TISAX Label in Months, Not Years

TISAX stands for Trusted Information Security Assessment Exchange and is the established standard for information security assessments in the automotive industry. It is operated by the ENX Association on behalf of the German Association of the Automotive Industry (VDA) and is based on the VDA ISA questionnaire (currently version 6.x).

Unlike ISO 27001, TISAX is not a certification but a label that is published on the ENX portal after a successful assessment. This label is visible to all participating OEMs and Tier-1 suppliers, creating a standardized trust mechanism across the entire automotive supply chain. The label is valid for 3 years, after which a re-assessment is required.

The VDA ISA catalog covers significantly more than classic IT security. In addition to information security (confidentiality, integrity, availability), it includes dedicated assessment objectives for prototype protection — both physical and digital — as well as data protection requirements that go beyond the GDPR. Companies must demonstrate maturity levels for each assessment objective on a scale from 0 (incomplete) to 5 (optimized).

Who needs TISAX? In principle, any company that processes, stores, or accesses confidential OEM data. This includes Tier-1 and Tier-2 suppliers, development partners, IT service providers, SaaS vendors, cloud providers, logistics companies, and aftermarket firms. OEMs increasingly require the TISAX label as a prerequisite for contracts. Without a label, you risk losing tenders and existing business relationships.

The assessment is carried out by an accredited audit provider (not by ENX itself). Depending on the required Assessment Level, the audit takes place remotely (AL2) or on-site (AL3). Companies with an existing ISO 27001 certification benefit from significant overlap — approximately 60 to 70 percent of TISAX assessment objectives are already covered. However, automotive-specific requirements such as prototype protection always require additional measures.