After you pass TISAX, keep your controls running and evidenced, track changes that affect your scope, and prepare renewal early. ENX says labels are valid for three years, and renewal repeats the process with a new scope. Monitoring between assessments is what makes renewal a repeat rather than a rebuild.
This guide uses the ENX TISAX overview and the first part of the TISAX Participant Handbook, both read on 18 October 2026. We did not find ENX rules on mid-cycle reporting in what we read, so ask ENX or your audit provider what applies to you.
What does the label depend on?
Your label reflects the assessment objectives you passed within the scope you registered, assessed against the ISA catalogue. ENX says results are shared with partners through the ENX Portal and are not publicly available. Partners can see your status, so a lapse is visible to them. The handbook also mentions temporary labels in some cases, such as when a corrective action plan is pending, so track any open actions closely.
What should you monitor continuously?
Corrective actions. If the assessment raised findings, keep a tracker with owners, dates and proof of closure.
Scope drift. New locations, moved teams, new systems handling partner information, new subcontractors. The handbook says you cannot edit a registered scope yourself, and adding locations has fee implications, so catch changes early and ask how to handle them.
Objective changes. A partner may ask for higher protection needs. The handbook maps some objectives to Level 3, and higher levels include lower ones. Know which objectives each partner needs next.
Control health. Re-run the checks you built for assessment: access reviews, patching, backups, logging, endpoint rules, awareness training, physical access where in scope, supplier reviews, incident handling.
Catalogue version. The ENX page notes the VDA has published ISA2027 and a German version of ISA2027.1 became available on 1 October 2026. Check which version your renewal will use.
Supplier and partner contracts. Note renewal dates and what each expects.
What does a monthly rhythm look like?
- Week 1: check the corrective action tracker and open findings.
- Week 2: review a sample of controls against evidence, for example one access review and one change record.
- Week 3: update the inventory of sites, systems and subcontractors.
- Week 4: review incidents and near misses and update the risk view.
Quarterly, review the self-assessment scores and mark anything that has slipped. Annually, hold a management review and update the renewal plan.
How early should you plan renewal?
The handbook text we read does not say when to start. Work back from label expiry, allow time to choose or re-engage an audit provider, and ask ENX and your provider for lead times. For renewal, create a new scope (it can match the old one) with the assessment year in its name, and reuse existing location records to avoid duplicates that can disrupt synchronization with ENX.
What to do
- Put the label expiry date and a renewal start date in the calendar.
- Keep one tracker for corrective actions and one for scope changes.
- Run the monthly rhythm above and file the results as evidence.
- Keep the self-assessment up to date, not rebuilt from scratch.
- Ask your partners annually what protection needs they expect.
- Check the ISA version before the renewal self-assessment.
Quick check
How long is a TISAX label valid?
ENX states three years. After that you repeat the registration, assessment and exchange steps if you remain a supplier.
Can partners see my results?
Only partners you choose to share with through the ENX Portal. ENX says results are not publicly available.
How Safeguard helps automate this
The gap between assessments is where evidence usually decays. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, leaving your team time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. An independent audit provider carries out the next assessment. Book a call to see it.
Sources
- ENX: TISAX overview, fetched 18 October 2026
- ENX: TISAX Participant Handbook, first part read; later sections not read
Last reviewed: 18 October 2026.
