TISAX in plain words: for automotive suppliers
Your automotive customer asked for a TISAX label. Here's what the assessment checks, which level and labels you need, how the ENX process runs, and what it means for your shop floor.
In 30 seconds
- What
- Trusted Information Security Assessment Exchange: an assessment and exchange mechanism run by the ENX Association for the automotive industry.
- Catalogue
- The VDA ISA, maintained by ENX and published by the VDA: information security, prototype protection, data protection.
- Levels
- AL1 is a self-assessment, unused for labels. AL2: the auditor checks your self-assessment with evidence and an interview, usually remote. AL3: a full on-site verification.
- Result
- Labels, such as Confidential or Proto parts, valid three years and shared on the ENX portal with the partners you choose. Results aren't public.
- Who asks
- Carmakers and large suppliers, before they share confidential data, prototypes or personal data with you.
- Versions
- ISA 6 applies today. ISA2027 applies to assessments ordered from 1 January 2027.
What TISAX is
TISAX lets an automotive company trust a partner’s information security without auditing it again. You’re assessed once against the VDA ISA catalogue by an audit provider that ENX has approved; the result, a set of labels, is shared on the ENX portal with the partners you choose. Carmakers and large suppliers use it before they hand over confidential designs, prototypes or personal data.
The process usually starts with a customer asking you for a given label. Ask for that request in writing: it decides the whole scope of the work.
The ISA catalogue
The VDA Information Security Assessment (ISA) is the list of requirements you’re assessed against. It has three catalogues; the labels you need decide which ones apply.
ISA 6 has applied to assessments ordered since 1 April 2024. ENX now publishes the ISA every year: ISA2027 applies to assessments ordered from 1 January 2027, with a reworked prototype protection module and stronger supplier security requirements.
Assessment levels and labels
Level 2 AL2
The audit provider checks your self-assessment for plausibility, with evidence and an interview with the person in charge of information security, generally by web conference.
Level 3 AL3
A comprehensive verification of everything, on site at your locations.
Level 1 is a self-assessment for internal use; TISAX doesn’t use it for labels. The Data and Special data labels cover processing personal data on a customer’s behalf under GDPR article 28; Special data adds the special categories of article 9.
How the process runs
- Step 1RegisterOn the ENX portal: company, scope, assessment objectives.
- Step 2Audit providerChoose an ENX-approved provider; your ISA self-assessment comes first.
- Step 3AssessmentRemote or on site, depending on the level. Gaps get corrective actions, up to nine months.
- Step 4ExchangeLabels on the ENX portal, shared with the partners you choose. Valid three years.
ENX doesn’t give a typical duration: it depends on your scope, your current maturity and the audit provider’s lead time. Most of the work happens before the assessment, while you fill in the self-assessment and close the gaps. For groups with three or more sites and a central security organisation, TISAX offers a simplified group assessment.
Production and OT: the realities
The ISA applies to the shop floor too, and a production site doesn’t run like an office. Plan for these early:
- Machines you can’t change. CNC machines, robots and test benches often run software their builder supplies and supports. Installing an agent or an update yourself can break that support. Agree with the builder what’s allowed, and document compensating measures: a separate network for production, controlled and logged remote access for the builder’s technicians, removable media rules.
- Monitoring and staff representatives. Logging, endpoint monitoring or video can count as monitoring staff. In Germany, the works council has a right of co-determination on technical devices designed to monitor employees’ behaviour or performance (section 87(1) no. 6 of the Works Constitution Act). Other countries have their own consultation rules: involve HR and staff representatives before you deploy, and record the decision.
- Prototypes on site. The Proto parts and Proto vehicles labels add physical security of the site and its surroundings, organisational rules and specific requirements for handling prototypes; Proto vehicles also checks protected garages and workshop areas. Building work takes time: plan it first.
- Shared accounts. Shop-floor terminals often run on a shared login. Each one needs a decision you can defend: personal accounts, or a documented exception with compensating controls.
Getting ready for TISAX: who does what
What QoBot does
- Works out with you which labels your customer needs, and so which level.
- Proposes the scope: sites, departments, systems, and what to leave out.
- Fills in the ISA self-assessment with you, control by control, from what's true today.
- Writes the missing policies and lists the evidence the auditor will ask for.
- Plans production and OT measures that fit machines you can't change, and tracks corrective actions.
What your team does
- Management sets the scope and approves the policies.
- You register on the ENX portal, choose the audit provider and book the assessment.
- Your IT and production teams apply the measures, with step-by-step guides.
- You consult your works council or staff representatives where monitoring tools are involved.
Kessler Präzisionstechnik's Tier-1 customer needs the Confidential and Proto parts labels: level 3, scope the Schwäbisch Gmünd plant and the design office. 41 ISA controls answered, 9 to work on. This week:
- Mr Albrecht (maintenance): list the CNC machines and each builder's remote access · template ready · ~45 minYour turn
- Sabine (authorised officer): share the endpoint monitoring plan with the works council · draft ready · ~20 minYour turn
- Klaus (managing director): approve the information security policy v1 · ~15 minNeeds you
FAQ
Which label do I need?
The one your customer asks for. Ask them in writing: the label decides the assessment level, so it decides the effort. Confidential and Data are assessed at level 2; Strictly confidential, Special data and the prototype labels for parts and vehicles at level 3.
How long does TISAX take?
ENX says it can't forecast the duration reliably: it depends on your scope, your maturity and the audit provider's lead time. Book the audit provider early, and use the time to fill in the self-assessment and close the gaps.
Is TISAX a certification?
ENX calls it an assessment, and the result is a set of labels. An audit provider approved by ENX runs it, and you decide which partners see your results on the ENX portal.
What if the audit finds gaps?
You agree a corrective action plan and have up to nine months to resolve the gaps. In some cases you get temporary labels, valid up to nine months, until the follow-up assessment.
We have ISO 27001. Does it count?
It helps a lot: the automotive industry wrote the ISA to tailor standards such as ISO/IEC 27001 to its needs, so much of your work carries over. TISAX still needs its own assessment, and adds prototype protection and data protection where your labels require them. See ISO 27001 in plain words.
Can QoBot get us the label?
No. Only an audit provider approved by ENX can assess you, and the label comes from that assessment. QoBot gets you ready: scope, self-assessment, policies, evidence list and the corrective action plan.
Sources
- TISAXENX Association · process, ISA catalogue, three-year validity, results not publicOfficial page
- TISAX Participant HandbookENX · assessment levels, assessment objectives and labels, corrective actions, validityOfficial text
- ISA2027 announcementENX, 1 July 2026 · ISA 6 since April 2024, ISA2027 for assessments ordered from 1 January 2027Official page
- TISAX downloads (VDA ISA)ENX · ISA 6.0.3 and ISA2027 cataloguesOfficial page
- TISAX FAQENX · audit providers approved by ENX; participants who require TISAXOfficial page
- Works Constitution Act (BetrVG), section 87Germany, official English translation · §87(1) no. 6, co-determination on monitoring devicesOfficial text
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error