The most common TISAX mistakes are registering the wrong scope, picking an assessment objective or level before asking your automotive partner, treating the self-assessment as paperwork, and writing policies with no evidence behind them. Fix scope and objectives first, then build evidence against the ISA catalogue.
TISAX is the automotive information security assessment run through the ENX Association, using the ISA catalogue that the VDA publishes. This guide is about the errors, so you can skip them. Everything below comes from ENX pages we fetched on 18 October 2026, and the full detail lives in the TISAX Participant Handbook.
Mistake 1: Registering a scope you cannot change later
The scope names the locations, processes and protection needs that get assessed. The handbook warns that you cannot edit a registered scope yourself. ENX can change it only if you have not yet sent the scope excerpt to an audit provider, adding locations raises the fee, and removing them is not refunded.
Two scope shapes cause trouble. One giant scope means that if a single location fails, the whole scope fails. A scope that is too narrow, with a site that handles partner information left out, may not satisfy your partner at all. The handbook describes removing a failing site, fixing it and adding it back through a scope extension assessment, which works but costs a second round.
Mistake 2: Choosing objectives without asking the partner
There are twelve assessment objectives, covering information protection, availability, prototype protection and data protection. Your partner usually names the objectives. If they do not, you choose based on the protection needs of what you handle, and the handbook advises thinking about future partners with stricter needs. All locations inside one scope must share the same objectives, so a wrong choice affects every site.
Mistake 3: Misreading the assessment levels
Per the handbook, Assessment Level 1 only checks that a self-assessment exists and TISAX does not accept those results. Level 2 checks the plausibility of your self-assessment, reviews evidence and interviews your information security lead, usually by web conference. Level 3 is a comprehensive on-site verification. Higher levels include lower ones.
If a remote method replaces an on-site Level 3, the handbook says it is recorded as a minor non-conformity that needs a follow-up assessment. Do not plan on remote as a shortcut.
Mistake 4: A self-assessment written to look good
You score yourself against the ISA catalogue before the external audit. Inflated scores do not survive an auditor who asks to see the evidence behind each answer. Score what you can show today, then close the gaps.
Mistake 5: Policies with nothing behind them
A policy that says access is reviewed quarterly needs a dated review record. Auditors test whether the control exists and works, so keep the artifacts: access lists, tickets, change records, training logs, supplier assessments.
Mistake 6: Ignoring which catalogue version applies
The ENX page states that the VDA has published ISA2027, with a German version of ISA2027.1 available from 1 October 2026. Ask your audit provider which catalogue version your assessment will use before you build the self-assessment.
What to do
- Ask your partner in writing which assessment objectives and level they expect.
- List every site and process that touches their information, then decide scope with the whole list in front of you.
- Prefer the predefined standard scope that ENX recommends unless you have a reason not to.
- Pick an approved audit provider early and ask about the catalogue version.
- Score the self-assessment honestly and attach an evidence link to every answer.
- Reuse existing location records at renewal, and put the assessment year in scope names.
Quick check
How long is a TISAX label valid?
ENX states that labels are valid for three years. When you renew, you repeat the process with a new scope, which can match the old one.
Does TISAX accept an Assessment Level 1 result?
No. The handbook says Level 1 only confirms a self-assessment exists and that TISAX does not accept those results.
How Safeguard helps automate this
The slow part of TISAX for a software or engineering supplier is proving controls with evidence rather than describing them. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between audits. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. An independent audit provider still performs the assessment. Safeguard helps you prepare and keep evidence ready. Book a call to see it.
Sources
- ENX: TISAX overview, fetched 18 October 2026
- ENX: TISAX Participant Handbook, first part fetched 18 October 2026; later sections not read
Last reviewed: 18 October 2026.
