TISAX Guide: VDA ISA, Assessment Levels and Labels

Automotive manufacturers will not share confidential designs, prototypes or personal data with a supplier until that supplier can show a TISAX result at the right level, and many suppliers discover the requirement only when a contract is already waiting. TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's shared assessment mechanism: one assessment against the VDA Information Security Assessment (VDA ISA) catalogue, performed by an approved audit provider, with the result shared with any partner through the ENX Association's portal. This guide explains the VDA ISA 6 catalogue, assessment objectives and labels, assessment levels AL1 to AL3, maturity levels, scope, the registration and assessment process, corrective action, simplified group assessment, renewal, and how TISAX relates to ISO/IEC 27001. It is for information security managers, compliance leads and IT teams at automotive suppliers, service providers and development partners.

Key takeaways

• TISAX is an exchange, not a certificate. An audit provider assesses you against the VDA ISA, ENX records the result as TISAX labels, and you decide which partners can see it and at what level of detail.
• The catalogue is VDA ISA 6. ENX's download page lists ISA 6.0.3 as the current version, the basis for assessments starting after 1 April 2024.
• Your objectives set your level. Confidential, High availability, Test vehicles, Proto events and Data are assessed at AL2; Strictly confidential, Very high availability, Proto parts, Proto vehicles and Special data require AL3, which includes on-site verification.
• Results last three years. The participant handbook states the assessment result is valid for three years, after which the register, assess and exchange process is repeated.
• ISO/IEC 27001 helps but does not substitute. The ISA is built on ISO/IEC 27001 and 27002 themes, but adds prototype protection, data protection and maturity scoring, and its scope rules differ.

What TISAX is and who runs it

The German Association of the Automotive Industry (VDA) maintains the ISA catalogue, and the ENX Association operates TISAX on behalf of the industry: it approves audit providers, runs the ENX portal where participants register and share results, and publishes the TISAX Participant Handbook (version 2.8, dated 13 March 2025, at the time of writing). A company that registers is a TISAX participant, identified by a Participant ID, and each assessment scope has its own Scope ID.

The handbook describes three steps:

1. Registration: create an account in the ENX portal, enter participant details and contacts, accept the General Terms and Conditions and define the assessment scope and objectives. ENX invoices a registration fee, which is due whether or not you pass; the audit provider invoices the assessment separately.
2. Assessment: choose an approved audit provider, complete a self-assessment using the ISA workbook, then undergo the assessment at the level your objectives require.
3. Exchange: share the result with partners through the portal, the TISAX exchange that gives the scheme its name. You choose publication and sharing levels, and the handbook warns that publication or sharing permissions cannot be revoked once granted.

Customers usually state the objectives they require in their contract or supplier questionnaire. A TISAX result replaces repeated customer-specific audits of the same controls, which is the point of the exchange. For the wider automotive picture, including vehicle cybersecurity under UNECE R155, see the Automotive Cybersecurity Guide.

Is there a TISAX certification?

People often say "TISAX certification" or "TISAX certificate", but the output is an assessment result with TISAX labels held in the ENX portal, not a certificate issued under an accreditation scheme. What a customer relies on is the label, the scope behind it (participant, locations, objectives) and the expiry date. A PDF or logo on a supplier's website is not evidence on its own.

Checking a supplier's TISAX labels

On the customer side, ask the supplier to share the result with your company through the ENX portal rather than sending screenshots. Then check four things: that the scope covers the location doing your work, that the objectives match what you require (Confidential is not Strictly confidential), that the assessment level is the one you need, and when the labels expire. Record the Scope ID in your supplier file and set a reminder for renewal. See the Third-Party Risk Management Guide.

The VDA ISA catalogue

The VDA ISA is published as a spreadsheet questionnaire. ENX lists ISA 6.0.3 (English) as current and a comparison copy showing changes from ISA 5.1.0; assessments ordered before 1 April 2024 could still use version 5. Historic versions used before 13 December 2018 sit in an archive.

• Information security module: the core control questions covering policies and organisation, human resources, physical security, identity and access management, IT and cyber security, supplier relationships and compliance. Every assessment includes it.
• Prototype protection module: physical and organisational requirements for prototype parts and vehicles, test vehicles and events such as photo shoots and presentations. The handbook describes Proto parts as including requirements for physical security and the surrounding area, organisational requirements and handling of prototypes.
• Data protection module: requirements for processing personal data as a processor under GDPR Article 28, and for special categories of personal data under Article 9 for the Special data objective.
• Requirement types: each control lists requirements that must be met, requirements that should be met, and additional requirements that apply for high and very high protection needs.

