How do you keep TISAX controls working after the audit?

TISAX results are valid for three years, but nothing checks your controls in the meantime, so you have to. Keep monitoring by naming a control owner for each requirement, collecting evidence on a schedule, tracking changes to sites and systems, and rehearsing the assessment well before it expires.

What does TISAX actually give you?

TISAX is an information security assessment framework for the automotive industry. Results are labels tied to an assessment objective, such as information security, data protection or prototype protection. Assessments are based on the ISA catalogue, which the ENX Association maintains and the VDA publishes. The ENX Association issues the labels and runs the portal where results are shared with partners. Results are not public.

Safeguard does not issue TISAX labels or make you compliant. This post is about the work that sits between two assessments.

Why does drift happen?

An assessment is a snapshot of a defined scope: locations, processes and protection needs. After it, people join and leave, a new office opens, a supplier changes, a cloud account is added. Each change can move something out of the scope you were assessed on, or weaken a control that was fine on audit day.

Partners who read your label assume it describes today. If your real state has moved, the label is out of step with the facts, and a later assessment will find it.

What should you monitor?

Scope changes. New sites, new rooms handling prototypes, new subsidiaries and new systems that hold partner data. Anything that touches the assessed scope needs a review.

Access. Joiner, mover and leaver records, plus a periodic review of who can reach protected data.

Technical hygiene. Patch status, vulnerable dependencies in software you build, endpoint and backup checks. For teams shipping software, a current software bill of materials and regular dependency scans make this concrete.

Suppliers. Contracts and security obligations for third parties that handle your data.

Incidents and exceptions. Every incident, near miss and approved exception, with owner and closure date.

Physical measures. Visitor handling, clean desk checks and prototype area controls, which no scanner sees.

What does a monthly rhythm look like?

Keep it small enough that people actually do it. In week one, the control owners confirm nothing in their area changed, or log what did. In week two, someone pulls access lists for the most sensitive systems and compares them to the current staff list. In week three, security reviews open incidents, exceptions and patch status. In week four, the lead writes a half page summary for management: what changed, what is overdue, what needs a decision.

The point is a paper trail. When the auditor asks how you knew a control kept working in month fourteen, you can show a dated note instead of an explanation from memory. Short and regular beats thorough and rare.

It also helps to decide in advance what counts as a trigger for an out of cycle review: a new site, a merger, a major supplier change, a serious incident, or a move of protected data to a new system. Write that list down once and attach it to your change process.

What to do

1. Keep the assessed scope statement in one place and review it every quarter.
2. Give each ISA control area a named owner with a deputy.
3. Decide what evidence proves each control and collect it monthly, not at reassessment.
4. Add a scope check to change management: any new site, system or supplier raises one question, does this touch the assessed scope.
5. Run an internal mock assessment about six months before expiry, using the current ISA catalogue.
6. Log open findings and corrective actions with dates and review them in management meetings.
7. Check the ENX Association pages for how and when to start reassessment, and book your audit provider early.
8. Keep a short change log you can hand to the auditor.

Quick check

Sources

• TISAX, ENX Association

Last reviewed: 18 October 2026.