TISAX evidence you can automate and what still needs a human

Automate evidence that systems already produce: scan results, access lists, patch records, configuration states. Keep humans for judgment: risk decisions, policy approval, physical security and supplier discussions. TISAX assessors check your self assessment against proof, so a mix of both is normal.

What is TISAX, briefly?

TISAX is a shared assessment and exchange framework for information security in the automotive industry. The ENX Association governs it. It rests on the VDA ISA catalogue, and results are issued as labels that match an assessment objective such as information security, data protection or prototype protection. Labels are valid for three years and are shared with partners through the ENX Portal. The ENX page notes that ISA2027 has been released.

You register as a participant, define scope, choose an approved audit provider, complete a self assessment and then undergo an external audit. Assessment depth depends on the protection need, from document review to on site inspection.

Which evidence can be collected automatically?

Look for anything a system already records.

• Vulnerability and dependency state. Scan reports and SBOMs per release, with dates.
• Access. Exports of user lists and group membership from identity systems, with review dates.
• Patch and configuration state. Device and server inventories, patch levels, encryption flags.
• Change records. Pull request history, approvals, pipeline logs.
• Backups. Job logs and restore test results.

Automated collection gives you dated, repeatable proof, and it avoids the scramble before an audit.

What stays manual?

• Scope definition and protection need decisions
• Policies, which need a named approver
• Risk assessments and the reasoning behind accepted risks
• Physical controls such as site access and prototype handling
• Supplier management conversations and contracts
• Training attendance and awareness exercises

An assessor will want to talk to the people who own these. A dashboard cannot answer for them.

How do you keep automated evidence credible?

Three habits matter. Timestamp everything. Store evidence somewhere that preserves history so it cannot be silently replaced. Tie each piece to a specific ISA control question, so the assessor does not need to search.

Tools can assist the mapping. Safeguard's compliance automation maps technical findings to control language, but it does not issue labels or replace an audit provider, and the assessment is performed by an approved provider.

A worked example

Take a control about handling vulnerabilities in software. The system evidence is a dated scan report for each release and the tickets that closed the findings. The human evidence is the vulnerability management policy, signed by a named approver, and a note on how you decide which findings to accept. The assessor will read the first to see that the process runs and the second to see that someone owns it.

Now take a control about physical access to a prototype area. No export will help. You need a documented procedure, a visitor log and a person who can walk the assessor through it. Most of the catalogue sits somewhere between these two, so sorting questions early saves time.

Plan for questions that start with "show me." Evidence you can pull in under a minute builds trust, and evidence that takes a week of searching raises doubt.

What to do

1. Confirm your scope and protection need before collecting anything.
2. Take the ISA catalogue questions and mark each as system evidence, human evidence or both.
3. Set up automatic exports for the system evidence on a schedule.
4. Give every manual item a named owner and a due date.
5. Store evidence with timestamps in one location.
6. Run a dry review a month before the audit and fill gaps.
7. Re-run the collection between audits so the three year label does not lead to three years of drift.

Quick check

Sources

• ENX Association: TISAX

Last reviewed: 18 October 2026.