TISAX is the automotive industry's shared way to assess and recognize information security. If you are the first security hire and a customer has asked for it, start with scope: which sites and processes handle partner data. Then register, self-assess against the ISA catalogue, and pick an audit provider.
What is TISAX, in one paragraph?
TISAX, run by the ENX Association, gives automotive manufacturers and suppliers one assessment that many partners accept. It rests on the Information Security Assessment, or ISA, a catalogue maintained by ENX and published by the VDA. Assessments are done by audit providers that ENX approves, and results are shared through the ENX Portal. ENX says results are not public, so you control who sees yours.
Why does scope come first?
Because everything else depends on it. ENX describes the assessment scope as every part of your company that handles classified information from automotive business partners. A result only satisfies a partner if the scope covers all the parts that handle their information. A scope that is too narrow wastes the audit. One that is too wide raises cost.
ENX also lists the registration details you need: participant name and contact, plus for each scope a name, type, assessment objectives, locations and a scope contact. Several locations can share one scope if they share the same objectives. A single scope gives one report and one expiry date, but the result depends on every location passing.
What happens after registration?
ENX sends a registry excerpt and a list of audit provider contacts, and you can ask all of them for a bid. The assessment begins with a self-assessment against the ISA catalogue, followed by an external audit. The depth varies with the protection level required, from document review to on-site inspection. Labels are valid for three years.
The ISA catalogue has a new edition. The VDA published ISA2027 in July 2026, and ENX lists a German version from 1 October 2026. Ask your customer and your audit provider which version applies to your assessment.
A constructed first week
Day one, ask the account team which customer asked, what label they named, and which data types they send you. Day two, list the sites, teams and tools that touch that data. Day three, draft the scope description in plain words and have the data owners correct it. Day four, download the ISA catalogue and read how its questions are laid out. Day five, register the participant and scope, and note the audit provider contacts.
You will probably find that the hardest part is not a missing control. It is learning that nobody can say where partner drawings or specifications are stored.
What to do
- Get the customer's TISAX requirement in writing, including labels and the catalogue version.
- Map where partner data enters, rests and leaves, and name an owner for each system.
- Write the scope statement and test it against that map.
- Register as a participant and register the scope with its locations and objectives.
- Run the self-assessment on the ISA catalogue and record each gap with owner and date.
- Request quotes from several approved audit providers using the same scope text.
- Decide how you will keep evidence current for the three year label.
Quick check
Who approves TISAX audit providers?
The ENX Association approves them, and its TISAX Committee takes part in approval decisions, according to ENX.
How long is a TISAX label valid?
ENX states three years.
Sources
Last reviewed: 18 October 2026.
