TISAX cost and timeline are driven by your assessment scope, the protection level your customers require, and how ready your controls and evidence are. The ENX Association publishes no price list, so the reliable way to budget is to define scope first and request quotes from approved audit providers.
What is TISAX?
TISAX is a shared assessment and exchange framework for information security in the automotive industry. It is based on the ISA catalogue, which ENX maintains and the VDA publishes. The idea is that one trusted assessment replaces many separate supplier audits. Results are shared with partners through the ENX Portal and are not public.
This post explains the framework. It is not a statement that any product certifies you. TISAX labels come from an audit by an approved provider.
What are the four steps?
ENX describes the path in four steps.
- Registration. You register as a participant and define at least one assessment scope: locations, processes and protection needs.
- Selection. You pick an approved audit provider.
- Assessment. You complete a self-assessment against the ISA catalogue, then an external audit follows.
- Exchange. You share the result with partners through the portal.
A label is valid for three years.
What actually moves cost and time?
ENX itself names two factors: the assessment scope and the required protection level. Audit depth ranges from document review to detailed on-site inspection depending on the protection needed, and the label reflects the objective, such as information security, data protection or prototype protection.
From that, a few practical drivers follow. These are reasoning from the process, not published figures.
Scope size. Each location and process in scope adds interviews, evidence and travel. A narrow scope that still satisfies your customer is cheaper than a broad one.
Assessment level. Your customer sets the objective and level. Higher levels bring more evidence and on-site work. BSI describes the lower of the two common levels as a plausibility check of your self-assessment with evidence review and an expert interview, and the higher as including an on-site inspection. Sources disagree on whether the lower level is done remotely or on site, so confirm with your customer and provider.
Readiness. Gaps found during the audit mean rework and a follow-up. Consultancy blogs give fixed price ranges and failure rates, but those are not official, and this post does not repeat them.
Prototype protection. If prototype handling is in scope, expect physical security checks as well as document review.
Internal time. Staff hours spent on the self-assessment and evidence collection often exceed the audit fee, and they are easy to leave out of a budget.
What to do
- Ask your automotive customer which assessment objective and level they require, in writing.
- Draft the narrowest scope that satisfies that request.
- Run the ISA catalogue self-assessment internally and list gaps before registering.
- Register, then request quotes from at least two approved providers using the same scope.
- Ask each provider what is included, how they treat findings, and how re-checks are billed.
- Collect evidence once, in a form that can be reused for related frameworks such as ISO 27001.
- Plan the label renewal, since validity is three years.
Quick check
How much does TISAX cost?
ENX does not publish prices or timelines. They depend on scope, protection level and the provider, so get quotes against a defined scope.
How long is a TISAX label valid?
Three years, according to ENX.
Who decides which assessment level I need?
Your customer, who sets the assessment objectives, which in turn determine the level.
Sources
Last reviewed: 18 October 2026.
