TISAX preparation for automotive suppliers

An automotive customer asks for a TISAX result. Before assigning tasks, establish which assessment objectives and locations the customer expects to see. That request determines the assurance work you need to organize: systems, physical environments, responsible teams, and evidence.

TISAX is an assessment and exchange mechanism administered by ENX, using the VDA Information Security Assessment (ISA). It produces assessment results and labels under its rules, not an ISO-style certificate. For a CTO, preparation means connecting customer expectations to implemented controls—not simply completing a questionnaire.

Translate the customer request into an assessment scope

Requests can arrive from an OEM or another supplier. Ask for the exact objectives, expected labels, required timing, and locations that must be covered. Confirm participating legal entities and whether engineering offices, production facilities, remote-working arrangements, and supporting services affect the boundary.

Assessment objectives determine the relevant requirements and assurance depth. Information security, prototype protection, and data protection are important dimensions, but they are not a substitute for selecting the specific objectives in current ENX guidance.

Assessment levels describe examination depth:

• AL1: self-assessment for internal purposes; results are not shared through TISAX and do not receive TISAX labels.
• AL2: a plausibility assessment of the self-assessment and supporting evidence.
• AL3: a comprehensive assessment, including on-site examination.

Use ENX's TISAX information and participant guidance to confirm the applicable objectives, assessment arrangements, and ISA version. Register the scope and select an authorized assessment provider through the appropriate process. Discuss prerequisites and availability early; a customer deadline is not a guaranteed assessment date.

The deliverable is a scope record with customer acceptance criteria, locations, objectives, dependencies, owners, and the agreed assessment approach. Avoid both unnecessary scope expansion and exclusions that omit services supporting protected information.

Turn the ISA self-assessment into implementation work

Complete the applicable self-assessment against actual operating practices. Where a requirement has a target maturity, explain how your implementation supports the answer rather than assigning a score based on a policy's existence.

Use a working register with requirement, implementation description, owner, location, evidence reference, gap, and corrective action. Assign review responsibility as well as delivery responsibility: someone should challenge whether the evidence proves the claim.

Secure engineering information and supporting IT

Trace confidential drawings, source code, specifications, and customer data from receipt through collaboration, storage, delivery, and disposal. Check classification, permissions, external sharing, privileged access, endpoint protection, logging, backup restoration, and incident handling.

For example, an approved drawing exchange process should identify the permitted channel, authorized recipients, access expiry, and responsibility for removing obsolete access. A policy prohibiting public links is weak evidence if project teams still use them.

Evaluate external providers too. Record which services support the scope, who administers them, what contractual security expectations apply, and which evidence you can obtain. Outsourcing a service does not eliminate your need to understand its controls.

Establish local physical and prototype controls

Central policies can support multiple sites, but each location needs evidence of implementation. Connect access rules to badge permissions, visitor records, escort arrangements, and removal of access when staff leave.

Where prototype protection applies, examine the handling environment: restricted zones, visibility from outside, photography restrictions, transport, temporary storage, and approved disposal. Identify responsible staff and document handovers where appropriate. Digital access logs alone do not demonstrate control over a physical component.

Address people and data protection

HR should support onboarding, confidentiality commitments, role-specific training, and leaver coordination. Procurement, facilities, and engineering need explicit tasks rather than a general instruction to “support IT.”

Where data protection objectives apply, assess the relevant processing and contractual responsibilities. A TISAX result does not establish GDPR compliance; legal duties still depend on your role and processing activities.

Assemble evidence that proves operation

Evidence should establish what happened, where, when, and under whose responsibility. As a practical recommendation, use the following distinctions when reviewing readiness:

Record evidence dates, source systems, locations, and reviewers. Preserve historical records where needed to explain operation and changes. An old screenshot is not automatically useless, but it cannot establish today's configuration without supporting context.

Keep confidential assessment evidence access-controlled. Avoid collecting unnecessary customer designs or personal information when a redacted record can demonstrate the control.

Automate repeatable collection, not accountability

Start with recurring tasks that have clear inputs and outputs: permission exports, asset inventory updates, training records, review reminders, and evidence freshness checks. Document the manual process first so automation does not reproduce an unclear workflow faster.

For each automated collection, specify its source, scope, frequency, failure handling, and review owner. Test whether exports include every relevant site and account type. A successful collection job can still omit contractor identities or a separately managed plant network.

When evaluating tooling, test evidence traceability, site-specific ownership, version handling, review decisions, and export usability. Ask separately how prototype evidence is represented; an information-security mapping does not establish physical prototype protection. Do not assume a tool's output format will be accepted without discussing evidence expectations with the assessor.

Worked example: two locations, one engineering process

Assume, illustratively, a supplier operates an engineering office and a prototype workshop. Its customer requests objectives covering confidential development information and prototype protection at both locations.

The engineering team identifies the design repository and exchange service. Facilities maps workshop access and visitor handling. A review finds that repository permissions are reviewed centrally, but workshop access still includes two transferred employees.

The corrective action removes those permissions, assigns a local reviewer, and records the next review date. Evidence includes before-and-after access records, the approval decision, and the workshop's updated procedure. The self-assessment answer references these records and identifies the location concerned. This makes the finding, remedy, and implementation traceable without treating the central policy as proof for both sites.

Keep the assessment cycle usable

Before assessment, rehearse evidence retrieval with control owners and agree who handles findings. Track corrective actions through implementation and reassessment as required by the provider's process. Confirm how results will be shared with the requesting customer within ENX's rules. TISAX labels generally have a three-year validity period; maintain controls and consider scope changes between assessments.

Secani provides a connected workspace for requirements, owners, tasks, and evidence. Teams can attach site-specific records to controls, track gaps, and preserve human review decisions. Structured audit preparation helps reuse common work without losing local context.

Start with the customer's requested objectives, then select one critical information flow and trace the records that demonstrate its protection at every included location.