TISAX® Frequently Asked Questions

TISAX stands for Trusted Information Security Assessment Exchange. It is an assessment and results-exchange mechanism used primarily in the automotive supply chain.

TISAX is an industry-specific mechanism for assessing information security against the VDA ISA requirements and exchanging assessment results with authorized business partners.

The ENX Association operates the TISAX mechanism. The VDA developed the underlying Information Security Assessment (ISA) catalog for automotive-industry requirements.

No. TISAX is an assessment and exchange mechanism, not an ISO-style certification scheme. Successful assessments can result in TISAX labels associated with defined assessment objectives.

TISAX labels are generally valid for three years, subject to the applicable TISAX rules and assessment outcome. Organizations must maintain the implemented controls throughout that period.

TISAX is not a general statutory requirement. Automotive customers may nevertheless require particular TISAX assessment objectives and results as a contractual condition.

Suppliers, engineering service providers, software companies, logistics partners and other organizations handling automotive customer information may need TISAX when a customer requires it.

Yes. TISAX is used internationally. Organizations in Europe, North America, Asia and other regions can participate if they need to demonstrate information security to automotive partners.

VDA ISA is the automotive information security assessment catalog used as the assessment basis for TISAX. It includes information security requirements and, where applicable, additional areas such as prototype protection and data protection.

It is more accurate to state that the organization has undergone a TISAX assessment and holds specified TISAX labels for its defined scope. Avoid suggesting an ISO-style certificate or coverage beyond the assessed scope.

Assessment levels describe the depth and assurance of the assessment. AL1 is self-assessment, AL2 involves an external plausibility assessment and AL3 involves more extensive verification, typically including on-site activities.

AL1 is an internal self-assessment without the independent verification associated with AL2 or AL3. It is generally not suitable when a customer requires an externally verified TISAX result.

AL2 involves an authorized TISAX audit provider reviewing the self-assessment and supporting evidence, generally through interviews and plausibility checks. The exact activities depend on the applicable rules and findings.

AL3 is a more in-depth independent assessment, normally including on-site verification, interviews, observation and examination of evidence for the relevant assessment objectives.

The customer or business partner normally specifies the protection needs and required TISAX assessment objectives. The participant should confirm these before registration and scope design.

Assessment objectives identify the protection outcomes to be demonstrated, such as information with high or very high protection needs, or specific prototype and data protection needs. The available objectives and their associated assessment levels depend on the current TISAX catalog.

Very high protection needs indicate potentially more severe consequences if information is compromised. The customer determines the classification using the relevant business and information risks; it is not simply a choice by the supplier.

No. Prototype-related objectives have different protection requirements and may have different associated assessment levels. Confirm the exact current objective and its required assessment level rather than assuming all prototype activities require AL3.

Not when the customer requires an objective associated with AL3. The assessment level must meet the relevant objective and contractual expectations.

Yes, multiple assessment objectives may be included in an assessment if the scope, applicability and audit planning support them. Confirm the combination with the selected audit provider.

The assessment scope defines the organizational units, locations, processes and interfaces covered by the TISAX assessment. It must represent the relevant information handling and security responsibilities.

Not necessarily. The scope may be limited to the relevant organizational environment, but it must follow TISAX scope rules and include supporting services and interfaces that affect the protected information.

A scope can include a single location if it adequately covers the relevant activities and dependencies. Shared IT, remote workers and centrally provided services still need to be considered.

Yes. Multi-location scopes are possible where the participating sites and shared controls are defined and assessed under the applicable TISAX rules.

Remote work must be considered when employees access or process in-scope information. Relevant controls include managed devices, secure connectivity, physical confidentiality and remote-working procedures.

Cloud services supporting in-scope activities must be considered as dependencies and managed through appropriate supplier, access, configuration, logging and risk controls. The cloud provider is not automatically part of the participant’s organizational scope.

A shared IT function cannot simply be ignored when it operates systems or controls used by the assessed environment. Its relevant responsibilities and evidence must be addressed in scope planning.

TISAX defines scope approaches with different rules and implications for result exchange. A standard scope is generally designed for broad recognition; a custom scope may have limitations. Verify current definitions with ENX and the audit provider.

The main phases are registration and scope definition, preparation and self-assessment, independent assessment by an authorized audit provider, remediation where needed, and controlled exchange of results.

The organization registers as a participant with ENX, defines its assessment scope and objectives, and follows the registration instructions before contracting an authorized audit provider.

Yes. Participants select from audit providers authorized for TISAX by ENX. Compare experience, availability, scope coverage, language and commercial terms.

It is a structured evaluation of how the organization meets the applicable VDA ISA requirements, including maturity ratings, evidence and identified gaps. It is a key input to assessment preparation.

Typical evidence includes policies, scope and asset inventories, risk assessments, access reviews, supplier controls, incident procedures, training records, operational logs and records proving that controls work in practice.

The audit provider evaluates the defined scope against the applicable requirements using document review, interviews and other verification appropriate to the assessment level. Findings are recorded in the assessment result.

Some AL2 activities are commonly conducted remotely. AL3 generally requires on-site verification. The audit provider determines the permitted assessment approach under the applicable TISAX rules.

Participants control the release of TISAX results to selected partners through the ENX exchange mechanism, using the available sharing and access settings.

TISAX results are not simply published as public certificates. Access and sharing are managed through the TISAX exchange mechanism and its permission model.

Assign knowledgeable process owners, validate that procedures match actual practice, collect dated evidence and rehearse clear explanations of how security controls operate. Avoid memorized answers unsupported by records.

