Everything about TISAX® requirements: meeting and implementing the assessment standards

TISAX® stands for Trusted Information Security Assessment Exchange and is a registered trademark of the ENX Association. TISAX® is an assessment and exchange procedure for information security in the automotive industry.

It was developed by the German Association of the Automotive Industry (VDA) and is now managed by the ENX Association. It provides a standardized approach to reviewing and confirming the information security of companies operating in the automotive industry. It is often called “TISAX® certification” – formally, TISAX® is not a certification but a label, awarded after an assessment by an ENX-approved audit provider.

TISAX® is based on the international standard ISO/IEC 27001 and also includes specific requirements of the vehicle manufacturers. We have compiled this article for you based on our experience from more than 120 client projects.

Table of contents:

• What is TISAX® and why is the label important?
• Which requirements must be met for a TISAX® label?
• How can the TISAX® requirements be implemented successfully?
• Which steps are necessary to obtain a TISAX® label?

What is TISAX® and why is the label important?

The TISAX® label is crucial for companies in the automotive industry, as information security is particularly sensitive in this sector. By meeting the requirements of TISAX®, suppliers and service providers can demonstrate that they meet the necessary standards for protecting information. The assessment takes place at different assessment levels (Level 2 and Level 3), depending on the requirements. Companies that obtain a TISAX® label help to strengthen information security across the entire supply chain.

The ENX Association is an independent organization that approves the audit providers. It offers no consulting or support in preparing for the TISAX® assessment. Obtaining a TISAX® label requires considerable resources and financial means. The assessment objectives must be clearly defined and achieved in order to meet the requirements for TISAX®.

Fundamentals and significance of TISAX®

The VDA ISA catalogue defines three assessment levels; only AL2 (high protection need) and AL3 (very high protection need) are relevant for a TISAX® label. AL1 is a pure self-assessment without a label. Companies in the automotive industry and their suppliers must meet the requirements for a TISAX® label in order to demonstrate their information security. This is particularly important because protecting sensitive data and prototypes is highly relevant in the automotive sector.

To obtain a TISAX® label, companies must meet the TISAX® requirements, which help to build trust with customers and partners. Experienced consultants offer consulting and support in preparing for the TISAX® assessment to ensure that companies achieve the objectives they have set.

The requirements for TISAX® Levels 1 to 3 can be described as follows:

TISAX® Level 1:

The TISAX® Assessment Level 1 can be carried out by the company itself as a self-assessment. TISAX® Level 1 requires the company to assess itself against the ISA questionnaire, but this assessment is not reviewed. Because the measures are not checked objectively and the company alone is responsible for the results, this level has little significance in practice.

TISAX® Level 2:

At Level 2, a company's security requirements are classified as high. In an AL2 assessment, an audit provider approved by ENX checks your self-assessment for plausibility – based on evidence and an interview, usually conducted remotely by video conference.

TISAX® Level 3:

Level 3 under TISAX® means that the protection need is classified as “very high”. It is the highest security level for companies in the automotive industry. At Level 3, an auditor carries out on-site inspections and live interviews. Documents and evidence are checked, local conditions are taken into account, process execution is observed and unplanned interviews are held with process participants. An accredited auditor assesses the maturity of the information security management system (ISMS) on site at all of the company's locations.

These descriptions provide an overview of the respective expectations and the level of security that organizations must achieve at the different TISAX® levels.

Benefits of the TISAX® label

With a TISAX® label, suppliers and service providers demonstrate to their customers that their ISMS is effectively managed and monitored – proof that is valid for all participating OEMs.

The VDA ISA catalogue defines the requirements; registration and the exchange of results take place via the ENX portal. By preparing for the TISAX® assessment, suppliers and service providers can ensure that they achieve all assessment objectives and implement continuous improvement in their system. The TISAX® assessment therefore helps to standardize and document the process.

