Passeca - Governance, Risk management, and Compliance support
Under attack?
TISAX

TISAX Readiness & Assessment Support

Navigate TISAX requirements with confidence. We help automotive suppliers and manufacturers assess their security practices, address compliance gaps and prepare for an independent assessment.

Book a free compliance consultationSee all frameworks

TISAX (Trusted Information Security Assessment Exchange) helps automotive companies assess their information security and share results. Managed by the ENX Association, it follows the Information Security Assessment (ISA) catalogue developed by the German Automotive Industry Association (VDA).

Passeca supports you from scope definition and ENX registration to addressing security gaps and preparing for an independent assessment. We use Hyperproof to organise evidence that can also support ISO 27001 (the international standard for information security management systems).

Definition

What is TISAX?

TISAX — Trusted Information Security Assessment Exchange

TISAX (Trusted Information Security Assessment Exchange) is a shared assessment and exchange scheme for the European automotive industry. It is administered by ENX, the association of European automotive manufacturers, and it exists so that a supplier can be assessed once and share the result with many OEMs and tier-1 partners — instead of being audited separately by each customer.

The technical basis of a TISAX assessment is the VDA ISA (Information Security Assessment), a control catalogue maintained by the German Association of the Automotive Industry (VDA). The VDA ISA is heavily derived from ISO/IEC 27001 and adds automotive requirements around prototype protection, data exchange and development partners. Assessment is carried out by an ENX accredited audit provider, and the result is published as a TISAX label that participating companies can verify on the ENX portal for three years.

Scope

Who needs TISAX?

  • You supply a European automotive OEM or tier-1. Many make a valid TISAX label a contractual prerequisite for data exchange.
  • You handle design, prototype or development data. High protection needs push you to assessment level AL3 (on-site audit).
  • You are an engineering or software supplier to the sector. TISAX demonstrates maturity without per-customer audits.
  • An OEM invited you to join the ENX portal. That invitation is usually the trigger to start the assessment.
Requirements

What does TISAX actually require?

A TISAX assessment tests your organisation against the VDA ISA catalogue, which is structured around the ISO/IEC 27001 control domains with automotive-specific extensions. The depth of testing depends on your assessment level (AL1, AL2 or AL3), which is driven by the protection needs of the information you handle.

  • Governance and organisation — information-security policy, roles, management commitment and a defined management system.
  • Personnel security — background checks, confidentiality agreements, onboarding and offboarding, and security awareness.
  • Identity and access management — least privilege, MFA, privileged-access control and recertification.
  • Asset and data security — classification, handling of prototypes and confidential data, and clean-desk rules.
  • Development partners and suppliers — VDA ISA extensions covering joint development, data exchange and supply-chain security.
  • Operations and incident management — change management, vulnerability management, logging and incident response.
  • Physical security — site protection, secure zones for prototypes, and visitor management (heavily weighted at AL3).
  • Business continuity — backup, contingency and continuity planning.

For AL2, an accredited audit provider conducts a plausibility check of your self-assessment. For AL3, the provider performs an on-site audit including physical inspection of prototype-handling areas.

The engagement

How Passeca gets you through TISAX

  1. 01

    Scope & registration

    We define the assessment scope with you, determine the required assessment level (AL2 or AL3), and guide you through registration on the ENX portal so your scope is accepted the first time.

  2. 02

    Gap analysis (ISA)

    We assess your environment against the VDA ISA (Information Security Assessment) catalogue — the standard behind TISAX — and rank the gaps by the risk they pose to your assessment level.

  3. 03

    Remediation roadmap

    We build a sequenced, costed plan to close the gaps against the VDA ISA maturity expectations, with owners and dates. Most failures cluster in supplier management, HR and access control.

  4. 04

    Implementation & internal assessment

    We implement the missing controls, capture evidence in Hyperproof, and run a full internal assessment against the VDA ISA so findings are closed before the audit provider arrives.

  5. 05

    Assessment by an audit provider

    We introduce you to an ENX-accredited audit provider, accompany you through the assessment (including the on-site audit for AL3), and support the response to any findings until the label is granted.

