TISAX® Registration in the ENX Portal: Getting Scope, Assessment Objectives and Labels Right

TISAX® registration in the ENX portal is the first, fee-based step toward any TISAX® label: this is where you define your assessment scope, your locations and your assessment objectives – and with them the assessment level, effort and cost of the entire project. Companies that plan carefully here almost always choose the standard scope, agree on the assessment objectives with their customer in advance and avoid costly changes later on.

Book a free initial consultation

What Happens During TISAX® Registration – and Why It Costs Money

Registration makes your company a TISAX® participant with the ENX Association. ENX operates the TISAX® process, approves the audit providers and provides the platform through which you later share your result with customers. Without registration, no audit provider can carry out an assessment for you – according to ENX, it is the prerequisite for all further steps, and it is subject to a fee.

The fee is based on the ENX price list: in the standard model you pay €405 per location and scope, once for the validity period of the result; from five locations in one scope, ENX automatically grants a volume discount. According to the participant handbook, the fee is due even if you do not continue the process or do not pass the assessment. The audit provider's costs come on top of this – you will find an overview of all cost components under TISAX® costs (in German).

Formally, TISAX® is not a certification but a label awarded after an assessment by an ENX-approved audit provider. Registration is therefore not a form you fill out “on the side”, but the binding description of what will later be assessed and labeled.

The TISAX® Scope: Standard Scope or Custom Scope?

The assessment scope describes which part of your company is assessed. ENX distinguishes two types:

Standard scope: The description is predefined by ENX and cannot be changed. You only select the locations and assessment objectives.
Custom scope: You define the scope yourself, for example to extend it or to describe it freely.

In practice, the standard scope is almost always the right choice. The reason is stated in the participant handbook itself: other TISAX® participants only accept results based on the standard scope, and ENX explicitly recommends it. A custom scope may lead to your customer not recognizing the result – in which case the entire assessment was wasted.

More important than the type of scope is usually the question of which locations belong in a scope. A joint scope for several locations results in one report, one result and one expiration date. In return, all locations must have the same assessment objectives, and the result is only available once every location has passed. Whether one scope or several makes more sense is something we clarify together with you in the gap analysis.

Assessment Objectives and Assessment Levels: Which TISAX® Labels Exist

The assessment objective determines which requirements of the VDA ISA catalog apply to you. Each assessment objective corresponds to a TISAX® label of the same name, and each assessment objective is permanently assigned to an assessment level. By topic, the assessment objectives fall into four groups:

Topic	Assessment level 2 (high protection need)	Assessment level 3 (very high protection need)
Confidentiality of information	Confidential	Strictly confidential
Availability of information	High availability	Very high availability
Prototype protection	Test vehicles, Proto events	Proto parts, Proto vehicles
Data protection (processing on behalf according to Art. 28 GDPR)	Data	Special data (special categories according to Art. 9 GDPR)

The former assessment objectives “Info high” and “Info very high” could only be selected until March 31, 2024; they have been replaced by “Confidential” and “Strictly confidential”. If a customer still uses the old names in a request, they usually mean the respective successor label – clarify this before registering.

Who determines the assessment objective? Ideally, your customer. In our projects, OEMs and Tier 1 suppliers usually name the required label – sometimes only the assessment level. If there is no requirement, you choose yourself – and should also take foreseeable future customers into account. When in doubt, follow the ENX recommendation: ask your partner before the assessment process begins. We explain the requirements behind the individual modules under TISAX® requirements and in the TISAX® question catalog.

AL1, AL2, AL3: What the Auditor Actually Does

The assessment level describes the depth of the assessment. A higher level increases the assessment effort, and higher levels include the lower ones.

AL1: The auditor only checks whether a complete self-assessment exists – not its content. According to ENX, results at AL1 have a low level of trust and are not used in TISAX®. AL1 therefore plays practically no role in registration.
AL2: The audit provider performs a plausibility check of your self-assessment, reviews evidence and conducts an interview with the person responsible for information security – usually by video conference. An on-site assessment is possible at your request.
AL3: The auditor verifies comprehensively: document review, planned and unplanned interviews, observation of processes. For this, the audit provider must come to your locations.

From our audit practice: the difference between AL2 and AL3 lies less in the catalog than in the burden of proof. At AL3, a good document is not enough – the auditor wants to see that it is followed in day-to-day work, and to that end also talks to employees without prior preparation.

From Assessment Objective to Label: Validity and Renewal

If you pass the assessment, you receive the label of the same name for each assessment objective. Your assessment result is valid for three years. For renewal, you go through the three steps of registration, assessment and exchange again – with a new scope whose content may correspond to the old one. The ENX registration is therefore due once per three-year cycle.

