A TISAX auditor works from the ISA catalogue and your registered scope. Expect to show a self-assessment, documents, records of controls operating, and, at higher protection levels, on-site inspection. The exact evidence list depends on the labels you chose, so agree it with your audit provider early.
How does a TISAX assessment work?
The ENX Association, which runs TISAX, describes four steps. You register as a participant with at least one assessment scope. You select an approved audit provider. You undergo the assessment. Then you exchange the results with partners through the ENX portal.
The assessment starts with a self-assessment based on the ISA catalogue, followed by an external audit. ENX says that, depending on the level of protection required, the audit may range from document reviews to detailed on-site inspections. Results are issued as TISAX labels that reflect assessment objectives such as information security, data protection or prototype protection. The labels are valid for three years, and results are not public: you choose which partners see them.
What is the ISA catalogue?
It is the standard set of information and cybersecurity requirements for the automotive industry, maintained by an ENX working group and published by the VDA. It is meant to give every customer one baseline instead of separate supplier questionnaires.
The catalogue is versioned. ENX reports that the VDA published ISA2027 on 1 July 2026, and a German language version of ISA2027.1 became available on 1 October 2026. ENX also says that from 2027, assessments ordered through an audit provider within a year will be conducted against that year's ISA version. Ask your provider which version applies to your assessment date.
What does scope mean for evidence?
Scope is the first thing an auditor reads. ENX says registration defines the relevant locations, processes and protection needs. Every piece of evidence is judged against that boundary. If the scope says one site and one engineering network, the auditor will look at that, and will question anything ambiguous at its edge.
What evidence do auditors usually look for?
ENX does not publish a checklist of artifacts, so treat what follows as common audit practice and confirm it with your provider. Control assessment generally falls into three kinds of proof.
Documents: information security policy, risk assessment, asset inventory, supplier management procedure, incident process, and the classification scheme for information.
Records of operation: access reviews with dates, change tickets, vulnerability and patch records, backup and restore tests, training attendance, and incident logs. These show the control runs, not just that it was written.
Observation: walkthroughs of systems, physical areas and processes, and conversations with the people who do the work. At higher protection levels, this includes on-site inspection.
What goes wrong?
Weak scope statements are the most common trouble: unclear, too broad, or missing sites. Policies written for the audit and not followed are the next, because interviews expose them. Records that cannot be dated or traced to a person are the third.
What to do
- Write the scope: sites, processes and protection needs, with a named owner.
- Complete the self-assessment honestly against the current ISA version.
- Build an evidence index: one row per requirement, pointing to a document, a record or a person.
- Store records with dates and the system they came from.
- Choose an approved audit provider and ask for their evidence expectations in writing.
- Run a dry run: pick five requirements and have someone outside the team test your evidence.
- Plan the three year label cycle, with reminders for changes in scope.
Quick check
How long does a TISAX label last?
ENX says labels are valid for three years.
Are TISAX results public?
No. ENX says results are not publicly available. You share them with chosen partners through the ENX portal.
Sources
- ENX: TISAX overview, fetched 18 October 2026
- ENX: ISA catalogue, fetched 18 October 2026
Last reviewed: 18 October 2026.
