TISAX ASSESSMENT

TISAX Assessment Readiness for
AUTOMOTIVE SUPPLIERS AND DEALERS

Your customers may request access to your TISAX assessment results through the ENX Portal. ITS helps you prepare the required controls, documentation, and evidence so your organization is ready for the assessment process.

Talk to a Compliance Expert ↗ Get My Free Assessment ↗

WHAT ASSESSORS FIND

Where a TISAX Assessment Goes Wrong

A TISAX assessment looks for controls that are implemented, functioning, and supported by evidence. Gaps often appear when policies, technical controls, and documentation do not align with the requirements being assessed. This sits inside our wider IT compliance services.

The gaps we are most often called in to close:

Shared logins nobody can attribute to a person
Multi-factor authentication missing on critical systems
Backups that exist but have never been restored
Insufficient logging and monitoring

Policies written years ago and never applied
Vendor access nobody has reviewed or removed
Evidence scattered across inboxes when the assessor asks

Talk to a Compliance Expert Compare TISAX and ISO 27001

Scope Before Spend

Which locations and which processes are in scope decides the size of the whole job. It is worth slowing down for one conversation.

Controls That Function

Assessors test whether a control works, not whether a policy mentions it. We put them in and operate them, on your systems.

Evidence in One Place

Screenshots, logs, records and policies collected as the work happens, so the interview is a walkthrough instead of a search.

TISAX and ISO 27001 address many similar information security principles, but they serve different purposes and follow different assessment models. See our TISAX and ISO 27001 comparison to understand the differences, including scope, assessment model, and how results are shared. And if the answer turns out to be the international certification rather than the automotive assessment, that is ISO 27001 certification support.

Talk to a Compliance Expert

HOW TISAX WORKS

Six Things to Understand Before You Register

TISAX is not a certification in the way ISO 27001 is, and the difference changes how you prepare for it. Here is the mechanism, in the order you will meet it.

Scheme structure, terminology and roles are taken from the ENX Association's published TISAX participant documentation. ENX operates TISAX on behalf of the German Association of the Automotive Industry (VDA). This page is not legal advice on your customer's requirements.

Who Runs It

TISAX stands for Trusted Information Security Assessment Exchange. It is governed by the ENX Association and provides a standardized way for automotive companies to assess and exchange information security results across the supply chain.

The VDA ISA Catalog

You are assessed against the VDA Information Security Assessment, the automotive industry's own control catalog. It draws heavily on ISO 27001, which is why the two are so often mentioned together, and it adds industry-specific expectations.

How it compares with ISO 27001

Registration and Scope

You register with ENX and define what the assessment covers: which locations, which processes, which parts of the business. Scope is the first real decision, because everything after it follows the boundary you draw.

Assessment Levels

The depth of the assessment is determined by the required assessment level. Level 1 is a self-assessment. Level 2 adds review of evidence and an interview with the assessor. Level 3 involves a more comprehensive verification of controls and may include on-site assessment activities.

Assessment Objectives and Labels

You are not assessed in general. You are assessed against specific objectives, such as handling information at a high or very high protection level, prototype protection or data protection, and you receive a label for each one you meet.

The Exchange

This is the part people miss. You do not send anybody a certificate. Your result sits in the ENX portal and you grant your customer access to it, which is why keeping it current matters as much as earning it.

HOW TO START

Three Steps to an Assessment That Goes Well

Start with these three preparation steps before moving into the formal TISAX assessment process.

STEP 1

Confirm What Your Customer Asked For

Which assessment level, which objectives, and by when. Getting this wrong is the most expensive mistake available, because it changes the size of everything after it.

Talk to a Compliance Expert

STEP 2

Scope It and Find the Gaps

Which sites and processes are in, then an honest read of your controls against the catalog. You get the gaps in writing, in the order we would close them, yours to keep.

Get My Free Assessment

STEP 3

Close the Gaps and Prepare for Assessment

Controls go in and stay on, evidence is collected as the work happens, and we prepare your team for the interview. The assessment itself is done by an ENX-approved audit provider, never by us.

CLIENT RESULTS

What Clients Say About Working With Us

Hear from ITS clients about the security and operational improvements they've experienced. These testimonials are not specific to TISAX or automotive organizations.

We always get a technician or an engineer that can solve the problem remotely and we have very little downtime. We’ve had a couple of times where we have had an employee that is prevented from working, and when we call in and we escalate quickly, we always have someone readily available to solve the problem.

Kathy Mickelson Office Manager, Tower Arch Capital

FAQ

What Suppliers and Dealers Ask Us First

1. What is TISAX?

TISAX stands for Trusted Information Security Assessment Exchange. It is used across the automotive industry to assess and exchange information security results. TISAX is governed by the ENX Association, and assessments are based on the VDA Information Security Assessment (ISA) catalogue. After the assessment, results are made available through the ENX Portal, where organizations can control how they are shared with business partners.

2. Is TISAX a certification?

TISAX is not a certification in the same way ISO 27001 is. ISO 27001 can result in a certificate issued by an accredited certification body. TISAX produces assessment results and corresponding TISAX labels, which are managed and shared through the ENX Portal.

3. What are the TISAX assessment levels?

There are three TISAX assessment levels. Level 1 is based on self-assessment. Level 2 adds review of evidence and interaction with the audit provider. Level 3 involves a more detailed verification of the organization's controls and may include on-site assessment activities. The required assessment level depends on the assessment objectives and protection needs involved.

4. TISAX or ISO 27001: which one do we need?

Ask your customer, because some accept either. Where both are acceptable, the trade is scope against reach: TISAX is automotive-specific and, at level 2, usually the lighter lift, while ISO 27001 is an international certification that also satisfies partners outside the industry. We have written the comparison up in full, including what each one realistically costs, and built a selector that walks a dealership through the decision.

5. Our manufacturer gave us a deadline. What does that actually mean?

It means the requirement is contractual rather than voluntary, and the date is theirs. Mercedes-Benz, for example, requires dealerships to meet a recognized security standard, either ISO 27001 or TISAX level 2, by September 30, 2026, and its Cyber Security Guideline lists controls that have to be implemented, monitored and proven with documented evidence. Other manufacturers set their own requirements and their own dates. The first thing to do is read the guideline you were sent rather than a summary of it.

6. Can ITS assess us, or issue our label?

No. ITS can help you prepare for TISAX, but the assessment itself must be conducted by an independent audit provider approved by the ENX Association. ITS can help confirm your scope, assess gaps against the ISA catalogue, implement and operate controls, organize evidence, and prepare your team for the assessment.

See Where Your TISAX Readiness Stands Today

Review what your customer is asking for, confirm what is in scope, and identify gaps between your current controls and the TISAX requirements. You'll leave with a documented view of where your organization stands and what to address next.