Maturity levels

For each control question the participant records a maturity level on a 0 to 5 scale, from not implemented through performed, managed and established to the higher predictable and optimising levels. The target maturity for most controls is level 3, meaning the control is established as a documented, consistently applied process. TISAX maturity level scoring is therefore the core of the TISAX requirements, not a side exercise. The handbook tells participants to use the ISA self-assessment to find out whether the ISMS reaches the expected maturity level before the audit. The workbook's results view compares achieved and target maturity per chapter, which participants also use for TISAX benchmarking across sites or business units, but the label decision is made by the audit provider's findings, not by the self-scored number.

Assessment objectives, labels and levels

Assessment objectives are what you choose at registration, and a passed assessment results in the matching TISAX labels. The Info high and Info very high objectives could only be selected until 31 March 2024; from 1 April 2024 they are replaced by Confidential and Strictly confidential.

The TISAX prototype protection labels and the TISAX data protection label are separate from the information security labels, so a supplier processing HR data but holding no prototypes needs Confidential and Data, not the prototype objectives.

If any chosen objective needs AL3, the whole scope is assessed at AL3: the standard scope text says the assessment is conducted at least in the highest assessment level listed in any of the objectives. This is why adding one Proto parts objective to an otherwise AL2 scope changes the cost and effort of the entire TISAX audit.

In short, the TISAX assessment level is driven by the objective with the highest protection need: TISAX AL2 suits most information handling, and TISAX AL3 is required for strictly confidential data, very high availability, prototype parts and vehicles, and special category personal data.

Scope and sites

Each scope covers one or more locations. The handbook offers two TISAX scope types, Standard and Custom. The standard scope is predefined and cannot be changed: the assessment "includes all processes, procedures and resources under responsibility of the assessed organization" at the listed locations. Customers generally expect the standard scope, because a custom scope that carves out departments or systems is harder for them to rely on. List every location where the in-scope information or prototypes are handled, including server rooms and outsourced data centres you control. Results are shown per scope, so a supplier with several unrelated business units may register separate scopes rather than one large one.

The assessment process, corrective action and renewal

1. Prepare: download the current ISA, complete the self-assessment honestly with evidence references, and close obvious gaps first. Many first-time participants need several months here.
2. Register and order: TISAX registration happens in the ENX portal: register the scope, then request offers from approved audit providers and order the assessment quoting your Participant ID and Scope ID.
3. Initial assessment: the audit provider assesses the scope at AL2 or AL3 and records conformities and non-conformities in the TISAX assessment report.
4. Corrective action plan: for non-conformities you write a TISAX corrective action plan with owners and dates. The audit provider evaluates the plan in a corrective action plan assessment and later verifies implementation in a follow-up assessment. In some cases, such as AL3 on-site work that had to be performed remotely, the handbook allows temporary TISAX labels to be shared while the follow-up is pending.
5. Labels and exchange: once results are complete, ENX shows the labels and you share them with partners at the level you choose.
6. Renewal: results are valid for three years. TISAX renewal means registering again and repeating the assessment in good time, because customers check expiry dates and a lapse can block new orders.

Simplified group assessment

Large participants can reduce effort with the TISAX simplified group assessment, described in ENX's addendum (version 1.1, dated 5 May 2023). It requires at least three locations in scope (ENX recommends at least twelve for it to pay off) and a "centralised and highly developed ISMS" at a main location.

The precondition check verifies five additional must-level requirements, covering policies, management system approval, a named overall responsible person, internal audits and security event processing. If the central ISMS cannot demonstrate those, per-site assessment is cheaper than a failed group assessment.

TISAX vs ISO 27001

The handbook notes that for TISAX "you also have to define your ISMS. But the scope of the assessment can be different." An existing ISO 27001 ISMS gives you the risk process, policies, internal audit and management review that the ISA expects, so certified organisations usually need to close prototype, data protection and maturity gaps rather than start again. See the ISO 27001 Certification Guide.

