the ENX portal.
3. Complete the VDA ISA self-assessment.
4. Close gaps and choose an audit provider.
5. Plan for ISA2027 at your next assessment.

Frequently asked questions

What is TISAX?

The automotive industry's information security assessment and exchange mechanism, based on the VDA ISA catalogue and operated by ENX.

Is TISAX a certification?

It results in labels shared with partners through the ENX platform, rather than a public certificate.

How long is a TISAX label valid?

Up to three years, after which a new assessment is needed to keep the label active on the ENX platform.

What are TISAX assessment levels?

Level 1 self-assessment, level 2 plausibility check, and level 3 thorough verification, usually on-site.

Which VDA ISA version applies?

ISA 6 for assessments ordered until 31 December 2026, and ISA2027 for assessments ordered from 1 January 2027.

Does ISO 27001 replace TISAX?

No, but it provides a strong foundation; TISAX adds automotive-specific requirements and its own assessment.

Do software companies need TISAX?

Often, if they handle confidential information, prototypes or personal data for automotive customers.

Who performs TISAX assessments?

Audit providers accredited by the ENX Association, which publishes the list of providers participants can choose from when ordering an assessment.

What changed in ISA2027?

Updated mappings to ISO/IEC 27001:2022 and NIST CSF 2.0, stronger supply chain requirements, and a reorganised prototype protection module.

Can TISAX results be shared with multiple customers?

Yes. The company chooses which partners can see its labels on the ENX platform.

Do TISAX labels cover all of a company's offices?

No. Labels apply to the locations included in the assessment scope, so customer work should be done at assessed sites.