TISAX is a shared assessment and recognition framework for information security in the automotive supply chain. Suppliers assess themselves against the VDA ISA catalogue, an approved audit provider checks them, and the result is a label shared with partners through the ENX Portal. This glossary explains the terms you will meet.
TISAX is not a Safeguard certification and Safeguard does not issue or hold one. This is a plain reading of the program for suppliers.
The program and its parts
TISAX. Short for Trusted Information Security Assessment Exchange. ENX describes it as a shared framework for assessments and recognition across the industry.
ENX Association. The body that governs TISAX. Automotive manufacturers, suppliers and audit providers contribute to its development through expert groups and committees.
VDA ISA. The Information Security Assessment catalogue, maintained by ENX and published by the VDA. It is the list of questions and controls you assess against. ENX's page says the VDA published a new edition, ISA2027, on 1 July 2026, with a German version of ISA2027.1 available from 1 October 2026. Check which catalogue version applies to your assessment.
Audit provider. An independent organization approved to perform TISAX assessments. You choose one after registering.
Scope. The part of your organization the assessment covers, such as a site, a set of processes or a project. You define it at registration. A narrow scope is faster but may not satisfy a customer who needs a wider one.
Assessment results
Self-assessment. The first step. You rate your own controls against the ISA catalogue before an external audit.
Assessment level (AL). How deep the audit goes. Secondary sources, including a BSI webinar and SECJUR, describe AL1 as a self-assessment, AL2 as a plausibility check with an evidence review and an interview, and AL3 as a full assessment with on-site inspection. ENX's own page says audit depth may range from document reviews to detailed on-site inspections depending on the protection required, and does not define the levels, so confirm the level your customer requires.
Label. The result of the assessment, in a standard format. Each label reflects an assessment objective, such as information security, data protection or prototype protection. ENX says labels are valid for three years. Label names have changed between catalogue versions, so use the names in your current assessment.
Participant. A company registered with ENX as part of TISAX.
ENX Portal. Where you share results with chosen partners. Results are not public, which keeps control with you.
What do customers ask for?
A customer typically names the objective and the level they require in a contract. If you serve several customers, each may need a label with specific objectives, so list them before you register. A label for the wrong scope or level can force a second assessment.
Where does software supply chain work fit?
The catalogue covers topics such as asset management, change management and vulnerability handling. An inventory of software components, dated vulnerability findings and change records are artifacts an assessor may ask about. Safeguard's compliance automation can help organize that evidence. It does not grant a TISAX label.
What to do
- Ask each customer which objective and assessment level they require, and get it in writing.
- Define your scope with that in mind.
- Check the current VDA ISA catalogue version with ENX before you start.
- Run the self-assessment honestly and fix gaps before you choose an audit provider.
- Request quotes from more than one approved provider.
- Decide who in your company shares the results through the ENX Portal.
Quick check
Is TISAX a certification?
It is an assessment and label shared with partners, not a public certificate. Labels are valid for three years per ENX.
Who defines the questions?
The VDA ISA catalogue, maintained by ENX and published by the VDA.
Sources
- ENX: TISAX
- Secondary descriptions of assessment levels came from search results citing a BSI webinar and SECJUR; confirm with ENX before relying on them.
Last reviewed: 18 October 2026.
