TISAX® Participant Handbook: How to Get the Most Out of the ENX Handbook

Anyone starting a TISAX® project will sooner or later come across the ENX TISAX® participant handbook. It is the official reference for the entire process – from registration through the assessment to sharing the result. This post is not a copy of the handbook but a reading guide from audit practice: what it contains, which chapters you really need and where small and mid-sized companies typically take a wrong turn.

What is the TISAX® participant handbook?

The participant handbook (German: „TISAX® Teilnehmerhandbuch“) is published by the ENX Association, which operates the TISAX® process for the automotive industry. It is aimed at TISAX® participants, i.e. companies that want to be assessed and share their result with partners. It describes the process – not the substantive security requirements. Those are found in the VDA ISA catalog, which we explain in our post TISAX® question catalog.

The distinction matters more than it sounds: the handbook tells you how to register, commission an audit provider and share your label. What has to be implemented in your ISMS is not in it.

Which version of the TISAX® handbook is current?

The current version is version 2.8 of March 13, 2025 (as of October 2026, according to the ENX handbook page). It is available in English and German; the other language versions (including French, Spanish, Italian, Polish, Czech, Chinese, Japanese, Korean) are in some cases still at version 2.7 or 2.7.1. According to ENX, the English version prevails in case of doubt.

Two notes for context: first, version 2.8 was released before VDA ISA 2027 was published in July 2026 – so the new catalog is not yet covered in the handbook. Second, according to the handbook, its explanations, examples and screenshots of the catalog still refer to ISA version 5. For your implementation, however, the catalog version that applies at the time your assessment is commissioned is what counts (see below).

How the ENX participant handbook is structured

The handbook follows the three-step TISAX® process. Here is how to use each chapter in practice:

• Chapter 1 – Overview: Purpose, target audience and notes on use. Skim it, then move on.
• Chapter 2 – Introduction: Why TISAX® exists and who defines what “secure” means. Useful when making the case to management.
• Chapter 3 – The TISAX® process: The three steps of registration, assessment and exchange at a glance. Ideal as an introduction for everyone involved in the project.
• Chapter 4 – Registration: Scope, locations, assessment objectives, assessment level, fees and online registration. The most important chapter before the project starts.
• Chapter 5 – Assessment: Self-assessment based on the VDA ISA catalog, selecting the audit provider and the assessment process through to the label. Required reading for the person responsible for the assessment.
• Chapter 6 – Exchange: How to publish your result or share it with individual partners – and which approvals are final.
• Chapter 7 – Appendices: Examples (invoice, confirmation email, scope excerpt), status descriptions, custom scope, scope extension, life cycle of the ISA catalog and complaint management. For reference when a specific case arises.
• Chapter 8 – Document history: What has changed between versions. Worth reading if you have worked with an older version.

The sections that really matter in practice

We know from our project work: hardly anyone reads the handbook cover to cover – and there is no need to. You should know these sections before you spend money:

1. Preparing the registration (chapter 4.3): This is where you decide on the scope type, locations, scope name and assessment objectives. Mistakes here cost money later, because locations added afterwards increase the fee and removed locations are not refunded. Our summary of the typical mistakes is available under TISAX® registration.
2. Assessment objectives and assessment level (chapter 4.3.3): Which assessment objective leads to which assessment level and what the auditor actually does at AL2 and AL3. This determines whether your assessment takes place remotely or on site.
3. Self-assessment (chapter 5.2): How the VDA ISA catalog is structured and how to fill it in. For the substantive work, the catalog itself is more important than this description.
4. Assessment process (chapter 5.4): Initial assessment, a corrective action plan if needed and follow-up assessment through to the label. This is where you learn what happens after a finding.
5. Exchange (chapter 6): Who may see your result. It explicitly states that publications and approvals cannot be revoked.

Typical misconceptions among SMEs

In our projects we keep encountering the same false assumptions – often because the handbook was only read in excerpts or in an old version.

“The handbook is the requirements catalog”

No. Anyone who reads only the handbook knows the process but not a single security requirement. The benchmark for your ISMS is the VDA ISA catalog. We therefore strongly recommend a gap analysis: it measures your company’s maturity against the catalog and shows exactly what still needs to be done to achieve TISAX® compliance.

“TISAX® is a certificate”

Formally, TISAX® is not a certification but a label, awarded after an assessment by an ENX-approved audit provider. The result is valid for three years and is shared via the ENX platform – not hung on the wall as a certificate.

“A custom scope suits us better”

That may be true in terms of content, but it rarely helps. According to the handbook, other participants only accept results based on the standard scope, and ENX explicitly recommends it.

“Better go straight for the highest assessment objective”

A higher assessment objective often leads to assessment level 3 – with an on-site assessment and significantly more effort. The handbook recommends agreeing the assessment objective with your partner. You should stick to that.

“All locations in one scope – that’s cheaper”

A shared scope means one result for all locations. That only works if all of them have the same assessment objectives and all of them pass. One weak location delays the label for the entire company.

ISA 6 or ISA 2027: What applies to an assessment commissioned today?

The participant handbook does not name any cut-off dates for ISA 2027 – the rule comes from ENX: the ISA version at the time the assessment is commissioned is what counts. Assessments commissioned by December 31, 2026 are conducted under VDA ISA 6. For all assessments commissioned from January 1, 2027, VDA ISA 2027 applies. Existing labels remain valid for their full term.

So an assessment you commission in October 2026 will still be assessed against ISA 6. If you are not planning to commission it until 2027, prepare directly for ISA 2027. You can find the changes in detail under VDA ISA 2027, and the structure of the catalog in the TISAX® question catalog.

Where to download the official participant handbook

The participant handbook is provided exclusively by ENX – as an online version, offline HTML and PDF in several languages: enx.com/handbook. Download it there so you always work with the current version. Copies from third-party sources are often outdated.

How 360 Digitale Transformation supports you

The handbook explains the process – the decisions are yours to make. In our consulting on TISAX®, we translate the ENX requirements to your situation: scope and locations, suitable assessment objectives, building the ISMS according to VDA ISA and support through to the label. It should always start with a gap analysis – it makes your maturity measurable and delivers the list of what is concretely missing on the way to TISAX® compliance.

Source: ENX Association, TISAX® Participant Handbook, version 2.8 of March 13, 2025 (enx.com/handbook).

Schedule a free initial consultation

About the author