A TISAX assessment tests your information security against the VDA ISA catalogue, so engineers should prepare evidence in the technical areas it covers: access control, cryptography, logging, patching and vulnerability handling, backups, secure development and supplier access. Check each point against the current catalogue, which I could not read in full.
What does the assessment really test?
ENX describes TISAX as a shared assessment mechanism for the automotive industry, built on the Information Security Assessment (ISA) catalogue, which is maintained by ENX and published by the VDA. Per ENX, the process starts with registration and a scope, moves to a self assessment on the ISA, then an external audit by an approved audit provider. The result is shown as TISAX labels, which ENX says are valid for three years, and are shared through the ENX portal. ENX's news banner says the VDA published ISA2027, so confirm which version your assessment uses.
The catalogue text is distributed by the VDA, and I did not read it. The checklist below is therefore a general set of technical areas that information security assessments of this kind commonly test, not a quote of control numbers. Ask your audit provider for the version and the assessment objective, because the objective sets the level of scrutiny.
Which technical areas should you prepare?
Identity and access. Single sign on and multi-factor authentication for staff and admins. Role based access with approvals. Quarterly or similar reviews, leaver removal within a stated time, and separate privileged accounts. Evidence: configuration exports, access review records, leaver tickets.
Cryptography. Encryption in transit and at rest for the data in scope, a key management practice, and a list of where keys live and who can use them. Evidence: configuration settings, a short cryptography standard.
Logging and monitoring. Central logs for authentication, admin actions and security events, protected from change, retained for a set period, with alerts that someone reads. Evidence: log source list, retention settings, sample alerts and responses.
Vulnerability and patch management. Inventory of assets and software, regular scans, timelines by severity, and proof of fixes. Include dependency scanning for your own code. Evidence: scan reports, tickets, patch status.
Secure development and change. Code review, protected main branches, separation between development and production, tested releases. Evidence: repository settings, pull request samples, release records.
Backup and recovery. Backups of in scope systems, restore tests, and protected copies. Evidence: job logs and restore test records.
Network and endpoint. Segmentation of the in scope environment, firewall rules reviewed, managed devices with disk encryption and screen lock, remote wipe. Evidence: device management exports.
Supplier and partner access. A list of third parties with access to the in scope environment, contract terms and access limits. Evidence: supplier register, access lists.
Data handling for prototypes and customer data. If your assessment includes prototype protection or data protection labels, add controls for the physical and handling rules they mention. These belong to the assessment objective you chose.
How should you collect evidence?
Per area, one folder with a short description, owner, frequency and the latest dated proof. Auditors may choose document review, interviews or on site checks depending on the protection level. ENX says results can come as temporary labels if you have only minor non conformities and submit a corrective action plan, so keep an issues log with owners and dates.
What to do
- Confirm the ISA version and your assessment objectives with the audit provider.
- Define the technical scope: systems, networks, sites.
- Run the self assessment honestly and log gaps.
- Fix access, logging, patching and backup gaps first.
- Export configurations and keep dated proof for each area.
- List suppliers with access and check their terms.
- Rehearse an interview with each control owner.
Quick check
How long are TISAX labels valid?
ENX says three years.
Can I get a label with a few minor gaps?
ENX describes temporary labels for a result of minor non conformity, on condition of a corrective action plan assessment and a follow up. Confirm the rules with your audit provider.
How Safeguard helps automate this
The technical areas above are mostly recurring checks. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between assessments. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, which covers the vulnerability and secure development areas, and helps with supplier software questions from automotive customers. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically. The assessment is done by an approved audit provider.
Try the framework mapping demo full screen.
Sources
- ENX Association, TISAX
- ENX Association, TISAX FAQs
- ENX Association, Information Security Assessment (ISA)
Last reviewed: 18 October 2026.
