TISAX: Information Security in the Automotive Industry

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's standard for information security in the supply chain. Developed by the ENX Association in collaboration with the German Association of the Automotive Industry (VDA), it is based on the VDA ISA (Information Security Assessment) questionnaire. TISAX enables suppliers to have their information security assessed once by an accredited auditor and share the result with multiple OEMs and Tier-1 suppliers through the ENX platform - without requiring a separate assessment for each customer. This makes TISAX the industry's equivalent of an ISO 27001 certification, but with automotive-specific extensions for prototype protection and connected car data.

A TISAX label is required by all companies acting as suppliers or service providers in the automotive industry that handle information requiring protection. This includes in particular: suppliers receiving prototype data, engineering drawings or vehicle designs; IT service providers operating systems for OEMs or Tier-1 suppliers; marketing agencies working with unreleased vehicle models; and all companies receiving a corresponding requirement from an OEM (BMW, Mercedes-Benz, Volkswagen, Stellantis, etc.). The requirement typically comes through supplier contracts or supplier portals. If your OEM customer requires TISAX, it is a contractual prerequisite for sensitive projects.

TISAX recognizes three Assessment Levels (AL) with increasing audit intensity: AL 1 (Self-Assessment with Plausibility Check): The supplier self-assesses against the VDA ISA; an accredited audit service provider checks the plausibility of the responses remotely. Used for normal information security requirements without elevated protection needs. AL 2 (Remote Assessment): An accredited audit service provider conducts a structured remote interview. This is the standard level for the majority of TISAX assessments with normal protection objectives (confidentiality, availability, integrity). AL 3 (On-Site Assessment): Complete on-site assessment by an accredited audit service provider. Mandatory for companies with high or very high protection requirements - particularly for prototype protection and processing highly sensitive vehicle data.

A TISAX assessment typically follows five phases: (1) Scope Definition and ENX Registration: The company defines the scope to be assessed (locations, systems, processes) and registers with the ENX Association. The assessment objective (e.g., information security, prototype protection, data privacy) and assessment level are also determined. (2) Self-Assessment: The company answers all relevant questions in the VDA ISA questionnaire and documents evidence. (3) Gap Analysis and Remediation: Unfulfilled requirements are identified and measures to close gaps are implemented. (4) Assessment by Accredited Audit Service Provider: Depending on the assessment level, a plausibility check, remote or on-site assessment is performed. (5) TISAX Label and Exchange: After a successful assessment, the TISAX label is stored in the ENX platform and can be selectively shared with customers.

TISAX assessment costs consist of several components: ENX registration fee (one-time, approx. EUR 200-500), audit service provider fees (depending on assessment level, scope and number of locations; typically EUR 3,000-15,000 for AL 2, EUR 8,000-30,000 for AL 3), and implementation consulting costs for preparation (varies widely by starting situation). Companies with an existing ISO 27001 ISMS typically have approximately 60-70% lower preparation effort since many requirements are already covered. AWARE7 provides an individual fixed-price proposal after a free initial assessment.

The VDA ISA (Information Security Assessment) is the questionnaire forming the basis of every TISAX assessment. Published by the German Association of the Automotive Industry (VDA) and regularly updated - VDA ISA 6.0 is currently valid (since 2024). The questionnaire is organized into three modules: (1) Information Security (mandatory module): Questions covering all fundamental security domains - organization, physical security, IT systems, identity management, cryptography, incident management, compliance. (2) Prototype Protection (optional module): Specific requirements for companies handling unreleased vehicle prototypes, parts or designs. (3) Data Privacy (optional module): GDPR-related requirements for processing personal data in the automotive context. Each question is rated on a 0-3 scale; for a TISAX label, all must-requirements (Maturity Level >= 3) and should-requirements (Maturity Level >= 2) must be fulfilled.

TISAX and ISO 27001 overlap by approximately 80% in their substantive requirements. ISO 27001 defines a general framework for an Information Security Management System (ISMS); TISAX concretizes and extends this for the specific needs of the automotive industry. An existing, certified ISO 27001 ISMS is the ideal basis for a TISAX assessment - many pieces of evidence can be directly reused. Conversely, a TISAX assessment does not cover all ISO 27001 requirements, as TISAX sets automotive-specific priorities (particularly prototype protection and the automotive supply chain). Companies pursuing both ISO 27001 and TISAX benefit from an integrated implementation approach that deliberately exploits synergies.

AWARE7 guides companies through the entire TISAX process: from the initial gap analysis against the VDA ISA through implementing identified measures to preparation for assessment by an accredited audit service provider. We specialize in leveraging synergies between ISO 27001 and TISAX - companies already pursuing or certified for ISO 27001 can meet both requirements simultaneously with our integrated approach. Our services include: VDA ISA self-assessment and gap analysis, action planning and implementation support, ISMS development with TISAX alignment, internal preparation for AL 2 and AL 3 assessments, and ongoing support through the three-year cycle.