You can prepare for TISAX in about twelve weeks if the scope is clear and your information security basics exist, but the assessment is performed by an approved audit provider on their schedule. The plan: confirm scope and assessment level with your customer, register, self assess against the ISA catalogue, close gaps, then undergo the audit and share results.
How does TISAX work?
According to the ENX Association's TISAX page, fetched 18 October 2026, TISAX is based on the Information Security Assessment (ISA) catalogue maintained by ENX and published by the VDA, for the automotive industry. The process has four steps: registration of a participant and at least one assessment scope, selection of an audit provider, the assessment, and the exchange of results with partners through the ENX Portal.
The page says the assessment starts with a self assessment based on the ISA catalogue and is followed by an external audit, ranging from document reviews to detailed on site inspections depending on the protection level required. Results are issued as TISAX labels reflecting assessment objectives such as information security, data protection or prototype protection, and the labels are valid for three years. Results are not public. You share them with chosen partners.
The page also announces that the VDA published a new ISA2027 on 1 July 2026. Confirm which catalogue version your audit will use, and when, with your audit provider.
The calendar is our planning suggestion, not an ENX timeline.
The twelve weeks
Week 1, requirements from your customer. Ask which assessment objectives and which assessment level your automotive customer expects, and which sites and services they want covered. Get it in writing. Choose an internal owner and sponsor.
Week 2, define scope. The registration process defines relevant locations, processes and protection needs. Decide which sites, networks, teams and information types are inside the scope, and what is outside and why. Prototype protection, if relevant, adds physical and organisational demands.
Week 3, register. Create your participant account in the ENX Portal and register the scope. Audit provider selection follows registration.
Weeks 3 to 5, self assessment. Score each ISA requirement honestly with notes on evidence. The catalogue is aligned with other big standards, so existing material, for instance from ISO 27001 work, may help. Do not inflate your scores: the auditor will check.
Week 5, gap plan. Rank gaps by effort and by audit risk. Typical heavy items are asset classification, supplier controls, physical security, access management, incident handling and business continuity.
Weeks 6 to 9, closing gaps. Write missing policies, implement technical controls, run an access review, test incident response, check supplier contracts and fix physical measures. Keep evidence as you go.
Week 8, choose the audit provider. Compare approved providers on availability, sector experience and approach. Agree scope, level and dates. Because you pick a provider after registration, plan the calendar around their lead time.
Week 10, internal readiness review. Someone independent samples requirements and tests the evidence, interviews staff and walks the site if on site inspection applies.
Week 11, fix and freeze. Close what the review found. Freeze a document set with versions and dates. Brief interviewees.
Week 12, handover to the audit. Submit the self assessment as required, provide access and answer questions quickly. After the assessment, you receive results and decide with whom to share them through the portal.
Who does what?
The security owner coordinates. IT, facilities, HR and procurement each own part of the catalogue. Management supports. The audit provider assesses and the ENX platform handles registration and exchange.
What mistakes recur?
- Starting before knowing what the customer requires.
- Scope too broad, adding sites that do not handle the information.
- Scores that rise because someone wanted them to.
- Physical security neglected until the on site audit.
- Supplier controls left to the end.
- Missing that labels are valid for a limited period, so a renewal cycle starts when you pass.
What to do
- Get the customer's required objectives and level in writing.
- Define scope across sites, processes and protection needs.
- Register in the ENX Portal.
- Complete an honest self assessment with evidence notes.
- Rank and close gaps in order of audit risk.
- Select an audit provider early and agree dates.
- Run an independent readiness review before the audit.
- Plan the renewal before the label's three year period ends.
Quick check
Do we pick the audit provider before registering?
No. ENX describes registration first, then selection of an audit provider, then the assessment.
How long is a TISAX label valid?
ENX states that labels are valid for three years.
Sources
- ENX Association, About TISAX, fetched 18 October 2026.
How Safeguard helps automate this
Self assessment and audit both depend on evidence that is current. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than screenshots, and monitoring continues between assessments, which helps when a customer asks mid cycle. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. The remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready; an approved audit provider performs the assessment. See the mapping demo below or book a call.
Explore the framework mapping demo.
Last reviewed: 18 October 2026.
