For a DevOps lead, TISAX means an external audit provider will compare the ISA catalogue to your real systems inside a registered scope. Expect to show who has access, how changes are approved, where data lives and how you recover. Prepare evidence you can export by location, not screenshots from memory.
What will an assessor actually see?
The process, as ENX describes it, begins with a self-assessment on the ISA catalogue and continues with an external audit by an approved provider. Depending on the protection level, the audit ranges from document review to on-site inspection. Your pipelines, cloud accounts and ticketing system are part of that picture if they handle partner information.
The catalogue is described by ENX as aligned with other big standards, so controls you built for other frameworks often map across. Do not assume a full match. Read the catalogue text and mark each question as met, partly met or open.
Which systems fall into scope?
ENX defines scope by what handles classified information of automotive partners. For DevOps that usually includes more than production. A staging database refreshed from real exports, a build cache holding drawings, a shared drive used by support: each belongs on the list if partner data lands there.
Scope also follows locations. ENX notes a scope can include many sites that share objectives, and that the result depends on all locations passing. If one office has unmanaged laptops, the whole result can be at risk.
A constructed example
A supplier of embedded software keeps customer specifications in a repository, mirrors them to a build server, and archives builds to object storage. The assessor asks for the list of people who can read the repository. The list from the source host is current, but the build server uses a shared service account nobody reviewed, and the archive bucket allows broad internal read access. Neither is exotic. Both are the kind of gap a self-assessment catches if someone traces the data path first.
What does the new catalogue edition change?
The VDA published ISA2027 in July 2026, per ENX. Confirm with your audit provider which edition your assessment will use, and read ENX's redline document for differences before you plan work. Do not trust a blog summary, including this one, over that redline.
What to do
- Get the final scope statement and list every system, account and vendor that handles partner data in it.
- Export access lists per system and review them, removing shared or orphaned accounts.
- Show change control: pull request reviews, deployment approvals and emergency change records.
- Document backup and restore, and run a restore test you can date.
- Keep an asset inventory tied to locations, including laptops and build machines.
- Check that logs for access and admin actions exist, are protected and are retained.
- Track open gaps from the self-assessment with owners and due dates before the audit starts.
Safeguard can add a dependency inventory and flag vulnerable components in repositories inside your scope. TISAX itself is an ENX assessment run by approved providers.
Quick check
Does a staging environment count for scope?
It does if it handles classified information from automotive partners, since ENX defines scope by what handles that information.
Can one failing site affect the result?
Yes, for a single multi location scope ENX says the result depends on all locations passing.
Sources
Last reviewed: 18 October 2026.
