TISAX Certification

What TISAX Is and Who Governs It

TISAX stands for Trusted Information Security Assessment Exchange. It exists because automotive manufacturers were each auditing the same suppliers against the same expectations, and the industry wanted one assessment that everyone would accept.

• ENX Association governs TISAX on behalf of the German Association of the Automotive Industry, the VDA. ENX maintains the audit provider criteria and assessment requirements, approves audit providers and monitors the quality of assessments and results.
• The assessment content comes from the VDA Information Security Assessment, usually called the ISA. It is a requirements catalogue built on key aspects of ISO/IEC 27001 and extended for automotive concerns such as prototype protection.
• Assessments are performed only by ENX approved audit providers. Many of those firms are also ISO certification bodies, but when they conduct a TISAX assessment they act under the ENX scheme rules, not as an accredited ISO certification body.
• Results are exchanged through the ENX Portal. They are not published openly. You decide which participants may see your result, and that sharing cannot be withdrawn once granted.

Assessment Levels and Labels

Two decisions define the scale of a TISAX engagement: the assessment level and the assessment objectives.

Assessment levels set how deeply the audit provider verifies your self assessment:

• AL 1. A self assessment whose existence is checked but whose content is not verified. It carries low trust and is not used for exchanging results within TISAX.
• AL 2. The audit provider performs a plausibility check on your self assessment across the locations in scope, supported by evidence review and an interview with the person responsible for information security. This is typically conducted by web conference.
• AL 3. Comprehensive verification requiring the auditor to be on site. Documents are examined, planned and unplanned interviews are held, conditions are observed and processes are verified in operation.

Assessment objectives determine which labels you receive. They fall into three criteria catalogues: information security, covering information with high and very high protection needs for confidentiality and availability; prototype protection, covering prototype parts and components, prototype vehicles, test vehicles and events or shoots involving prototypes; and data protection, covering the processing of personal data and of special categories of personal data under the GDPR. Passing an assessment for an objective earns you the corresponding label.

A TISAX assessment result is valid for three years. There is no annual surveillance audit in the ISO sense; the result runs its term and is then renewed through a further assessment.

How a TISAX Assessment Runs

1. Registration. You register as a participant with ENX and define the scope, which means the locations and the assessment objectives your customer requires.
2. Self assessment. You complete the VDA ISA questionnaire, scoring each requirement on maturity and recording the evidence behind the score.
3. Audit provider selection. You appoint one of the audit providers approved by ENX. This is a commercial choice, but only approved providers can produce a valid result.
4. Assessment. The provider verifies at the agreed level, raises findings and agrees corrective action plans where requirements are not met.
5. Result and exchange. Once findings are closed, the labels are issued and the result is made available through the ENX Portal to the participants you nominate.

How Univate Prepares Suppliers

• We confirm the scope with you against what the customer actually demanded, because assessing more sites or more objectives than required is the commonest source of avoidable cost.
• We run the VDA ISA questionnaire as a gap assessment with evidence, so that your self assessment scores are defensible rather than optimistic.
• Where you already hold ISO/IEC 27001 certification, we map the existing management system onto the ISA requirements and concentrate effort on the automotive specific gaps, typically prototype protection and physical security.
• We build the maturity evidence the assessment expects: policy, procedure, implementation records and measurement, rather than a folder of documents assembled the week before.
• We support you through the assessment itself and through closure of any corrective action plan.

Points Worth Being Careful About

• A TISAX label is not an ISO/IEC 27001 certificate and cannot be substituted for one. They are issued under different schemes by different authorities for different purposes.
• Holding ISO/IEC 27001 certification does not exempt you from a TISAX assessment, although it substantially reduces the preparation work.
• Prototype protection objectives carry physical security requirements that catch out firms used to purely information security audits, including site perimeter, visitor control and photography restrictions.
• Sharing a result through the ENX Portal is permanent. Decide deliberately who receives it.
• Scope is defined by location. Adding a site later is a new assessment activity, not an amendment.

TISAX Questions We Are Asked Most Often

Who issues a TISAX label?

The assessment is performed by an audit provider approved by ENX Association, and the result is issued and exchanged under the TISAX scheme that ENX governs on behalf of the VDA. It is not issued under ISO accreditation, even though many approved audit providers are also ISO certification bodies.

How long is a TISAX result valid?

Three years. There is no annual surveillance audit in the ISO sense. Before the result expires you undergo a further assessment to renew the labels.

What are the TISAX assessment levels?

AL 1 is a self assessment whose content is not verified and is not used for exchanging results. AL 2 is a plausibility check by the audit provider with evidence review and interviews, usually remote. AL 3 is comprehensive verification requiring on site presence, document examination, planned and unplanned interviews and observation of processes.

Is TISAX the same as ISO 27001?

No. The VDA ISA questionnaire is built on key aspects of ISO/IEC 27001, so the two overlap heavily, but TISAX adds automotive specific requirements such as prototype protection, uses its own assessment levels and produces labels exchanged through the ENX Portal rather than a certificate.

Do we need TISAX if we do not make vehicle parts?

Possibly. TISAX is required by many automotive manufacturers and tier one suppliers of any partner that handles their confidential information, which includes engineering services, software suppliers, marketing agencies handling prototype imagery and logistics providers.

Send us the assessment objectives and level your customer has specified, along with the sites in scope. We will run the VDA ISA gap assessment and get you ready before you book an audit provider.

Univate supports certification, assessment and compliance programmes for organisations operating across international markets. Talk to our team about scope, effort and the route that genuinely applies to your organisation.