Insight into the current VDA catalogue:
TISAX® Consulting: Pass your assessment with predictability and no detours
Gap analysis, ISMS setup and assessment preparation for automotive suppliers.
Related topics
A supply order is hanging on the TISAX® label – and the contract includes a deadline that no one in the company has ever backed up with a realistic estimate of the effort involved. This is exactly where our TISAX® consulting comes in: We bring your information security management up to the standard required by the VDA ISA and guide you through to passing your TISAX® Assessment.
If TISAX® suddenly becomes a contractual requirement
For most IT and security managers, TISAX starts as a single line in a supply contract. An automotive manufacturer or Tier 1 supplier requires a valid TISAX label before awarding the next contract – and the deadline is tight. At the latest, the first honest stocktake reveals that the company's own IT documentation, authorisation concepts, and emergency processes do not have the maturity level demonstrably required for a TISAX assessment.
The challenge is rarely the technology alone. TISAX assesses a living information security management system (ISMS) – meaning processes, responsibilities, and evidence, not just firewalls. Anyone starting without a structure will lose weeks searching, doing rework, and facing misunderstandings about the TISAX requirements.
Our consultancy takes this uncertainty away from you. We precisely identify your current position with a GAP analysis, prioritise measures by effort and impact, and guide you systematically through to the assessment. The result: a plannable path to the label instead of last-minute activism before the audit.
What is TISAX®?
TISAX stands for Trusted Information Security Assessment Exchange. It is the testing and exchange procedure by which companies in the automotive industry uniformly demonstrate and share their information security levels with each other. The procedure is operated by the ENX Association On behalf of the German Association of the Automotive Industry (VDA).
Technically, TISAX is based on the VDA ISA – the Information Security Assessment- Catalogue. This catalogue of questions forms the binding basis for assessment and is closely aligned with the international standard ISO/IEC 27001; Around three-quarters of the controls align in terms of content. Version 6 of the catalogue has been binding for all newly commissioned audit procedures since 1 April 2024. ENX has since published the subsequent catalogue version, which applies to assessments commissioned from 2027 onwards – a point you should consider when planning your project's timeline.
The VDA ISA structures its over 300 requirement questions into three test modules:
- Information Security – the mandatory module for every assessment
- Data protection – relevant when personal data is processed on behalf of another party
- Prototype protection – for companies working with vehicles, components or test data that have not yet been released
The procedure has three Assessment Level (AL), which are based on the need for protection:
The three assessment modules: Information security, Data protection, Prototype protection
The VDA ISA catalogue is divided into three modules. Not every company needs to go through all three. Which modules are audited depends on the type of data you process for the OEM.
The mandatory module for all TISAX participants. It covers the central topics of an ISMS, including security policies, risk management, access and authorization controls, IT security, personnel management, physical security, and supplier management. Companies that have already implemented an ISMS according to ISO 27001 will recognise many of the contents and structures.
Relevant when processing personal data on behalf of an OEM. The module is based on the requirements of the GDPR and assesses, among other things, records of processing activities, data protection impact assessments, and the secure handling of data transfers.
Obligatory for companies working with vehicle prototypes, test vehicles, new developments of components and parts, or highly confidential development data. It includes physical security measures, organisational guidelines, and special requirements for test vehicles and events.
The benefits at a glance
A TISAX label replaces a standalone ISO 27001 certification for your automotive customers as equivalent proof. Instead of convincing each client individually of your security level, you demonstrate it once and share the result in a controlled manner. This saves effort on both sides and removes a recurring hurdle in the supply chain.
Why TISAX® is important for your company
It is the entry ticket into the automotive supply chain
Objective Clarity regarding TISAX typically becomes mandatory when a contract with a manufacturer or supplier includes the processing of confidential information – in other words, practically whenever a non-disclosure agreement is part of the supply contract. Without a valid label, an order often remains simply unattainable. An expired or missing label can, in extreme cases, lead to an immediate order freeze.
It protects what makes your business.
Construction data, simulation results, prototype information, and customer data are a supplier's capital. VDA ISA demands precisely the measures that protect this capital: clear classification of information, robust authorisation concepts, regulated incident and crisis management, and – increasingly since version 6 – the safeguarding of the availability of IT and OT systems against attacks such as ransomware.
It is a competitive advantage
An existing TISAX label signals to clients that you take information security seriously and remain capable of delivery. In tenders, this is often an exclusion criterion – those who meet it are even in the running. Those who meet it early and cleanly gain a time advantage over competitors who only react under deadline pressure.
It contributes to your overall compliance.
TISAX does not stand in isolation. An ISMS based on VDA ISA covers a significant portion of the requirements from the NIS2 Directive and creates a common basis with ISO 27001. Those who consider integrating these frameworks, instead of working through them separately, noticeably reduce the overall effort. This very interlocking of security and compliance requirements is the core of our work.
Challenges in TISAX implementation
Experience from projects shows that TISAX rarely fails due to a lack of will, but rather due to underestimated effort in five typical areas.
