What should a startup do in its first 90 days for TISAX?

In the first 90 days for TISAX, a startup should confirm what its automotive customer actually requires, define a narrow assessment scope, register as a participant, run a self-assessment against the ISA catalogue, and choose an approved audit provider. The audit itself usually comes after those steps.

What is TISAX?

TISAX is an information security framework for the automotive industry. It is based on the ISA catalogue, which the ENX Association maintains and the VDA publishes. Its purpose is a shared way to assess and recognise a company's information security, so suppliers are not audited separately by each customer.

The ENX describes four steps: register as a TISAX participant and define at least one assessment scope, select an approved audit provider, complete a self-assessment followed by an external audit, and exchange the results with partners through the ENX Portal. Labels are valid for three years, and results are not public. You share them selectively.

This plan is our own planning suggestion built on that process. ENX does not prescribe a 90 day schedule, and timelines depend on your scope and auditor.

Days 1 to 30: decide what you are assessing

Ask the customer what they need. Which assessment objective applies: information security, data protection or prototype protection? ENX says the depth of assessment depends on the protection required, ranging from document reviews to detailed on-site inspections, so the customer's requirement shapes the work. Get it in writing.

Then define scope. ENX says registration covers the participant and its assessment scope, including relevant locations, processes and protection needs. A startup with one office and one product team should keep scope small and accurate. A scope you cannot defend is worse than a small one.

Name an owner. TISAX work stalls when it belongs to nobody.

Days 31 to 60: self-assess honestly

Register on the ENX portal and download the ISA catalogue. Work through it control by control with the people who run the systems. Score what you do, not what the policy says.

You will find gaps. Look closely at asset inventories, access reviews, supplier management and secure development, since these are areas where small teams often lack written records. Open a list of gaps with an owner and a date for each. This is also the time to write the policies you do not yet have, short and true.

Days 61 to 90: close gaps and choose the auditor

Fix the cheapest high-value gaps first, then agree a plan for the rest. Select an approved audit provider and ask for scope confirmation, timing and what they will want to see. Collect evidence as you go: dated records, screenshots with context, tickets and logs.

Do not rush into the audit with open critical gaps. Equally, do not wait for perfection. Auditors expect an organisation that knows its gaps.

Where can tooling help?

Some of the work is inventory: which software you run and ship, and what is vulnerable in it. Safeguard can generate software bills of materials and scan dependencies. That supports secure development evidence. It does not produce a TISAX label, and the label comes only from an assessment by an approved provider.

What to do

1. Get the customer's TISAX requirement in writing.
2. Define a small, defensible assessment scope.
3. Name one accountable owner.
4. Register as a participant on the ENX portal.
5. Self-assess against the ISA catalogue with the system owners.
6. Keep a gap list with owners and dates.
7. Close quick wins and write the missing policies.
8. Choose an approved audit provider and agree scope and timing.

Quick check

Sources

• ENX Association: TISAX

Last reviewed: 18 October 2026.