When an automotive customer asks you for TISAX, the request lands on engineering as a deadline, an audit and a pile of evidence. A VP of engineering should convert it into a written scope, a staffed plan and a date that accounts for registration, self-assessment and an external audit by an approved provider.
What exactly is being asked?
TISAX is the automotive industry's shared assessment, governed by the ENX Association and built on the VDA's Information Security Assessment catalogue. The customer is asking for a label, issued after assessment, that they can view through the ENX Portal. ENX says labels are valid for three years and results are visible only to partners you choose.
Get the ask in writing: which assessment objectives, which locations and which projects. The ENX description lists examples of objectives, including information security, data protection and prototype protection. A vague request leads to a rework later, so spend a week pinning it down with the customer's contact.
What does the timeline look like?
ENX gives four stages: registration with a defined scope, choosing an approved audit provider, the assessment itself, and exchange of results. The assessment starts with a self-assessment against the catalogue, followed by an external audit that can range from document review to on-site inspection depending on required protection level.
ENX does not promise durations on the page we reviewed, so ask your audit provider for lead times and add your own time for fixing gaps found in the self-assessment. Promise the customer a range only after that conversation.
Where does the engineering load fall?
Teams are usually surprised by the breadth. The catalogue spans more than software.
- Access and identity: joiner, mover and leaver processes, privileged access, authentication.
- Environments: segregation of development, test and production, handling of customer data and design files in each.
- Development and operations: change control, secure development, vulnerability handling, logging.
- Endpoints and mobile devices: management, encryption and loss procedures.
- Suppliers: which third parties handle data, and how you assess them.
- Physical: facility access and, for prototype work, much stricter site controls that engineering does not own.
Assign one owner per area and one coordinator. The coordinator tracks evidence requests, so engineers are not hit by scattered messages.
What decisions belong to you?
Staffing: who is released from roadmap work, and for how many weeks. Sequencing: do the highest-effort gaps first. Architecture: whether to segment or move sensitive projects to a controlled environment, which can shrink scope more than fixing everything. Tool choices follow evidence needs, not the other way round.
What is not yours: choosing the audit provider usually involves procurement and legal, and the statements made to the customer should be reviewed against the actual label and scope.
What are the traps?
A scope that excludes the site or project the customer cares about. Treating the label as a document exercise when auditors test practice. Letting a control lapse after the audit, then facing renewal in three years with no habit. And claiming status early: "in progress, target date" is accurate, while "certified" is not.
How to check or apply this
- Get the customer's objectives, sites and projects in writing.
- Register and draft scope with a diagram of sites and systems.
- Ask the audit provider for lead times and the likely audit style.
- Run the self-assessment and rank gaps by effort and risk.
- Staff owners per area and name a coordinator.
- Build monthly evidence refreshes into normal operations.
- Put the three year renewal in the calendar.
Quick check
How long does TISAX take?
ENX publishes the steps but not durations on its main page. Ask your audit provider and add time for fixing gaps.
Who sees our TISAX results?
Only partners you choose to share them with through the ENX Portal, per ENX.
Sources
Last reviewed: 18 October 2026.