Deliverables

What you get from the engagement

An ENX-registered scope at the correct assessment level (AL2 or AL3)
A VDA ISA gap report with maturity ratings and prioritised remediation
Implemented controls — supplier management, prototype protection, access control
An internal assessment against the full VDA ISA catalogue
Evidence pack in Hyperproof — reusable for ISO 27001 and BSI C5
Introduction to an ENX-accredited audit provider
On-site audit support — including physical prototype-zone walkthroughs for AL3
A published TISAX label verifiable on the ENX portal
Timeline

How long does a TISAX assessment take?

Assessment levelPreparation & implementationIndependent assessment
AL2 (normal protection)4–6 months2–4 weeks (plausibility check)
AL3 (high protection)6–9 months4–8 weeks (on-site audit)

Lead time to secure a slot with an ENX-accredited audit provider can add several weeks, so we recommend starting the ENX registration early in parallel with the gap analysis.

Overlap

Doing more than one framework?

 TISAX (VDA ISA)ISO 27001
Governance & policy
Risk assessment
Access control
Supplier / third-partyAutomotive-ext.
Prototype protectionGeneric physical
Awareness & HR
Incident management
Administered byENXISO/IEC
ResultTISAX labelCertificate

Because the VDA ISA is derived from ISO/IEC 27001, the two are highly complementary. An existing ISO 27001 ISMS typically closes the majority of the VDA ISA control set; the automotive-specific extensions (prototype handling, development-partner data exchange) are what Passeca adds on top.

FAQ

TISAX assessment, answered

What is TISAX?
TISAX (Trusted Information Security Assessment Exchange) is an assessment and exchange mechanism for the European automotive industry, administered by ENX. It lets suppliers demonstrate information-security maturity to OEMs and tier-1s through a single assessment against the VDA ISA catalogue, rather than being audited separately by each customer.
What is the difference between TISAX and the VDA ISA?
The VDA ISA (Information Security Assessment) is the questionnaire and control catalogue published by the German Association of the Automotive Industry. TISAX is the framework that governs how an assessment against the VDA ISA is conducted and how results are exchanged between automotive companies on the ENX platform.
What are the TISAX assessment levels?
There are three. AL1 is a self-assessment for very low protection needs and rarely requires an audit. AL2 is a plausibility check (often remote) for normal protection needs and is the most common. AL3 requires an on-site audit by an ENX-accredited provider for high protection needs — for example when handling highly confidential design data.
How long does TISAX assessment take?
From scope registration on the ENX portal to the assessment label, 4–8 months is typical for AL2; AL3 takes longer because of the on-site audit. The ENX registration itself and securing a slot with an audit provider often add a few weeks of lead time.
Who needs TISAX?
Any supplier, service provider or software vendor that exchanges information with European automotive OEMs or tier-1 suppliers — particularly those handling design, development, production or prototype data. Many OEMs make a valid TISAX label a contractual prerequisite for onboarding.
Does ISO 27001 help with TISAX?
Yes, significantly. The VDA ISA is heavily based on ISO/IEC 27001, so an existing ISO 27001 ISMS closes most of the TISAX control set. Passeca maps the evidence once in Hyperproof so the same work serves both assessments.
How long is a TISAX label valid?
A TISAX assessment label is valid for three years, after which a full reassessment is required. Passeca offers ongoing support to keep the controls operating and to prepare for reassessment well before expiry.
Always-on defence

Book a Free 30-Minute TISAX Consultation

Tell us which automotive manufacturer you're working with and what security requirements you need to meet. We'll help you identify the appropriate assessment level and discuss estimated timelines and costs.

Book a free consultationSee automotive bundle

Related

Compliance hubAll 11 frameworks in one placeISO 27001 CertificationThe basis of the VDA ISA control setThird-Party RiskAutomotive supply-chain obligationsAutomotive industryThe Passeca automotive bundleVirtual CISOOwn the TISAX program from €1,950/monthPenetration TestingTechnical testing for VDA ISABook a consultationFree 30-minute compliance consultation