Where identity fits

The ISA's identity and access management controls are where assessors find many non-conformities: shared or generic accounts, missing joiner-mover-leaver evidence, unmanaged service accounts and API keys, and supplier staff with standing access to OEM portals and collaboration platforms. Assessors look for unique identities, need-to-know authorisation, regular access reviews, strong authentication for remote and privileged access, and controlled handling of technical accounts. Practical evidence includes an account inventory that distinguishes personal, privileged, service and supplier accounts with an owner for each; leaver tickets matched to account disablement dates; MFA enforcement reports for remote access; and a record of where technical credentials such as API keys and certificates are stored and when they were last rotated. Engineering environments that hold customer CAD data and the OEM collaboration portals your staff use are in scope and are often missed. See the Access Reviews Guide and the Service Account Security Guide.

How to implement TISAX

1. Confirm the requirement: get the exact objectives your customer expects in writing, because they set AL2 or AL3 and the modules in scope.
2. Define the scope: list locations, systems and processes; prefer the standard scope.
3. Run a gap self-assessment: score the current ISA honestly with evidence, and prioritise must requirements and controls below maturity 3.
4. Remediate in order: governance and risk first, then access control, physical security for prototype areas, supplier management and incident handling.
5. Pilot: run an internal audit of one site against the ISA, or ask the audit provider for a pre-assessment, before ordering the formal assessment.
6. Assess and correct: complete the assessment, submit a realistic corrective action plan and schedule the follow-up promptly.
7. Share and maintain: share labels, keep the ISMS running with internal audits, and diarise renewal at least six months before expiry.

Decision guidance

• AL2 or AL3: do not request objectives your customers do not need, since one AL3 objective lifts the whole scope. Equally, do not under-scope: a supplier that later receives prototype parts must reassess.
• Single scope or several: combine locations that share one ISMS and handle the same customer work; separate business units with different customers and controls.
• Small suppliers: one location at AL2 with Confidential and Data is the common starting point; reuse cloud provider attestations as evidence for hosted systems.
• Large groups: consider S-SGA only when the central ISMS is mature; otherwise use per-site assessment.
• Already ISO 27001 certified: map the statement of applicability to the ISA first and budget for prototype and data protection modules.

Measurement and framework mapping

• Percentage of ISA controls at or above target maturity 3, by chapter and site.
• Number of open non-conformities and median days to close against the corrective action plan.
• Days until label expiry for each scope, with a renewal start trigger.
• Percentage of in-scope accounts covered by quarterly access reviews.
• Prototype area access exceptions and visitor log completeness per month.

Common failure patterns

• Self-assessment optimism: scoring controls at 3 without evidence that the process is documented and followed, which surfaces as non-conformities at AL2 plausibility checks.
• Wrong objectives: registering Strictly confidential or Proto parts "just in case" and turning a remote AL2 assessment into an on-site AL3 one.
• Prototype areas treated as IT only: missing visitor control, photography rules, privacy screens or transport procedures.
• Weak supplier access control: automotive incidents such as the Scania data breach show how a partner's credentials become the way in.
• Letting labels lapse: starting renewal after expiry, leaving customers unable to confirm the supplier's status.
• Corrective action plans without owners: dates slip and the follow-up assessment finds the same gaps.

Practitioner checklist

• Obtain each customer's required assessment objectives in writing.
• Download the current ISA (6.0.3 at the time of writing) from ENX and confirm it before every assessment.
• Define a standard scope listing every location handling in-scope data or prototypes.
• Complete an evidence-backed self-assessment and close must requirements below maturity 3.
• Review shared, generic, service and supplier accounts against the ISA access requirements.
• Register in the ENX portal, record the Participant ID and Scope ID, and order from an approved audit provider.
• Track corrective actions with owners and book the follow-up assessment.
• Set publication and sharing levels deliberately, remembering they cannot be revoked.
• Start renewal at least six months before the three-year expiry.

Standards and references

• ENX Association: TISAX Participant Handbook
• ENX Association: TISAX downloads (VDA ISA 6.0.3)
• ENX Association: TISAX Simplified Group Assessment
• VDA: VDA ISA catalogue version 5.1
• ISO: ISO/IEC 27001:2022 Information security management systems, Requirements
• ISO: ISO/IEC 27002:2022 Information security controls

Related NHI Mgmt Group resources: Automotive Cybersecurity Guide · ISO 27001 Certification Guide · Third-Party Risk Management Guide · Security Questionnaires Guide · GDPR Compliance Guide for Security Teams