We found no official ranking of the most common TISAX findings. ENX, which runs TISAX, does not publish one in the material we read, so any list claiming percentages is unverified. What is documented is how an assessment is scoped and what it is built on, and most preventable trouble starts there.
TISAX is the shared assessment and recognition framework for information security in the automotive industry. This post explains what ENX says, where teams tend to lose time because of how the process works, and how to prepare. It describes the framework and does not imply that any vendor can certify you.
What is TISAX built on?
Per ENX, TISAX replaces individual supplier audits with a standardized, scalable approach. It is based on the Information Security Assessment catalogue, which is "maintained by the ENX Association and published by the VDA." The page notes that a new version, ISA2027, has been released and that a German version, ISA2027.1, is available as of 1 October 2026. If your last assessment used an older catalogue version, check which version your next assessment will use.
How is an assessment scoped?
Registration needs a TISAX participant and "at least one TISAX Assessment Scope." The scope defines the relevant locations, processes and protection needs. The depth of assessment depends on the protection level required, from document reviews to detailed on site inspections. Results are issued as labels that match assessment objectives, such as information security, data protection or prototype protection. Labels are valid for three years.
Where does preparation go wrong?
These are patterns that follow from how the process is described, not statistics:
- A scope that does not match the contract. If your customer needs a label for a specific site or objective and your scope covers something else, the label does not help them. Ask the customer which objectives and which scope they expect before you register.
- Choosing a catalogue version late. The catalogue changes, and self assessment answers written against one version need rework against another.
- Documents without records. A policy proves intent. Reviewers also look for evidence that people follow it.
- Sites and processes left out of the picture. Scope covers locations and processes, so a forgotten office or subcontracted process can surface late.
- Letting the three year label lapse. A label expires, and renewal needs lead time.
How does software supply chain work fit in?
The ISA catalogue covers information security broadly, so teams that build or ship software for automotive customers usually need to show how they handle components they did not write: an inventory, a way to learn about vulnerabilities and a process for fixing them. We did not confirm the exact catalogue control numbers for this, so look up the relevant questions in the current ISA catalogue rather than relying on a blog summary.
What to do
- Ask each automotive customer which assessment objectives and which scope they require.
- Download the current ISA catalogue from ENX and confirm which version applies.
- Map your sites, processes and subcontractors to a scope draft.
- Run an internal gap check against the catalogue questions and record the evidence for each.
- Fix gaps with owners and dates, and keep the records.
- Decide on an assessment provider and book early.
- Put the label expiry date in a calendar with a lead time for renewal.
Quick check
What are the most common TISAX findings?
No ranked list is published in the ENX material we read. Treat claims with percentages as unverified and prepare against the ISA catalogue itself.
How long is a TISAX label valid?
ENX states that labels are valid for three years.
Sources
Last reviewed: 18 October 2026.
