To get through a TISAX assessment, define a tight scope at registration, complete the VDA ISA self assessment honestly, keep dated evidence for every control you rate, and rehearse the interviews and site walk the audit provider will run. The result is a label that is valid for three years.
How does TISAX work?
TISAX is the automotive industry's shared assessment and exchange system, governed by the ENX Association. Instead of each carmaker auditing every supplier, you are assessed once and share the result with partners. According to the ENX page we fetched on 18 October 2026, the steps are: register as a participant and define at least one assessment scope; choose an approved audit provider; complete a self assessment based on the ISA catalogue, followed by an external audit; and exchange the results through the ENX portal. Results are not public.
The requirements come from the Information Security Assessment, a catalogue published by the VDA. The ENX page notes that VDA has released ISA2027 with a German version. Confirm with your audit provider which catalogue version applies to your assessment.
What decides how deep the audit goes?
The page says assessment depth depends on the required protection level, from document reviews to on site inspections. Labels reflect the assessment objective, for example information security, data protection or prototype protection. Ask your customers which objective and level they need before you register, because registering for more than needed costs time and registering for less costs a re-assessment.
How should evidence be organised?
Think of three layers per ISA question.
The statement. One paragraph on how you meet the requirement, written for a reader who has never seen your company.
The documents. The policy, procedure or standard that defines the control, with version and approval date.
The records. Proof the control operates: tickets, logs, export files, training lists, access review sign offs. Records should be dated, and recent enough to represent today.
Keep one folder per ISA control with those three items, and a short index file that lists them. The auditor will jump around the catalogue, and a good index saves hours.
What happens on the day?
Expect interviews with the people who run the processes, not only with the security lead. Developers get asked how code reaches production. Facilities staff get asked about visitors. HR gets asked about screening. Where the protection level requires it, the provider walks the site and looks at access, clear desk habits and storage of sensitive materials.
Answers must match documents. A manager who describes a process that differs from the written procedure causes a finding even if the practice is good. Brief interviewees a week before, and have them read the procedures they own.
What if you get findings?
Findings are normal. Handle them as a plan: for each one write the cause, the fix, the owner and the date, and send evidence when it is done. Ask the provider in advance how nonconformities are classified and how long you have to close them, since that depends on the assessment rules and your provider.
Mistakes to avoid
- Scope that covers a site or process you did not mean to include, or leaves out the one the customer cares about.
- Rating yourself high on every question. A self assessment that does not match the audit damages trust.
- Evidence from a different environment than the one in scope.
- Interviewees who have never read the procedures.
What to do
- Ask each customer which assessment objective and protection level they require.
- Register as a participant and define scope by site, process and system.
- Choose an approved audit provider and ask for their schedule and evidence format.
- Fill in the ISA self assessment with notes and links to evidence for each answer.
- Build the evidence folders and the index.
- Run a mock audit with someone from outside the team.
- Brief interviewees and fix gaps found in the mock.
- After the audit, track findings to closure and calendar the three year renewal.
Quick check
How long is a TISAX label valid?
Three years, according to the ENX page we fetched. Plan renewal well before it ends.
Who does the audit?
An independent audit provider approved in the TISAX system, which you select after registration. ENX governs the scheme.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, which suits a catalogue where each question needs a fresh record. Evidence is collected from connected systems and code instead of screenshots, and monitoring runs between audits so records stay recent. Technical evidence, such as scans and SBOMs, comes from your real code and dependencies, which supports the questions on software and development. Safeguard helps you prepare and keep evidence ready. The audit is done by an independent provider, and Safeguard does not grant labels. See the framework mapping demo.
Sources
- ENX Association, TISAX, fetched 18 October 2026. The page did not describe assessment levels AL1 to AL3 or a TISAX ID, so they are not covered here.
Last reviewed: 18 October 2026.
