Trusted Information Security Assessment Exchange (TISAX)
What is TISAX?TISAX (Trusted Information Security Assessment Exchange) is a mechanism for assessing and mutually recognising information security assessment results within the automotive industry.
TISAX was developed on the initiative of the German Association of the Automotive Industry (VDA) and is operated by the ENX Association. Its primary purpose is to provide a common approach to assessing the information security of organisations within the automotive supply chain and to enable the results of a single assessment to be recognised by multiple manufacturers and business partners.
TISAX assessments are conducted against the VDA Information Security Assessment (VDA ISA) catalogue, which contains information security requirements tailored to the specific needs of the automotive industry. The catalogue draws on ISO/IEC 27001 and supplements it with sector-specific requirements.
It is important to note that TISAX is not a certification scheme. Following the successful completion of an assessment, the relevant TISAX Labels are issued. Participants can share their assessment results with selected manufacturers and other authorised organisations through the ENX platform.
Who is TISAX intended for?
TISAX is intended for manufacturers, suppliers, subcontractors and service providers in the automotive industry that process sensitive information related to the development, production and maintenance of automotive products and services.
In many cases, holding an appropriate TISAX Label is a prerequisite for participating in projects with automotive manufacturers and their suppliers.
How does the TISAX assessment process work?
The process typically includes the following stages:
- registration on the ENX platform
- definition of the assessment scope
- selection of the applicable assessment objectives and the required assessment level
- preparation for the assessment
- assessment by an approved TISAX Assessment Provider
- issuance of the applicable TISAX Labels and availability of the assessment results for controlled sharing through the ENX platform
Main assessment areasThe VDA ISA catalogue covers requirements in several key areas, including:
- information security management
- risk management
- information classification and protection
- access management
- cryptographic controls
- physical security
- IT infrastructure security
- supplier management
- incident management
- business continuity
- data protection
- Prototype Protection, where applicable.
What are the benefits of TISAX?
Successful completion of a TISAX assessment demonstrates that an organisation applies a systematic approach to information security management and meets the applicable information security requirements of the automotive industry.
The main benefits include:
• easier fulfilment of automotive manufacturers’ information security requirements;
• reduced need for multiple customer assessments;
• increased trust among customers and business partners;
• improved management of information security risks;
• a stronger competitive position when pursuing new business opportunities.
Update: VDA ISA2027
In 2026, VDA released VDA ISA2027, the new edition of the information security assessment catalogue. It will become mandatory for all TISAX assessments ordered from 1 January 2027 and introduces a number of changes relating to updated reference standards, supply chain security, the Prototype Protection module and other areas.
More information about the key changes is available in our news article: “VDA Releases the VDA ISA2027 Catalogue.”
Trusted Information Security Assessment Exchange (TISAX)
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
