What is TISAX®? Labels, assessment levels and how the process works
The request usually arrives in a supply contract or a purchasing portal: “The supplier shall hold a valid TISAX® label with the objective ‘Confidential’ before the start of development.” For a first-time supplier to a German carmaker, that sentence raises a string of questions. What is TISAX®? Is it a certificate? Which label do we need, and how long does it take?
Key takeaways
- TISAX® is an assessment and exchange mechanism, developed by the German automotive association VDA and operated by the ENX Association.
- It is not a certification. An accredited audit provider assesses you, and the result is a set of labels you share with partners through the ENX portal.
- The basis is the VDA ISA catalogue, currently in version 6, which builds on ISO/IEC 27001. Assessments ordered from 1 January 2027 follow VDA ISA2027.
- Your customer decides which labels you need. The labels determine the assessment level.
- Labels are valid for three years. After that, you go through the assessment again.
- An ISO 27001 program gives you a strong head start, but prototype protection and the maturity model need their own work.
What TISAX® is
TISAX® stands for Trusted Information Security Assessment Exchange. Car manufacturers share confidential information with hundreds of suppliers: drawings, specifications, prototypes, test data. Before TISAX®, each manufacturer ran its own supplier audits. TISAX® replaced that with one assessment that a supplier can share with every participating partner.
Three parties are involved. The participant is the company that is assessed. The audit provider is an independent firm accredited by ENX that carries out the assessment. ENX runs the portal, sets the rules and publishes the result as labels. The participant decides who can see its labels.
The VDA ISA catalogue
The assessment criteria come from the VDA Information Security Assessment, or VDA ISA. It is a catalogue of controls grouped into modules: information security, prototype protection and data protection. The information security module follows the structure of ISO/IEC 27001 and references the 2022 edition. Version 6 has applied to assessments ordered since 1 April 2024. It added more on operational technology, availability and resilience, and introduced the current label names. Assessments ordered from 1 January 2027 follow its successor, VDA ISA2027. Existing labels remain valid until they expire.
Each control is rated on a maturity scale from 0 to 5. The general target for a label is maturity level 3, which means the measure is established: defined, documented, applied and checked. A written policy without evidence that it is followed does not reach that level.
Labels and assessment levels
Your customer asks for the label. Each label stands for an assessment objective, and each objective requires a certain assessment level:
Assessment level 1 is a self-assessment. It does not lead to a label in the ENX portal and is rarely enough for an OEM. Assessment level 2 is a plausibility check by the audit provider, usually remote, based on your self-assessment, your evidence and interviews. Assessment level 3 is a comprehensive check, normally on site, where the auditor verifies the measures directly.
Read your contract carefully. If it asks for “Strictly confidential” and you are assessed for “Confidential”, the label does not meet the requirement and the assessment has to be extended.
How the process runs
- Register on the ENX portal. You define the scope: the locations, the assessment objectives and your contact details. You then choose an audit provider from the list ENX publishes.
- Complete the self-assessment. You work through the VDA ISA catalogue, rate each control and collect evidence. This is where most of the effort sits.
- Initial assessment. The audit provider checks your measures at the agreed level and reports any findings.
- Corrective actions. If there are gaps, you agree a corrective action plan with the audit provider. Depending on the findings, a temporary label can be issued while you close them.
- Label and exchange. Once the assessment is complete, ENX publishes the labels and you share them with your customers in the portal.
The overall timeline depends mostly on how mature your security program already is. A company with an established ISMS can prepare in weeks. A company that starts from zero, or needs prototype protection on site, should plan for considerably longer.
What ISO 27001 gives you
Because the information security module builds on ISO/IEC 27001, a certified ISMS covers a large part of it: risk management, policies, access control, cryptography, operations security, supplier relationships and incident handling. The differences are worth planning for:
- Maturity, not just presence. TISAX® rates each control. An ISO 27001 control that exists but is applied unevenly may reach level 2, not 3.
- Prototype protection. Physical security for prototype areas, camouflage, transport and handling of test vehicles and rules for events have no counterpart in ISO 27001.
- Scope by location. TISAX® is assessed per site. Your ISO 27001 scope may be broader or narrower.
- Specific automotive requirements, such as how you handle information classified by the OEM.
Run both on one control set and map the VDA ISA questions onto the controls you already have. Our guide on multi-framework control mapping shows how, and our TISAX® page explains how GetTeddy supports the preparation.
What trips suppliers up
- Calling the label a certificate. Contracts and customers use exact terms. So should you.
- Choosing the label without reading the contract. The customer defines the objective, not the supplier.
- Underestimating maturity level 3. Auditors look for evidence that a measure runs, not only that it is written down.
- Leaving prototype protection to the end. Physical measures take time to build.
- Forgetting the three-year cycle. Plan the next assessment well before the labels expire.
TISAX® is a registered trademark of the ENX Association.
