TISAX.
The automotive industry's assessment and exchange process: clarify objectives, have the appropriate scope assessed and share results with business partners.
- ENX · VDA ISA · TISAX Participant Handbook
- By Derya Altinay
- As of: 10/22/2026
- Reading time: 8 min.
Short answer.
TISAX is the information security assessment and exchange mechanism for the automotive supply chain. Companies have an approved assessment provider evaluate a defined scope against VDA ISA. TISAX labels summarise achieved assessment objectives; results are shared with selected business partners through the ENX portal. The basis is the ENX TISAX Participant Handbook.
TISAX, ENX and VDA ISA have different roles.
TISAX stands for Trusted Information Security Assessment Exchange and combines external assessments with a regulated exchange of results. The ENX Association governs the process. The Information Security Assessment, or ISA, is the assessment catalogue; the ENX Working Group ISA develops it, and the German Association of the Automotive Industry publishes it as VDA ISA. ENX describes these roles on its ISA information page.
VDA ISA creates a common basis for handling information requiring protection. Manufacturers, suppliers, development service providers and software companies can cooperate using the same assessment basis. According to the ENX ISA overview, this aims to reduce individual security assessments by each customer. Which results a customer accepts still depends on the agreed assessment objectives and the scope actually covered.
ISA2027.1 has been available in German and English since 1 October 2026; the English version remains authoritative for assessments. ENX announces ISA2027 as the basis for assessments commissioned from 1 January 2027. According to the ENX transition information of 7 August 2026, the commissioning date is decisive, rather than the scope registration date. Assessments commissioned earlier may still use ISA6 under the transition rules.
Annual ISA editions do not mean annual reassessment. The ENX publication on ISA2027 of 1 July 2026 distinguishes the new publication cycle from the validity of existing labels. When planning across the year end, companies should therefore explicitly document the agreed catalogue version and assessment engagement, rather than just using the name of the most recently downloaded file.
TISAX concerns cooperation in the supply chain.
TISAX becomes relevant when a business partner requests corresponding security evidence for cooperation. In addition to manufacturers and suppliers, the ENX ISA overview names service providers, software developers and engineering partners. The information, activities and sites involved in the business relationship are decisive. This does not create a general statutory TISAX obligation for every company.
The assessment scope describes which part of the company is evaluated. Clarify with the requesting customer which companies and sites should be included and which assessment objectives are expected. Preparation should also account for supporting services, so that centrally operated IT or external cooperation remains visible. Agree the specific boundaries with the assessment provider.
A company can provide results while also requesting results from its own business partners. This makes the regulated exchange useful for procurement and supplier management. Participant registration alone, however, says nothing about a passed assessment or covered objectives; this information only emerges from the specific assessment result.
TISAX examines organisation and security in practice.
Preparation encompasses organisational, technical and site-specific security work. The following topics describe general work areas and do not reproduce the ISA requirements catalogue. Which topics are assessed, and to what depth, depends on the agreed objectives and applicable ISA version.
Responsibility and security management.
The organisation needs traceable responsibilities and decisions for protecting its information. A policy describes the intended working approach; preparation becomes robust when owners can also explain how risks are assessed, controls managed and changes taken into account.
People and cooperation.
Employees and external participants must know their responsibilities when handling protected information. Preparation therefore brings together personnel processes, confidentiality, training and coordination between business functions. Practical execution remains the organisation's task even when individual activities are outsourced.
Information, access and IT operations.
Safeguards should cover actual information flows. Consider permissions, systems used, data exchange, recovery and incident handling together. The existing blog article on preparing for a TISAX assessment covers technical preparation details and suitable evidence.
Sites and the physical environment.
Site-specific security cannot be derived solely from a central IT rule. Rooms, access and the actual handling of visitors or items requiring protection also matter for the agreed scope. The responsible teams should be able to explain their local procedures and find the associated records.
Suppliers and external services.
External services can affect the security of your own service. Preparation should therefore show which providers are involved, what information they receive and which expectations have been agreed. A blanket assumption that every supplier needs the same label does not replace consideration of its specific role.
Prototype protection and data protection according to objectives.