Organisational requirements
TISAX consistently requires maturity level 3 – demonstrably lived processes, not just documents in a folder. This necessitates designated responsibility for information security, functioning risk management, and active involvement of senior management. Without this governance level, any technical measure remains a piecemeal effort.
Technical measures
A large part of a TISAX project involves IT-related evidence: current asset registers, clear authorisation concepts, documented patch levels, system hardening, and – since ISA 6 – the integration of relevant OT systems into the ISMS scope. Those who have not documented these fundamentals up-to-date often stumble already in the self-assessment.
Documentation
The auditor assesses what can be evidenced. Guidelines, work instructions, evidence, and records must be consistent, retrievable, and up-to-date. Incomplete or contradictory documentation is one of the most frequent reasons for audit findings.
Processes
Safety must be a part of everyday life: How is a new employee granted rights and how are they revoked upon departure? How are security incidents reported and handled? How is the effectiveness of the ISMS verified? These processes must be defined, communicated, and demonstrably lived.
Staff training
Even the best ISMS remains ineffective if the workforce is not aware of it. TISAX expects demonstrable awareness and training – a point that is often overlooked internally but is regularly checked during audits.
Dealing with the scope is an overarching challenge: if it is defined too broadly, the effort will explode; if it is defined too narrowly, the label will not cover what the client expects. Cutting the scope correctly is one of the first and most consequential decisions in the project.
How long does a TISAX certification take?
A TISAX certification typically takes 6 to 18 months, from registration with ENX to the awarding of the label. The largest time block is the preparation.
Phase
Duration
Registration and Scope Definition
1-3 weeks
Preparation and ISMS Setup
3-12 months
Assessment
approx. 1 week
Follow-up (only in case of deviations)
up to 9 months
The preparation time can be shortened. Instead of 9 to 12 months with a classic consulting project, many SMEs can expect 3 to 6 months with an existing ISMS, because workflows, templates, and VDA-ISA mappings are already integrated.
Organisations that already operate an ISMS in accordance with ISO 27001 often fall at the lower end of the scale. The overlap is approximately 80 %. The remaining gaps typically relate to prototype protection and automotive-specific requirements for supplier management.
The certificate is valid for three years. After that, a re-assessment is required. Unlike ISO 27001, there are no annual surveillance audits.
Our services for your TISAX assessment
We will support you all the way – from the initial assessment of your current situation to beyond the successful completion of your assessment. Depending on your level of maturity, you can join us at the point where you need support.
GAP Analysis
We systematically compare your current state with the requirements of the VDA ISA and provide you with a robust gap list – including an assessment of effort, priority, and critical path. This creates the basis for realistic time and budget planning.
ISMS Implementation
We will build an information security management system with you that fits your company's needs – lean enough to be practical and comprehensive enough to demonstrate maturity level 3. We will integrate existing approaches from ISO 27001 or NIS2, rather than duplicating efforts.
Documentation and Guidelines
We draw up and organise the necessary policies, procedures and supporting documentation in such a way that they pass audits whilst remaining practical for day-to-day use – without creating a mountain of paperwork.
Risk management
We are establishing a traceable process for the identification, assessment, and treatment of information security risks, including a clear assignment of risk owners – a core component expressly required by the VDA ISA.
Technical safety measures
As a system house, we don't just develop concepts, we also implement them: hardening, authorisation control, logging, backup and emergency concepts, as well as the security of OT environments where they fall within the scope.
Preparing for the assessment
We will go through the self-assessment with you, critically review it against the catalogue and resolve any outstanding issues before the audit service provider arrives. This way, there will be no surprises in the TISAX audit.
Support throughout the entire project
We remain your point of contact beyond the individual measure – from registration with ENX through the selection and coordination of the accredited audit service provider to the awarding of the label.
Aftercare
A TISAX label is valid but requires an annual self-disclosure to ENX and a follow-up assessment after three years. On request, we will take over the ongoing support of your ISMS, so that security remains a state and does not become a major undertaking again just before expiry.
TISAX consultation process – step by step
1
Initial consultation
We will clarify your starting position: Which label does your client require, what deadline is in the contract, what scope do we need to consider? At the end, there will be a shared understanding of the goal and framework.
2
Gap analysis
We record your current status and compare it to the requirements of the VDA ISA. The result is a prioritised gap list with an effort estimate.
3
Action planning
From the gap list, a concrete timetable is created with responsibilities, deadlines and milestones – tailored to your internal resources and the contractual deadline.
4
Implementation
We implement the organisational and technical measures – together with your team or on your behalf. Documentation, guidelines, and processes are created in such a way that they are audit-proof and suitable for everyday use.
5
Preparation
We are carrying out TISAX preparation in the narrower sense: completing the self-assessment, compiling evidence, testing processes, and conducting an internal trial run against the catalogue.
6
Assessment
You will undergo the assessment with an accredited testing service provider. We will assist with the preparation of documentation, be available as a point of contact during the audit, and provide support with any findings in the action plan.
