TISAX: Automotive Information Security Assessment Guide

TISAX (Trusted Information Security Assessment Exchange) is the standardized information security assessment mechanism for the automotive industry. Managed by the ENX Association and based on the VDA Information Security Assessment (ISA) catalog, TISAX enables suppliers and partners to demonstrate their information security maturity through a single assessment that is recognized across the automotive supply chain — eliminating the need for each OEM to conduct separate audits.

What TISAX Covers

TISAX assessments are based on the VDA ISA catalog, which covers information security, prototype protection, and data protection. The information security module aligns closely with ISO 27001 but adds automotive-specific requirements around supply chain security, project-specific security, and connected vehicle data. The prototype protection module addresses physical security of vehicle prototypes, test vehicles, and pre-release components. The data protection module covers GDPR compliance requirements.

Assessment levels determine the rigor of the evaluation. AL 1 is a self-assessment (rarely accepted). AL 2 involves a remote audit by an accredited provider. AL 3 requires an on-site audit and is mandatory for handling highly sensitive information or prototypes.

Who Needs TISAX

TISAX is required for virtually all companies in the automotive supply chain that handle sensitive information from OEMs. This includes component suppliers, engineering service providers, IT service providers, logistics companies, and toolmakers. Major OEMs including Volkswagen, BMW, Daimler, and others require TISAX labels from their suppliers as a contractual condition.

Implementation Approach

Register on the ENX portal and define your assessment scope. Conduct a self-assessment using the VDA ISA catalog to identify gaps. Remediate gaps by implementing required controls — focus on areas where automotive requirements diverge from general IT security. Select an ENX-accredited audit provider and schedule the assessment. After successful assessment, your TISAX labels are published on the ENX portal for partner verification.

Cost Considerations

Total costs range from $30,000 for smaller suppliers with AL 2 assessments and strong existing security to $200,000 for larger organizations requiring AL 3 with prototype protection. Audit provider fees typically run $15,000 to $40,000 depending on scope and assessment level. Organizations with existing ISO 27001 certification find TISAX preparation significantly easier, with many controls directly transferable.