TISAX, Trusted Information Security Assessment Exchange, is the automotive industry's shared way to prove information security. Suppliers and service providers in the car supply chain are assessed against the VDA ISA catalogue by an audit provider, receive a label and share it with partners through the ENX portal. Labels are valid for three years.
Safeguard does not hold a TISAX label. This is an explainer for suppliers and their security teams.
What is TISAX and who runs it?
ENX Association governs TISAX with manufacturers, suppliers and audit providers through expert groups and committees. It provides the labels and runs the ENX Portal where participants share results with chosen partners. The ISA catalogue is maintained by ENX and published by the VDA, the German association of the automotive industry.
Results are not public. You share your label with the partners you choose, and a partner sees it through the portal.
Who needs it?
Companies in the automotive supply chain. In practice the requirement comes from a customer: a manufacturer or a larger supplier asks you to hold a label before they send you sensitive information or prototypes. ENX describes the ISA catalogue as used both internally by companies and by suppliers and service providers when they are assessed.
If you are a software or service provider to the sector, expect the same question during procurement, particularly if you handle design data or run systems connected to a manufacturer.
How does an assessment run?
The steps ENX lists are registration, selection of an audit provider, a self-assessment based on the ISA catalogue, and then an external audit. Depending on the protection level you need, the audit ranges from reviews of documents to detailed on-site inspections.
Results are issued as labels that reflect the assessment objective: information security, data protection or prototype protection.
What is new with ISA2027?
ENX states that the VDA released ISA2027 on 1 July 2026, and that a German version, ISA2027.1, became available on 1 October 2026. If your label is near renewal, ask your audit provider which catalogue version applies to your assessment and when the older one stops being used. We did not find a transition date on the ENX page, so confirm it directly.
What does a label tell a customer?
It tells them that an audit provider checked your information security management system against the ISA catalogue for a stated objective, at a stated depth. It does not tell them how you perform day to day, so many customers still ask follow up questions about specific systems and sites. Treat the label as the start of a conversation about risk, and keep the scope of the label clear so nobody assumes it covers a site or service that was left out of the assessment.
Where do software dependencies come in?
Information security assessments look at how you manage assets, change and vulnerabilities. For a software supplier, a current inventory of third party components and a record of how fast you fix serious vulnerabilities make the self-assessment easier to answer honestly. TISAX does not name a tool for it.
What to do
- Ask your customer which assessment objective and protection level they require.
- Register with ENX and choose an accredited audit provider.
- Complete the self-assessment against the current ISA version and fix gaps first.
- Decide the scope: sites, services and systems the label should cover.
- Share the label with partners through the portal when issued.
- Set a reminder well before the three year expiry and check the ISA version in force.
Quick check
How long is a TISAX label valid?
ENX states that labels are valid for three years.
Can a customer see my results without my consent?
ENX says results are not publicly available and participants share them with selected partners through the ENX Portal.
Sources
Last reviewed: 18 October 2026.
