TISAX is a shared information security assessment for the automotive industry. If a carmaker or tier-one supplier asks you for a TISAX label, you register on the ENX portal, choose an audit provider, complete an assessment based on the VDA ISA catalogue, and share the result with partners. Founders should ask early which label the customer needs.
What is TISAX?
According to ENX, TISAX gives the automotive supply chain a standardized, scalable approach to information security. It is based on the Information Security Assessment (ISA) catalogue, maintained by the ENX Association and published by the VDA. The idea is to replace many inconsistent supplier audits with one assessment that many partners recognize.
ENX reports that the VDA published the new VDA ISA2027 on 1 July 2026 and that a German-language version of ISA2027.1 became available on 1 October 2026. Confirm with your audit provider which catalogue version applies to an assessment you start now.
What are the steps?
ENX lists four stages. Registration: you register as a participant with at least one assessment scope. Selection: you choose an approved audit provider. Assessment: it starts with a self-assessment against the ISA catalogue and is followed by an external audit, which depending on the protection level can range from document review to detailed on-site inspection. Exchange: you share the results with chosen partners through the ENX portal.
Results are not public. You control who sees them.
What is a label and how long does it last?
Results are issued as TISAX labels that reflect specific assessment objectives such as information security, data protection or prototype protection. ENX states that labels are valid for three years. Different customers request different labels, and the protection level depends on the data you handle, so ask which one the contract needs.
What does this mean for a small company?
A constructed example: a six-person engineering software startup lands a pilot with a car manufacturer's supplier. The supplier writes "TISAX required before data access". The founder's first moves are to ask which assessment objective and level apply, define a tight scope covering only the team and systems that will touch the customer's data, and book an audit provider early, since audit capacity can be a bottleneck.
Scope is the main cost control. Include only the locations and processes you need.
What delays founders most?
Usually it is waiting, not work. Audit providers have schedules, and the ENX registration and scoping steps come first. A founder who learns of the requirement the week before data access is promised will miss the date. Ask during early sales conversations whether TISAX will be needed, and start registration as soon as the answer is yes.
The second delay is a scope that is too broad. Naming the whole company when only one team touches the customer's data multiplies the evidence you must produce. Define the scope narrowly, document why, and make sure the customer accepts that scope. Some customers accept a small scope, others will not, so confirm before you commit.
How to check or apply this
- Ask the customer which TISAX assessment objective and protection level they need.
- Check which ISA catalogue version applies to your assessment.
- Define a narrow scope: locations, teams, systems.
- Run the ISA self-assessment and close gaps before the audit.
- Register on the ENX portal and select an approved audit provider.
- Plan evidence: policies, access control, incident handling, supplier management.
- Share results only with the partners who need them, and calendar the three-year renewal.
Safeguard's compliance automation and dependency inventory can help organize evidence for supplier and vulnerability management topics. The label is only issued after an audit.
Quick check
Is TISAX a certificate?
It is an assessment result expressed as a label, issued after an audit by an approved provider and shared through the ENX portal.
How long is a TISAX label valid?
ENX states three years.
Sources
Last reviewed: 18 October 2026.