A TISAX® label makes you a preferred partner for OEMs and Tier 1 suppliers, because it proves that your information security meets the requirements of the industry. With the label, you meet a frequent prerequisite in tenders, avoid many individual security audits by single customers – the result is shared via the ENX portal – and gain access to business relationships that remain closed without a label.

At the same time, TISAX® requires structured and verifiable processes, for example for document management, access control and the handling of security incidents. This also makes your company more resilient, independently of customer requirements. In addition, TISAX® lays further foundations:

• Raising employee awareness of information security
• Regular training for secure operations
• Processes that are actually lived instead of documentation produced only for the assessment
• Key performance indicators (KPIs) that let you track the effectiveness of your information security

What are the differences between TISAX® and ISO 27001

The differences between TISAX® and ISO 27001 lie mainly in the specific objectives that must be met. While ISO 27001 defines general requirements for information security management systems, the TISAX® requirements are tailored specifically to the automotive industry.

ISO 27001 leads to a certificate with annual surveillance audits and a freely chosen scope. TISAX® leads to a label that is valid for three years; in practice, the assessment objectives and assessment level are specified by the customer, and the results are shared via the ENX portal.

What do TISAX® and ISO 27001 have in common?

ISO 27001 and TISAX® have significant similarities. This makes it possible to run both projects in parallel and manage them together, although this certainly means additional effort.

We have written a detailed article on the differences and similarities between ISO 27001 and TISAX®.

A TISAX® label already covers a large part of the requirements of the NIS-2 Directive, whose national implementation act (NIS2UmsuCG) has been in force in Germany since December 2025.

Which requirements must be met for a TISAX® label?

The TISAX® requirements are defined in the requirements catalogue of the German Association of the Automotive Industry (VDA). In the TISAX® assessment, an audit provider checks whether the requirements relevant to your assessment objectives have been implemented. The ISA questionnaire serves as an assessment and exchange mechanism.

The maturity model distinguishes 6 maturity levels:

Information security requirements under TISAX®

To obtain a TISAX® label, companies must meet certain expectations regarding their structure and information security. These include the defined objectives, which follow a standardized process.

Companies must meet the requirements of the VDA ISA questionnaire if they are aiming for a TISAX® label.

The label confirms that the company has taken the necessary measures to ensure information security and that it explicitly follows the requirements of the TISAX® questionnaire. This enables the company to gain a competitive advantage and build trust with customers and partners.

Insight into the VDA ISA questionnaire and its significance for the automotive industry

The information security requirements are defined in the ISA questionnaire. The new ISA 2027 applies to assessments commissioned from 1 January 2027. The ISA questionnaire is a tool used by the automotive industry to assess and improve information security in companies.

It provides a structured approach to identifying security risks and implementing appropriate measures to protect sensitive information. The significance of this catalogue for the automotive industry lies in its ability to help companies meet the growing requirements for data protection and information security.

Assessment objectives and protection need in the TISAX® audit

There are ten TISAX® assessment objectives: four for information security (confidentiality high/very high, availability high/very high), four for prototype protection (prototype parts, prototype vehicles, test vehicles, events with prototypes) and two for data protection (data; special categories of personal data).

The TISAX® process is complex and requires regular renewal every 3 years through a reassessment.

How can the TISAX® requirements be implemented successfully?

Tips on documentation and evidence

To implement the TISAX® requirements successfully, careful documentation (in German) and evidence are essential. First, a detailed analysis of all requirements should be carried out to ensure that all relevant aspects are covered.

1. Clear documentation of all measures taken is crucial to completing the assessment process successfully. It is advisable to store all relevant evidence in a well-organized system so that it can be presented quickly when needed.

2. In addition, regular reviews of the implemented measures should be carried out to ensure that the specified objectives are met in the long term. Companies that have followed an established process can hold their own against companies without a label.