7
Continuous improvement
After the labelling process, we keep your ISMS up-to-date: annual self-assessment, adaptation to new catalogue versions, and preparation for the follow-up assessment. This ensures your security level remains resilient.
Frequently Asked Questions about TISAX Consulting (FAQ)
How much does a TISAX assessment cost?
The TISAX costs are made up of several components: the participation fee to the ENX Association, the fee of the accredited audit service provider for the actual assessment, and – usually the largest item – the internal and external effort for setting up the ISMS. The amount depends heavily on the assessment level, the number of locations, and the maturity of your existing security management. An AL-3 assessment with an on-site audit is significantly more expensive than a simple AL-2 procedure. A reliable figure can only be provided after the gap analysis – which is why it is at the beginning for us.
How long does TISAX preparation take?
As a rule of thumb, you should expect between three and nine months, depending on the starting point. Companies with an existing, implemented ISMS or an ISO 27001 foundation will be quicker; those starting from scratch will take longer. It's less about the technology and more about the time it takes for implemented processes to settle in – maturity level 3 cannot be achieved overnight.
What is the difference between assessment levels AL 2 and AL 3?
Both examine the same controls of the VDA ISA but differ in their depth of examination. AL 2 is predominantly carried out remotely and relies more heavily on a plausibility check of the evidence. AL 3 comprises an on-site audit with system checks and sample testing and is required for very high protection needs – for example, for particularly sensitive design or prototype data. Your client typically specifies which level you require.
Do we need TISAX if we are already ISO 27001 certified?
An ISO 27001 certification is an excellent foundation, but it does not automatically replace TISAX. Around three-quarters of the controls overlap, meaning an integrated approach can save 30 to 50 percent of the effort compared to separate implementation. However, there remain automotive-specific requirements – such as for prototype protection – that ISO 27001 does not cover and which must be specifically demonstrated in the TISAX assessment.
What does maturity level 3 mean and why is it crucial?
The VDA ISA assesses each requirement on a maturity scale. For a TISAX label, maturity level 3 is consistently required – this means: the process is defined, documented, and demonstrably lived. A policy that exists but is not applied in everyday life does not achieve this maturity level. This is precisely where preparation separates from formality in the audit.
What is the VDA ISA and which version is applicable?
The VDA ISA is the questionnaire and audit catalogue that forms the basis of every TISAX Assessment. Version 6 has been mandatory since 1st April 2024. The subsequent catalogue version has since been published, which applies to assessments commissioned from 2027 onwards. For ongoing or short-term planned projects, you should incorporate this transition into your scheduling; we will keep an eye on the current status for you.
Ein TISAX-Label ist in der Regel drei Jahre lang gültig.
A TISAX label is valid for three years. After that, a follow-up assessment is required. Additionally, the ENX Association requires an annual self-disclosure. Clients can check at any time via the ENX portal whether a label is active – an expired label practically means a risk for the business relationship.
Will we receive a TISAX certificate in the end?
TISAX does not issue certificates, but rather labels. The successful assessment is stored in the ENX portal, and you decide which partners may view the results. In practice, the effect is the same as with a certification: your client receives the required proof that your site meets the TISAX requirements.
Who in our company needs to be involved in the project?
TISAX is not purely an IT project. In addition to IT management, it requires executive management for the governance level, quality or security management for processes and documentation, and specialist departments where sensitive information is processed. Successful projects usually have a named, responsible person who coordinates the undertaking internally.
What happens if findings occur in the assessment?
Findings are not the end, but part of the procedure. If deviations are identified, the auditor documents them in an action plan, which you must complete within a defined timeframe. Only then will the label be awarded. Thorough preparation – particularly an honest internal trial run – significantly reduces the number of such findings.
Can we achieve TISAX without external consultancy?
In principle, yes – with sufficient in-house expertise and available capacity. In practice, both are often lacking when TISAX is put under deadline pressure on an already overloaded team. Consulting is particularly worthwhile if you are undergoing an assessment for the first time, if the deadline is tight, or if you want consulting and technical implementation from a single source.
Does TISAX cover the requirements of the NIS2 Directive?
An ISMS based on VDA ISA covers a significant portion of the NIS2 requirements, as both frameworks demand comparable fundamentals: asset management, authorisation concepts, incident processes, and documented risk consideration. However, there is no complete overlap. Those considering both topics should plan them together – we fundamentally consider TISAX and NIS2 together in our projects.
Talk to us about your TISAX project
TISAX rarely gets easier by postponing it. If your supply contract already contains a deadline or you foresee that a client will require a label, the best time for an initial assessment is now.
In a no-obligation consultation Let's clarify together which label you need, how realistic your deadline is, and where your biggest gaps lie. You'll receive an honest initial assessment – no obligation and no sales pressure.
As an IT consultancy with a focus on information security, we combine consulting and technical expertise.
Book your no-obligation initial consultation for TISAX consulting now.
Our TISAX specialist, Ralph Dörfler, has years of experience as a TISAX auditor himself and will guide you from the gap analysis through to passing the assessment – and beyond.
RALPH DÖRFLER
Head of IT Security