You can prepare for TISAX yourself by following the ENX process: register as a participant, define your assessment scope, run a self-assessment against the ISA catalogue, fix gaps, then have an approved audit provider assess you and share the result through the ENX portal. Your automotive customer decides which assessment objectives you need.
What is TISAX?
ENX describes TISAX as an information security assessment framework for the automotive industry, with the tagline assessed once, recognised by many. ENX governs it and maintains the ISA catalogue, which the VDA publishes, and runs the ENX Portal where participants share results. Results are issued as TISAX labels reflecting the assessment objective, such as information security, data protection or prototype protection. Labels are valid for three years, and results are not public: they are shared only with selected partners. The depth of the assessment ranges from document reviews to detailed on-site inspections depending on the protection need. Confirm assessment level and objective with your customer, because the ENX page we fetched did not list them.
What are the steps?
Step 1, ask the customer. Find out which assessment objectives and protection level your automotive partner needs. This sets the work.
Step 2, register. Register as a TISAX participant on the ENX portal and define at least one assessment scope, which includes locations, processes and protection needs. Scope is the most important choice, because the label applies only to it.
Step 3, define the scope with care. List sites, the teams and processes that handle the partner's information, and the systems involved. Keep the scope accurate, since an audit provider will check it.
Step 4, self-assessment against the ISA catalogue. Work through the catalogue's questions for your scope, rating where you stand and noting evidence. The ENX page says the assessment begins with a self-assessment based on the ISA catalogue.
Step 5, close gaps. Typical areas include policies and roles, access control, supplier management, incident handling, physical security of sites, and, if prototype protection is in scope, strict handling of prototypes and locations. Write short procedures that match practice.
Step 6, gather evidence. Keep policies with approval dates, access lists, training records, supplier agreements, asset lists and incident records. For each question, know where proof lives.
Step 7, choose an approved audit provider. ENX says you select an approved audit provider. Share your scope and self-assessment, agree the plan and dates.
Step 8, the external audit. Provide evidence and access to sites and people as the provider requires. Expect interviews, document reviews and, depending on the level, an on-site inspection.
Step 9, act on findings. Fix any nonconformities in the way the provider requires.
Step 10, share the result. After the assessment, exchange results with existing and potential partners through the ENX portal, and plan the renewal before the three years run out.
Who does what?
An owner coordinates the process. IT security answers technical questions. Facilities or site managers handle physical security. HR covers screening and training. Procurement manages suppliers. Management signs off the scope and the budget.
What mistakes are common?
- Scoping a single site when the data flows through others.
- Answering the self-assessment optimistically, then facing an audit that tests it.
- Missing the partner's required objective, and having to redo the work.
- Policies that are generic and untested.
- Forgetting the renewal date.
What to do
- Confirm the assessment objective and level with your customer.
- Register and define the scope with sites, processes and systems.
- Complete the ISA self-assessment honestly.
- Fix gaps and collect evidence for each question.
- Select an approved audit provider and agree timing.
- Share the result through the ENX portal and diary the renewal.
Quick check
How long is a TISAX label valid?
ENX says labels are valid for three years.
Are TISAX results public?
No. ENX says results are not publicly available and are shared only with selected partners through the ENX portal.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. Self-assessment answers need proof, and evidence is collected from connected systems and code instead of by screenshot. Monitoring runs between audits, which matters over a three year label. Technical evidence, such as vulnerability management and the software inventory, comes from your real code and dependencies through scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. The assessment is done by an independent, approved audit provider. Safeguard helps you prepare and keep evidence ready.
Open the framework mapping demo
Sources
- ENX, TISAX, fetched 18 October 2026
Last reviewed: 18 October 2026.