3. There is no prescribed process for meeting the requirements. However, you should have followed a documented process. The Information Security Assessment catalogue supports companies in meeting the TISAX® requirements, building a secure system and maintaining it in day-to-day operations.

Consultants can help you meet the requirements for a TISAX® label in the audit

• Consultants support companies in preparing for the TISAX® assessment with a gap analysis in order to meet the strict assessment objectives.
• They can help develop and implement security measures and data protection standards to meet the requirements of TISAX®.
• Consultants usually also offer training and workshops to inform employees about the requirements of TISAX® and prepare them for the audit.
• They can help companies optimize internal processes to meet the TISAX® requirements and assist in creating the required documentation.
• While consultants prepare companies for the audit, they do not carry out formal audits or issue official audit reports.

The role of audit providers in the TISAX® assessment process

• Audit providers are responsible for carrying out the actual TISAX® audits, also called assessments.
• They must be officially approved and qualified by the ENX Association to perform this task.
• Their main task is to check the TISAX® requirements and assess whether a company meets them.
• Auditors carry out audits to ensure that the company has implemented the necessary security measures and meets the data protection standards.
• After completing the audit, auditors prepare a report containing the results of their assessment and any recommendations for improvement.

Consultants and audit providers have clearly separated roles: the consultant prepares your company, and the audit provider approved by ENX assesses independently. The two roles must never be held by the same organization.

The TISAX® assessment: process, levels and providers

The TISAX® assessment is the audit at the end of which you receive the label. It is carried out exclusively by an audit provider approved by ENX. How deeply you are audited is determined by the assessment level – and that follows from the assessment objectives you choose during registration.

How a TISAX® assessment works

1. Registration in the ENX portal: define scope, locations and assessment objectives – step by step in our article TISAX® registration.
2. Self-assessment: you rate your maturity level using the VDA ISA catalogue.
3. Initial assessment: the audit provider audits you – for AL2 usually by video conference, for AL3 on site.
4. Corrective action plan and follow-up: if the auditor finds deviations, you submit a corrective action plan; its implementation is checked in a follow-up assessment. The rules are set out in the TISAX® participant handbook.
5. Label: if you pass the assessment, you receive the label for each assessment objective in the ENX portal. The assessment result is valid for three years.

TISAX® assessment level 2

For AL2, the audit provider checks your self-assessment for plausibility, reviews evidence and interviews the person responsible for information security – usually by video conference. An on-site audit is possible at your request. AL2 is the level for assessment objectives with high protection needs and the normal case for most suppliers.

TISAX® assessment level 3

For AL3, the auditor verifies comprehensively: document review, planned and unplanned interviews, observation of processes – which is why the auditor comes to your locations. AL3 applies to very high protection needs, for example prototype protection. From our experience: for AL3 a good document is not enough – the auditor wants to see that people actually work according to it every day.

What does a TISAX® assessment cost?

The audit provider's fees depend mainly on the assessment level, the number of locations and the scope; the audit provider invoices them directly. Our fixed prices for preparing you for the assessment are on consulting on TISAX®.

TISAX® assessment providers: audit provider or consultant?

The assessment itself can only be carried out by an audit provider approved by ENX. A consultant prepares you for it – and both must not come from the same organization. Before the assessment we strongly recommend a gap analysis to measure your maturity level and determine exactly what still needs to be done for TISAX® compliance. How we then support you all the way to the label is described under consulting on TISAX®.

Which steps are necessary to obtain a TISAX® label?

How does the process from gap analysis to TISAX® label work in detail?

