TISAX is the automotive industry's shared information security assessment. A company is assessed once against the VDA ISA catalogue by an approved audit provider, and the result is shared with partners through the ENX Portal. A CTO's main decisions are the scope, the assessment objectives, and which sites and systems the audit will touch.
What is TISAX, in practice?
According to the ENX Association, which governs it, TISAX was created to give the automotive industry a standardized and scalable approach to information security, replacing individual supplier audits that were inefficient and gave inconsistent results. It protects design data, production information, customer information, prototypes and intellectual property, and it helps make supply chains more resilient.
The requirements come from the Information Security Assessment (ISA) catalogue, maintained by ENX and published by the VDA. ENX's site says the VDA published ISA2027 on 1 July 2026, and a German version became available on 1 October 2026. Confirm which ISA version your assessment will use before you start.
How does the process run?
ENX describes four steps. Registration: you register as a participant and define at least one assessment scope, including relevant locations, processes and protection needs. Selection: you choose an approved audit provider. Assessment: it begins with a self-assessment against the ISA catalogue, followed by an external audit, ranging from document review to detailed on-site inspection depending on the protection level required. Exchange: you share results with chosen partners through the ENX Portal.
Results are issued as TISAX labels that reflect the assessment objectives, such as information security, data protection or prototype protection. ENX states the labels are valid for three years, and that results are not public: you control who sees them.
Where does the CTO decide?
Scope. Which sites, which processes and which systems. Your customers will tell you the scope they expect, usually driven by the data they send you. A smaller scope is faster, but a customer can reject a label that does not cover the location or project involved.
Objectives. Different labels cover different things. Choose them from customer requests: a supplier handling pre-release vehicle designs needs different coverage from one handling only business contact data.
Technical foundation. The self-assessment will probe areas you control: identity and access, network and cloud architecture, endpoint management, logging, secure development, supplier management and physical protection of sites. Prototype protection adds physical and environmental measures that engineering does not own, so involve facilities early.
Evidence. Decide where it lives and who refreshes it, because the audit is of operating practice, not only documents.
What is the relationship to ISO 27001?
ENX says the ISA is aligned with other big standards, which helps if you already have a management system. It does not mean an ISO 27001 certificate substitutes for a TISAX label. They are separate assessments with different recipients.
What should you avoid?
Do not tell a customer you are "TISAX certified" without stating the label, scope and date. Do not assume a label held by a parent company covers your site. Do not wait for the label before engaging with the customer, since the process takes time and can be planned jointly.
How to check or apply this
- Ask each automotive customer which assessment objectives and scope they expect.
- Register on the ENX Portal and define scope with sites and processes.
- Pick an approved audit provider and agree timing.
- Run the self-assessment against the current ISA version and list gaps.
- Fix gaps in access, logging, endpoints and supplier controls.
- After the audit, share results only with named partners through the portal.
- Diarise renewal ahead of the three year label expiry.
Quick check
Is TISAX a certificate from the VDA?
No. The VDA publishes the ISA catalogue. ENX governs TISAX, approved audit providers assess, and results are issued as labels.
Are TISAX results public?
No. ENX says results are not publicly available. You share them with chosen partners through the ENX Portal.
Sources
Last reviewed: 18 October 2026.
