TISAX assessments are built on the VDA ISA catalogue, so the documents you need are the ones that let an audit provider confirm each control: a scope statement, a completed self-assessment, core policies, registers for assets, suppliers and risks, and dated evidence that people follow them. Write documents to match your real practice, not an ideal.
What does TISAX actually assess?
According to ENX, which runs the scheme, TISAX is a shared assessment and exchange mechanism for information security in the automotive supply chain. It rests on the ISA catalogue maintained by ENX and published by the VDA. You register as a participant, register at least one assessment scope, complete a self-assessment against the catalogue, then pick an approved audit provider for the external audit. Results are issued as labels that reflect the objective, such as information security, data protection or prototype protection, and a label is valid for three years. Results are shared through the ENX portal with partners you choose.
Assessment depth varies. Secondary sources, such as audit provider service descriptions, describe level 2 as a plausibility check of the self-assessment plus an interview, and level 3 as a full check with on site interviews. Confirm the level your customer requires before you start, because that sets the size of the evidence pile.
Which documents come first?
Start with the scope statement. It names locations, processes, systems and the protection need, and every later document points back to it. Then write the information security policy that top management approves, with roles and responsibilities. The audit provider will ask who approved it and when.
Which policies does the ISA catalogue expect?
The ISA groups controls across areas that include policy and organization, personnel, physical security and continuity, identity and access, IT and cyber security, supplier relationships and compliance. Plan a short document for each topic and check the final list against the current catalogue version, because the ENX page names the version in force and it changes.
- Information security policy and organization chart
- Risk assessment method and a risk register
- Asset inventory with classification rules and handling instructions
- Access control policy, joiner mover leaver steps and an access review record
- Cryptography and key handling rules
- Operations security, logging and vulnerability handling rules
- Change management and secure development rules, if you build software
- Supplier management policy with a supplier list and the requirements you pass to them
- Incident management procedure with contacts and an exercise record
- Business continuity and recovery plans with test results
- Physical security rules for sites, including prototype areas if you handle them
- Personnel screening, training and confidentiality commitments
- Data protection documents if the label covers it
What evidence matters more than the policy?
Auditors test whether practice matches paper. Gather samples: a recent joiner and leaver ticket, an access review with sign off, a patch report, an incident exercise record, a supplier review, training attendance. Date and name each one. A policy with no sample behind it counts for little.
How should you organize it for the audit provider?
Map your own folders to the ISA control numbers in a single index sheet: control, answer, owner, document link, evidence link, gap. Keep it as the one live version, because the self-assessment you submit and the files you show should agree line by line.
Where do first timers stumble?
Scope that is too wide, policies copied from a template, and self-assessment scores set higher than reality. An honest gap with a dated action plan serves you better than an unsupported yes.
What to do
- Confirm your customer's required assessment level and label.
- Register as an ENX participant and define the scope.
- Complete the ISA self-assessment honestly, noting gaps.
- Write and approve the information security policy with top management.
- Draft the supporting policies from the list above, trimmed to your size.
- Build the asset, risk and supplier registers.
- Collect dated samples for every control you claim.
- Build the index sheet and review it against the catalogue version in force.
- Pick an approved audit provider and agree the timeline.
Quick check
How long is a TISAX label valid?
Three years, according to ENX.
Is TISAX a certificate issued by ENX?
No. Approved audit providers perform the assessment, and ENX hosts the exchange of results.
How Safeguard helps automate this
The evidence index is the heavy part of any TISAX preparation. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code rather than by screenshot, and monitoring runs between assessments so your team gains time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability, which supports the supplier and vulnerability handling questions. The agent can open tested fix pull requests, off by default, with every category on Manual until you change it. Safeguard helps prepare and keep evidence ready; an independent audit provider performs the assessment. Book a call.
Open the framework mapping demo
Sources
- ENX, TISAX overview
- Audit provider service descriptions (for assessment level wording), for example TUV NORD TISAX service description
Last reviewed: 18 October 2026.