Prototype protection and data protection are added according to the selected assessment objectives. The ENX TISAX overview explicitly lists these areas alongside information security. Clarify early whether, for example, development objects, testing or personal information form part of the customer's requirements; a broadly worded information security objective does not answer that question.
The TISAX assessment starts with the customer's requirements.
Clarify objectives and scope.
Record the requested assessment objectives, sites and required timing before planning preparation as a joint project between business functions and security owners.
Register the participant and scope.
Register the company and assessment scope through the ENX portal; according to the ENX process overview, registration is a prerequisite for subsequent process steps.
Select an assessment provider.
Choose a provider from the official ENX directory and agree scope, catalogue version and assessment dates, rather than assuming any audit engagement will suffice.
Prepare the self-assessment.
Describe actual implementation status and link existing records so that statements can be verifiably examined in the subsequent external assessment.
Manage the assessment and corrections.
Have the agreed assessment performed and address findings with the responsible teams under the agreed assessment procedure.
Share the result selectively.
Release the available assessment result to the intended business partners in the ENX portal, then check that the requested objectives and sites are recognisably covered.
TISAX labels and assessment levels describe different things.
The TISAX assessment produces a report and a result for the agreed scope. Labels summarise achieved assessment objectives; they are not an unrestricted judgement on every activity of a corporate group. The ENX directory lists approved assessment providers. When selecting one, clarify matters such as geographical coverage and the specific services included, so that quotations address the same assessment needs.
The assessment level describes the assessment method; maturity describes implementation status. Under section 4.3.3.5 of the TISAX Participant Handbook, AL1 is for internal self-assessments and is not used in TISAX as an exchangeable result. AL2 includes a plausibility check; AL3 includes a more comprehensive examination with on-site activities. A higher level is therefore not a freely chosen maturity grade.
TISAX labels are generally valid for three years. Section 5.4.14.2 of the Participant Handbook lists scope changes as a possible reason for shorter validity. The result remains selectively shareable through the ENX portal and is not a public company ranking. Define internally who will track changes, customer enquiries and the next assessment cycle.
Other frameworks retain their own purpose.
ISO 27001 describes requirements for an information security management system; TISAX uses its own assessment and exchange process for the automotive supply chain. Existing security work can support preparation, but does not replace the agreed TISAX objectives and scope. The GDPR separately governs the handling of personal data; a TISAX label does not answer every data protection question about a processing activity.
In Secani.
Secani provides an editorial TISAX assessment catalogue for VDA ISA 6.0.3. Scope and details of the selected objectives can be recorded in the assessment profile. The product catalogue is distinct from the future ISA2027.1 assessment basis; the version confirmed with the assessment provider remains authoritative for the external assessment.
Next step: determine the evidence needed.
Ask the requesting business partner for the expected assessment objectives and relevant sites. Compare these details with your own service scope and clarify unresolved boundaries before registration. Preparation can then be planned specifically, without first assembling extensive records for an undefined scope.
Sources.
- ENX: TISAX and process overview
- ENX: role and purpose of VDA ISA
- TISAX Participant Handbook 2.8: sections 4.3.3.5, 5.4.13–5.4.14 and 6
- ENX: ISA2027 published, 1 July 2026
- ENX: ISA2027 transition information, 7 August 2026
- ENX: ISA2027.1 in German and English, 1 October 2026
- ENX: Download Center with catalogue versions
- ENX: directory of TISAX assessment providers
Frequently asked questions.
TISAX is an assessment and exchange process with an assessment result and labels. The common search phrase “TISAX certification” therefore refers to a different form of evidence from an ISO 27001 certificate.
No. The assessment level describes examination depth; maturity describes the assessed implementation status. Clarify the requested assessment objectives rather than agreeing only on a level number.
No. AL1 serves internal purposes; its results are not shared through TISAX and do not lead to TISAX labels.
Generally three years. Temporary labels and significant changes to assessment scope can mean a shorter term; the process must be completed again for the next assessment cycle.
Prepare for TISAX with a clear scope.
Discover the TISAX catalogue and assessment profile in Secani.
This page provides general context on TISAX. Current ENX publications, VDA ISA and the agreed assessment engagement take precedence.