The basis for the assessment is the VDA ISA version at the time the assessment is commissioned: assessments commissioned by December 31, 2026 follow ISA 6; assessments commissioned from January 1, 2027 follow VDA ISA 2027.

The Costly Mistakes in TISAX® Registration

We checked the following points against the current ENX participant handbook (version 2.8). Each of them costs money or time in practice.

1. Scope Name Without a Year

Every scope needs a name, and every renewal requires a new scope. ENX therefore recommends including the year of the assessment in the scope name, for example following the pattern “location or division + year”. If you skip this, you will end up with two identically named scopes at the latest during the re-assessment – and customers who do not know which result is current.

2. Adding or Removing Locations Afterwards

A scope can be changed as long as the audit provider has not completed the assessment. However: if something is added, the fee increases. If locations are removed, there is no refund. In addition, audit providers calculate their quote based on the original scope – so changes affect costs there as well. The list of locations should therefore be final before you submit.

3. Choosing an Assessment Objective That Is Too High

Choosing the higher assessment objective “just to be safe” sounds sensible, but in many cases it means AL3 instead of AL2: an on-site assessment, more comprehensive verification and significantly more preparation effort. Choose the assessment objective your customer requires or will foreseeably require – no more and no less.

During registration, you can specify whether your result is published on the exchange platform or shared with specific participants. According to ENX, publications and sharing approvals cannot be revoked. Conversely: if you do not share anything, nobody sees your result. Decide deliberately who should see what – sharing can still be approved later.

5. One Scope for Locations With Different Maturity Levels

Because all locations in a joint scope must pass, one weaker location can delay the result for all of them. Check before registering whether all locations are at a comparable level.

The Process in the ENX Portal at a Glance

The online registration is structured in a few clearly separated steps. For the first registration with one scope and one location, ENX estimates at least 20 minutes – the real work lies in the decisions made beforehand.

Create a portal account: personal access to the ENX portal.
Register the participant: your company's details as a TISAX® participant.
Name a contact person: the person ENX communicates with regarding the participant.
Accept the general terms and conditions: the English version must be confirmed online; a German translation is provided for information.
Register the assessment scope: scope name, scope type, contact person for the scope, assessment objectives, locations, optional publication and sharing, and the invoice recipient.
Confirmation email: usually within three business days, you receive your participant ID and scope ID as well as the list of approved audit providers.

After that, you select and commission one of the audit providers approved by ENX. How to prepare until then is explained in our article on the TISAX® participant handbook.

Download the TISAX® Scoping Guide for Free

Scope, locations and assessment objectives determine the effort and cost of the entire project. Our scoping guide walks you step by step through the ENX requirements – with a decision tree, location checklist and naming convention.

Frequently Asked Questions About TISAX® Registration

How much does TISAX® registration with ENX cost?

According to the ENX price list, registration in the standard model costs €405 per location and scope, once for the validity period of the result. From five locations in one scope, a volume discount applies automatically. The costs of the audit provider and of consulting come on top.

Which TISAX® labels are there?

There are labels for four topics: confidentiality (Confidential, Strictly confidential), availability (High availability, Very high availability), prototype protection (Test vehicles, Proto events, Proto parts, Proto vehicles) and data protection (Data, Special data). Each label corresponds to the assessment objective of the same name that you select during registration.

How long is a TISAX® label valid?

The assessment result is valid for three years. For renewal, you register a new scope and go through the assessment again.

Can I still change the scope after registration?

Yes, as long as the audit provider has not completed the assessment. However, additional locations increase the fee, and there is no refund for removed locations.

Who determines which assessment objective I need?

Usually your customer, who requires a specific label or assessment level. If there is no requirement, you choose yourself – when in doubt, after consulting your customer before you register.

Do I need to register even if I have an ISO 27001 certificate?

Yes. An ISO 27001 certificate replaces neither the registration nor the TISAX® assessment. It does, however, make preparation considerably easier because many requirements are already covered – learn more under TISAX® and ISO 27001.

Setting Up Your Registration Correctly – With 360DT

Since 2019, we have been supporting companies in the automotive supply chain with information security and TISAX®. As part of our consulting on TISAX®, we define scope, locations and assessment objectives together with you before you submit anything in the ENX portal – and then support you all the way to the label. The assessment itself is carried out by an ENX-approved audit provider; 360DT consults but does not assess. Alongside registration, we strongly recommend a gap analysis: it measures your company's maturity level and shows exactly what still needs to be done to achieve TISAX® compliance.

Get your open questions answered in a free 45-minute initial consultation.