Total cost depends on ENX fees, audit provider charges, number of locations, assessment objectives, scope complexity and internal preparation effort. Request current quotations rather than relying on a universal fixed price.

Not necessarily. ENX participation or registration charges and the independent audit provider’s fees are distinct cost components. Check each quotation for what is included.

Preparation time varies with organizational maturity, scope, resources and the gaps found. A mature ISMS may need focused adaptation, while an organization starting from scratch can require substantially longer.

The duration of audit activities depends on the assessment level, objectives, sites, workforce, evidence quality and audit provider schedule. Remediation and follow-up activities may extend the overall process.

Yes. Small organizations can participate, but must implement controls appropriate to the applicable requirements and their risks. A small headcount does not remove the need for reliable evidence and accountability.

Typical contributors include management, information security, IT operations, HR, procurement, legal or privacy specialists, facilities and the owners of in-scope business processes.

An existing effective ISMS may reduce preparation effort and duplicate documentation, but it does not automatically waive TISAX assessment fees or the independent assessment.

Confirm customer objectives early, design a defensible scope, reuse proven controls, complete a realistic gap assessment and collect operational evidence before the auditor arrives. Do not reduce scope artificially.

Maturity level 3 is the general target for applicable VDA ISA controls. The overall assessment outcome also depends on the scoring methodology, deviations and applicable assessment rules.

Level 3 generally describes an established, defined process that is implemented and integrated into organizational practice. Written policies alone are not enough; consistent execution must be demonstrable.

Not necessarily. The VDA ISA evaluation method considers individual ratings and the overall maturity calculation, while certain significant weaknesses may still affect the assessment outcome. Do not treat an average score alone as a guarantee.

A policy states the intended rule. Evidence shows the rule is implemented, such as access approvals, completed training, configuration records, incident tickets or management reviews.

Risk management is a core element of information security. The organization should identify relevant risks, assign owners, select treatments and demonstrate that risk decisions inform operational controls.

Use defined approval, least-privilege allocation, periodic review, timely removal and traceable administration of privileged access. Apply controls consistently across in-scope applications and infrastructure.

Organizations should identify suppliers affecting protected information, assess relevant risks, define contractual security expectations and monitor performance or assurance proportionate to those risks.

No. Awareness is one supporting control. TISAX preparation also requires technical, organizational and physical measures that operate consistently and can be verified.

Incident management should include reporting paths, assigned responsibilities, classification, response, escalation, evidence retention and lessons learned. Records of exercises or real cases help demonstrate operation.

A recurring implementation risk is documenting controls without making them operational. Auditors assess actual execution, ownership and evidence, not simply the existence of templates.

ISO/IEC 27001 is an internationally recognized management-system certification standard. TISAX is an automotive-sector assessment and results-exchange mechanism based on VDA ISA, with sector-specific requirements and maturity evaluation.

No. A customer requesting TISAX objectives generally expects a TISAX assessment result. ISO 27001 certification can provide a strong foundation but is not an automatic substitute.

Yes. Reuse the ISMS scope, risk processes, policies, internal audit records and operational evidence where they satisfy VDA ISA requirements. Perform a mapping and gap analysis for differences.

No. Organizations can undergo TISAX assessment without holding an ISO 27001 certificate, provided they meet the applicable VDA ISA requirements.

The right sequence depends on customer deadlines, organizational strategy and existing controls. An integrated ISMS can support both; prioritize mandatory customer objectives while avoiding duplicate processes.

Yes. A unified governance, risk, asset, supplier and operational control framework can support both, with separate mappings, evidence and assessment arrangements for their different requirements.

The audit provider documents findings. The participant analyzes root causes, defines corrective actions, assigns owners and provides evidence of remediation according to the applicable TISAX process.

Not always. The effect depends on the severity and nature of findings, the assessment result and the permitted corrective-action process. Confirm the outcome with the audit provider.

The TISAX process generally provides a maximum nine-month window measured from the initial assessment for completing the corrective-action process. Specific deadlines and follow-up conditions should be confirmed under the current rules.

It is a documented plan connecting each finding to root cause, required change, accountable owner, due date and objective evidence showing that the weakness has been addressed.

Temporary or compensating measures may be considered within the applicable assessment process, but they do not automatically replace required sustainable corrective action. Acceptance rests with the audit provider and rules.

A follow-up assessment verifies whether corrective actions adequately address findings. The verification method and depth depend on the finding, assessment level and applicable process.

Missing the permitted deadline can prevent successful completion of the existing assessment process and may require a new initial assessment. Discuss the implications promptly with the audit provider.

Assign control owners, monitor key processes, conduct periodic internal reviews, update risk assessments, manage changes and retain evidence so that the security level remains sustainable.

US companies may need TISAX if an automotive customer requires relevant assessment objectives. There is no general rule that every US supplier must participate.

Yes. TISAX participation is international. The organization must define an eligible scope and use an authorized audit provider able to assess the relevant locations and objectives.

No. SOC 2 reports and TISAX assessments use different criteria, assurance approaches and sharing mechanisms. Existing SOC 2 controls may help preparation but do not automatically meet customer TISAX requirements.

Potentially, but only when the defined scope, locations, responsibilities and TISAX rules support that coverage. A group-level label does not automatically extend to every subsidiary.

Use a language that relevant employees understand and that the audit provider can assess effectively. Agree on interview and evidence language early, especially for multi-country scopes.

GDPR is a legal framework for personal data protection. TISAX may include data-protection-related assessment objectives, but a TISAX result does not establish comprehensive legal compliance with GDPR.