1. Gap analysis: In this phase, a comprehensive analysis is carried out to identify the gaps between your current processes and the requirements of the TISAX® standards. This helps to draw up a detailed action plan.
2. ENX registration: After the gap analysis, you register with ENX. This is a necessary step to start the assessment process. We will be happy to help you with the registration.
3. Selecting the audit provider: Here you choose an ENX-approved audit provider who will carry out the TISAX® assessment. The choice should be based on factors such as experience, expertise and cost. With our experience, we will be happy to support you in the selection.
4. Audit preparation: In this phase, you prepare your company for the upcoming assessment. This includes training staff, reviewing security policies and procedures, and making sure that all requirements are met.
5. Building and implementing the ISMS: You implement the information security management system (ISMS) in your company. This includes establishing security policies, procedures and controls.
6. Workshops: We run workshops with you to raise awareness and understanding of the requirements of the TISAX® standards. They also serve to train staff in the relevant security practices.
7. Self-assessment: Before the actual assessment, you carry out a self-assessment. This gives you the opportunity to evaluate your maturity level for the audit and close any remaining gaps. How the TISAX® self-assessment works — step by step.
8. TISAX® assessment: Finally, the TISAX® assessment takes place. The selected audit provider evaluates compliance with the TISAX® standards. After a successful assessment, you receive the TISAX® label you are aiming for.

Clearly described, documented and demonstrably lived processes make it easier for everyone involved in the organization to understand and implement the steps towards a successful TISAX® assessment. We will be happy to support you.

The process from preparation to a successful TISAX® label begins with understanding the assessment objectives and the requirements of the ISA requirements catalogue. The requirements must be implemented carefully to create a solid foundation for the assessment.

Gain a comprehensive understanding of meeting the TISAX® requirements, so that all relevant aspects are covered. Supporting measures such as training and internal audits are also a must in order to build up TISAX® and maintain it in day-to-day business operations. Ultimately, consistently implementing these steps leads to a successful assessment and demonstrates a company's commitment to the security and protection of sensitive data.

Effort and costs associated with a TISAX® label

The effort and costs of obtaining a TISAX® label can vary depending on the company and its requirements. It is important to estimate the potential costs and effort in advance and plan accordingly to ensure a smooth assessment process.

Your company's maturity level is decisive for the costs. A TISAX® project usually takes 3 to 12 months. Our consulting on TISAX® costs from €18,000 (AL2) or from €24,000 (AL3) at a fixed price after scoping; in addition, there is the ENX registration (€405) and the audit provider's assessment fees, which the audit provider invoices to you directly. You can find more information in our article on TISAX® costs (in German).

Can small companies meet the requirements for a TISAX® label?

Yes, small companies can definitely meet the requirements of TISAX®. The ISA questionnaire is designed so that even small businesses can work with it. The TISAX® requirements should be regarded as guidelines that can be implemented flexibly to achieve the desired assessment objectives and the required protection appropriately.

The decision on appropriateness is made individually for each company by the audit providers. However, both building an ISMS and the audit itself require a certain amount of effort and cost. We therefore advise micro-enterprises to weigh up whether the effort and the potential benefits of a TISAX® label are economically justifiable.

Our practical tips for meeting the TISAX® requirements from more than 120 client projects

You need to involve the following areas in a TISAX® project:

• Management: A TISAX® project is not possible without management support. The first requirement is therefore met when management support is in place.

• HR: Efficient hiring, the definition of sensitive activities, and onboarding and offboarding processes are an important part of a TISAX® project. In addition, planning and delivering training is one of the HR department's tasks.

• Facility management: Physical security, measures for the security zone concept, emergency plans and emergency drills are a must for successful TISAX® projects.

• IT: Self-explanatory. IT accounts for 60% of a TISAX® project. Regardless of this, the interfaces between the IT department and the other departments must be defined and documented.

• Purchasing: Suppliers relevant to information security and non-disclosure agreements with suppliers are a critical part of a TISAX® project.

• Compliance: The data protection officer (DPO) – if there is one – and, depending on the size of the company, the legal department should take part.

• Time. A TISAX® project and the maturity of an ISMS take time. Depending on your maturity level, you should plan 3 to 12 months for a TISAX® project. For larger companies and less mature processes, the time required tends to be at the upper end.

Arrange a free initial consultation