TISAX® Assessment

TISAX® (Trusted Information Security Assessment Exchange) is a process for assessing information security and exchanging the results between companies in the automotive industry. Its focus is protecting the confidentiality, integrity and availability of data throughout vehicle development, production and operation, such as design drawings, prototype data and carmakers' project information.

TISAX® was initiated by the German Association of the Automotive Industry (VDA) and is operated and governed by the ENX Association. Assessments are based on the VDA ISA catalogue (Information Security Assessment), maintained by ENX and published by the VDA, which builds on the principles of ISO/IEC 27001 and adds industry-specific requirements such as prototype protection and data protection. Assessments ordered from 1 April 2024 use VDA ISA 6; according to ENX, VDA ISA2027 applies to assessments ordered from 1 January 2027. After a successful assessment, the TISAX® label is published on the ENX platform. Many vehicle manufacturers, such as Audi, Volkswagen and BMW, require suppliers to hold the appropriate TISAX® labels.

Note that TISAX® is not a certificate in the usual sense: the result is a TISAX® assessment report and labels shared on the ENX platform, and the assessed company itself decides who may view its results.

Every company wishing to take part must register on the ENX portal. Within the TISAX® network a company can be a passive participant (the party that requests and receives assessment results, typically a carmaker) or an active participant (the party that is assessed and shares its results, typically a supplier); a company can hold both roles.

Assessment objectives (for example Confidential, Strictly confidential, High availability, Proto parts, Data) are chosen according to the protection needs of the information, and each objective corresponds to an assessment level:

• Level 1 (AL1): a self-assessment, mainly for internal purposes; results are not used in TISAX® and no label is issued.
• Level 2 (AL2): for objectives with high protection needs. The audit provider checks the plausibility of the self-assessment on the basis of evidence and interviews, usually by web conference or on site at the company's request.
• Level 3 (AL3): for objectives with very high protection needs, such as protection of prototype parts and vehicles or special data. The audit provider carries out a comprehensive assessment at the company's location(s), including interviews and inspection of relevant areas and facilities.

The scope and duration of an assessment depend on the assessment objectives, the maturity and complexity of the ISMS and the number of sites. From the closing meeting of the initial assessment, the company has a maximum of nine months to resolve non-conformities and complete the process, including the audit provider's verification of corrective actions; if this period is exceeded, a new initial assessment is required. TISAX® labels are valid for three years, after which a new assessment is required.