TISAX: the automotive security label, assessment levels and process

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's information security label, often called “TISAX certification”: a supplier is assessed once against a shared catalogue, then shares the results with all its carmaker customers. If you work for a carmaker or a tier-one supplier and they entrust you with drawings, prototypes or data, they are likely to ask for it. Here is how TISAX works, from registration to labels, and what it borrows from ISO 27001.

TISAX stands for Trusted Information Security Assessment Exchange. The idea is simple: rather than each carmaker auditing each supplier with its own questionnaire, the supplier takes one assessment recognised by all, then shares the result.

The scheme is run by the ENX Association, a non-profit founded in 2000 by carmakers, suppliers and national automotive associations. The first participants registered on 28 June 2016. Ten years on, ENX says more than 21,000 locations have been assessed and more than 5,000 users from over ten vehicle manufacturers rely on the results (July 2026 announcement).

Three points to keep in mind from the outset, all from the participant handbook:

• TISAX issues no certificate. It awards labels, shared through the ENX platform with the partners of your choice.
• No law requires it. The customer requires it by contract and specifies the labels expected.
• The assessment covers locations, under a predefined standard scope, not the whole company.

Requirements come from the VDA ISA (Information Security Assessment) catalogue, published by the VDA, the German automotive industry association. Since 2019, an ENX working group has written and maintained it. The catalogue builds on ISO 27001 principles adapted to the sector, and adds automotive-specific modules such as prototype protection.

For each question, the company rates its maturity on a 0 to 5 scale. The target is usually 3, meaning an established process that is applied. The handbook notes that a shortfall on one question cannot be offset by a better score on another.

Current assessments are based on version 6 of the catalogue (ISA 6). On 1 July 2026, ENX announced its successor, ISA2027, which introduces naming by the year it becomes mandatory. According to ENX, it becomes the default catalogue for assessments contracted from 1 January 2027, with ISA 6 still possible for assessments contracted earlier or with an initial assessment before 1 April 2027. It updates the mappings to ISO/IEC 27001:2022 and the NIST Cybersecurity Framework 2.0, and thoroughly overhauls the prototype protection module.

Before the assessment, the supplier picks its assessment objectives, according to what its customers require. Each corresponds to a label and an assessment level. They fall into three families:

The assessment level (AL) follows from the objectives chosen. The participant handbook describes them as follows:

• AL1: a plain self-assessment. Its confidence level is considered too low: it is not used in TISAX.
• AL2: the audit provider checks the plausibility of your self-assessment for all locations in scope, based on evidence and an interview with the person in charge of information security. The interview is usually held by video conference; an on-site visit only happens at your request.
• AL3: the provider carries out a comprehensive verification of compliance, with in-person interviews and an on-site inspection.

A practical point often missed: an AL2 assessment cannot be used as a basis to move up to AL3 later, because the auditor did not verify everything. Moving up means a new initial assessment. When in doubt, the handbook recommends going straight for objectives that imply AL3, which do not necessarily take more effort.

The TISAX process comes down to three steps: registration, assessment, exchange.

1. Registration

On the ENX portal, the supplier registers, declares the locations and assessment objectives, then picks an audit provider from those approved by ENX. Before the audit, it completes its self-assessment against the VDA ISA catalogue, which the provider will check.

2. Assessment

The initial assessment leads to an overall result. According to the handbook, if it is "minor non-conform", the supplier can receive temporary labels while gaps are fixed; if it is "major non-conform", the issue must be resolved first. The supplier has up to nine months to resolve non-conformities, failing which it receives no labels. The auditor can approve a corrective action plan, then a follow-up assessment confirms the fixes.

3. Exchange

Results are placed on the ENX platform. The supplier decides which partners to share them with, and in how much detail. The customer no longer needs to run its own audit.

TISAX labels are generally valid for three years from the end of the assessment process. To keep them, you go through the three steps again, starting with a new registration. ENX states that publishing new catalogues every year does not change this period.

How much does a TISAX assessment cost?

There is no single price: the budget depends on the number of locations, the assessment objectives and therefore the AL2 or AL3 level. It has three components: registration fees paid to ENX, published in its price list; the audit provider's fees, quoted by each provider; and above all the internal time spent on preparation, self-assessment and fixing gaps, which weighs most for an organisation without an ISMS. Getting quotes from several approved providers and reusing an existing ISO 27001 foundation are the two most effective levers.

The two speak the same language, since the VDA ISA catalogue builds on ISO 27001. Yet they do not answer the same question.

Many automotive suppliers also fall under NIS 2, since vehicle manufacturing is one of the sectors covered. In 2025, ENX published an expert opinion comparing the measures in Article 21 of the directive with ISA 6 controls. Its conclusion: a location assessed in line with TISAX covers these security measures, under several conditions. The labels must be based on ISA 6, obtained at AL2 or AL3, reflect the company's overall risk and cover every location affected by NIS 2.

Two important caveats. First, the opinion comes from ENX itself, not from a national authority. Second, it does not cover everything: registration with the authority, incident reporting and national requirements must still be handled separately. TISAX is therefore a good foundation for NIS 2, not turnkey compliance.

• Read the contract. Identify the labels and locations your customer requires: they set the level and scope.
• Take the self-assessment seriously. Answer the VDA ISA catalogue with evidence, not intentions. This is what the auditor will check.
• Reuse what you have. If you have an ISMS, map its controls to the catalogue questions rather than starting from scratch (see our article on becoming compliant).
• Allow time for fixes. Keep a margin before your customer's deadline: nine months at most to fix gaps goes by quickly.
• Plan the renewal and the move to ISA2027 for assessments contracted from 2027.
• Assess your own subcontractors if they access the carmaker's information: a chain is only as strong as its weakest link (see third-party risk management).

If you already run an ISO 27001 programme, compliance campaigns that link several frameworks spare you from assessing the same control twice.