TISAX can replace a large share of duplicate questionnaires from automotive customers, because one assessment is shared with many partners through the ENX portal. It will not replace every question, such as specific contract terms. Treat your TISAX result as the base answer, and add to it where a customer asks for more.
What is TISAX, in plain terms?
TISAX was built for the automotive industry to create a standard way to check information security across suppliers. It rests on the Information Security Assessment catalogue, known as the ISA, which the ENX Association maintains and the VDA publishes. ENX describes the old problem plainly: individual supplier audits and general requirement catalogues were inefficient, hard to scale and produced inconsistent results. TISAX replaces them with shared assessments that many partners recognize.
The ENX site lists the process as four steps: registration, selection of an audit provider, the assessment, and exchange of results. You register as a participant and define at least one assessment scope, which covers locations, processes and protection needs. An approved audit provider then runs the assessment, starting from your self-assessment against the ISA catalogue and followed by an external audit. The depth varies with the protection level required, from document review to on-site inspection. Results are issued as labels tied to objectives such as information security, data protection or prototype protection. ENX says labels are valid for three years.
The VDA published a new ISA edition, ISA2027, on 1 July 2026 according to ENX. If you are starting now, ask your audit provider which catalogue version applies to your assessment and to your customers' requirements.
How does TISAX help with questionnaires?
The results are shared through the ENX portal with partners you choose. ENX stresses that results are not public, so you control who sees them. A customer who accepts TISAX can read your label and scope instead of sending its own long form.
The trick is matching scope. A label covers the locations and processes you registered, at the protection level you assessed. If a customer's project involves a site or a data class outside that scope, the label does not cover it, and you will still get questions.
How do you reuse it in practice?
Build a small answer library:
- Your TISAX labels, scope and validity dates, ready to cite.
- A one page description of the assessed scope, in plain language.
- Short, accurate answers to the questions customers repeat, each pointing to the ISA control area it comes from.
- A list of questions TISAX does not answer, such as contract specifics, insurance or customer specific data processing terms.
When a questionnaire arrives, answer from the library first, mark the rest as new, and send those answers back for review by the right owner. Keep the answers consistent. A contradiction between a questionnaire and your assessment looks worse than a gap.
Where does software supply chain evidence fit?
The ISA catalogue covers information security broadly, and customers in automotive increasingly ask about software components inside products and tooling. Having an SBOM process and dependency scanning evidence helps you answer those questions faster. Safeguard can produce SBOMs and scan dependencies, which feeds that evidence. It does not grant or substitute for a TISAX label, which only an approved audit provider's assessment can produce.
What to do
- Ask your top customers whether they accept TISAX and at which assessment level.
- Register as a participant and define your scope with care, matching the sites and processes customers use.
- Choose an approved audit provider and agree the timeline early, since assessments take planning.
- Complete the self-assessment honestly and fix gaps before the external audit.
- Share the result in the ENX portal with each customer.
- Build the answer library and keep it current.
- Diary the three year validity and plan the renewal.
Quick check
How long is a TISAX label valid?
ENX states that labels are valid for three years.
Are TISAX results public?
No. ENX says results are not publicly available and are shared through the ENX portal with the partners you select.
Sources
Last reviewed: 18 October 2026.
