Prepare for your TISAX assessment with clear, evidenced controls

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's mechanism for assessing information security at suppliers and partners and sharing the results. It is operated by the ENX Association. Companies complete a self-assessment against the VDA ISA catalogue, an approved audit provider assesses them, and the results are issued as TISAX labels that the company can share with chosen partners through the ENX portal.

TISAX is not required by law, but it is often mandatory in practice. Vehicle manufacturers and other automotive customers write TISAX requirements into contracts and tenders, so a supplier without the required label may be unable to win or keep the work. The customer usually specifies which assessment objectives, and therefore which labels, it expects for the information or prototypes being shared.

VDA ISA 6.0.3 is a release of version 6 of the Information Security Assessment catalogue, dated 12 April 2023, used for TISAX assessments. It contains 45 information security controls, 22 prototype protection controls and 12 data protection controls. ISA 6 applies to TISAX assessments ordered from 1 April 2024 and is replaced by ISA2027 for assessments ordered from 1 January 2027.

TISAX uses assessment level 2 and assessment level 3. AL 2 is a plausibility check of the self-assessment, while AL 3 is a thorough assessment that includes on-site review. The level depends on the assessment objective: for example, Info high, Confidential and Data are AL 2, while Info very high, Strictly confidential, Proto parts, Proto vehicles and Special data are AL 3. AL 1 results are not used in TISAX.

A TISAX label is valid for three years. After that, if your partner still requires it, you go through the TISAX process again: registration, assessment and exchange. ENX has confirmed that the move to annual ISA catalogue releases, starting with ISA2027, does not shorten label validity or increase how often you need to be reassessed.

TISAX and ISO 27001 overlap heavily but are not interchangeable. Early ISA versions were based on ISO/IEC 27001, and ISA 6 references ISO 27001:2022, but the ISA has become an independent industry standard with automotive specific controls such as prototype protection. An ISO 27001 certificate does not replace a TISAX label, though an existing ISMS makes TISAX preparation much easier.

You get a TISAX label in three steps. First, register on the ENX portal and define your assessment scope and objectives. Second, complete the ISA self-assessment and have an ENX approved audit provider assess you at the required assessment level, closing any findings. Third, share the result with your partners through the ENX portal. There is no physical certificate; the label is the result.

Yes, on request. TISAX (VDA ISA 6) is mapped in OneClickComply's control library and can be enabled for your account. You can then track readiness against the ISA controls, collect evidence automatically from connected tools, generate policies and get guidance from our auditors. OneClickComply does not issue TISAX labels: those come only from an ENX approved audit provider.