To scope TISAX, list every location and process that handles your automotive partner's information, choose assessment objectives that match their protection needs, and register one scope that covers them. Do this before registering, because a registered scope cannot be edited by you and changes can cost fees.
TISAX is run through the ENX Association, using requirements from the ISA catalogue. ENX says registration covers your participant record and at least one assessment scope, covering relevant locations, processes and protection needs. This post follows the TISAX Participant Handbook (we read its first part on 18 October 2026) and the ENX overview.
What is an assessment scope?
The handbook defines it as the part of your company that handles partner information and gets assessed. It has to sit inside your information security management system, but it can be smaller: "The scope of the assessment can be smaller than the scope of your ISMS." ENX gives each scope a Scope ID at registration. You need that ID to order an assessment, and you should share the ID, not your internal scope name, with partners.
Standard scope or custom?
ENX recommends the predefined standard scope, which every participant accepts. Custom scopes exist, but the handbook covers them in an annex we did not read. Take the standard scope unless a partner or your structure forces otherwise, and read the annex before deviating.
Which objectives and level go in the scope?
There are twelve objectives, grouped as information protection, availability, prototype protection and data protection. Your partner normally specifies them. If they do not, choose by the protection needs of the information you hold, and think about the next partner who might ask for more.
Objectives map to assessment levels. According to the handbook, Level 2 covers objectives such as high protection needs, Confidential, High availability, Test vehicles, Proto events and Data. Level 3 covers very high, Strictly confidential, Very high availability, Proto parts, Proto vehicles and Special data. Higher levels include lower ones, so a Level 3 result satisfies a Level 2 request. All locations inside one scope must share the same objectives.
How do you split locations?
Use a decision table:
- Small company, one site: One scope, one location
- Several sites, similar maturity: One scope is simpler, but one failing site fails the whole scope
- One weak site: Keep it out and add it later via a scope extension assessment, or fix it first
- Sites needing different objectives: Separate scopes
The handbook flags these pitfalls: one large scope, mixed objectives, a scope too narrow to satisfy the partner, edits after registration, and duplicate location records at renewal.
What about remote work and cloud?
The pages we read do not set separate rules for remote staff or cloud hosting. Treat both as part of your scope description if they handle partner information, and ask your audit provider how they evidence them. Do not assume they are out.
What to do
- Ask each partner in writing for objectives, level and any deadline.
- Inventory locations, teams, systems and data flows that handle their information.
- Decide the standard scope or a custom one, and write the reasoning.
- Name scopes uniquely, with the assessment year, such as Company Standard Scope 2026.
- Run a quick self-check against the ISA catalogue for each location before registering.
- Register, record the Scope ID, then select your audit provider.
Quick check
Can the TISAX scope be smaller than my ISMS?
Yes. The handbook says the assessment scope can be smaller than the scope of your information security management system, but it must lie within it.
Can I edit a scope after registering?
Not yourself. ENX can change it if you have not yet sent the scope excerpt to an audit provider, and adding locations increases the fee while removals are not refunded.
How Safeguard helps automate this
Scoping decides which systems must produce evidence, and that evidence then has to stay fresh. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation, which can open tested fix pull requests for vulnerable dependencies, is off by default with every category on Manual until you choose otherwise. An independent TISAX audit provider performs the assessment. Safeguard helps you prepare and keep evidence ready. Book a call or open the demo below.
Open the framework mapping demo
Sources
- ENX: TISAX overview, fetched 18 October 2026
- ENX: TISAX Participant Handbook, first 100,000 characters read; custom scope annex not read
Last reviewed: 18 October 2026.
