MEET AUTOMOTIVE INDUSTRY INFORMATION SECURITY REQUIREMENTS

TISAX Assessment and Certification

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry’s standardized information security assessment framework. Developed by the VDA (German Association of the Automotive Industry) and administered by ENX Association, TISAX provides common recognition of security assessments throughout the global automotive supply chain. Our TISAX expertise guides organizations through assessment and certification across all levels.

Why TISAX Certification Matters

Supply Chain Requirement

Automotive OEMs and tier-1 suppliers increasingly mandate TISAX certification for supply chain partners. Without TISAX certification at the required level, you cannot participate in many automotive projects or access sensitive information necessary for component development.

Competitive Advantage

Industry-Wide Recognition

Understanding TISAX Requirements

VDA ISA Catalogue Foundation

TISAX assessments are based on the VDA Information Security Assessment (ISA) catalogue, building upon ISO/IEC 27001 with automotive-specific requirements. The catalogue addresses information security management, physical security, organizational security, technology security, and supplier relationships specific to automotive industry needs.

Assessment Objectives

TISAX assessments address multiple objectives based on client requirements:

INFORMATION SECURITY: CORE VDA ISA REQUIREMENTS FOR PROTECTING INFORMATION ASSETS
PROTOTYPE PROTECTION: ENHANCED PHYSICAL SECURITY FOR PRE-PRODUCTION VEHICLES AND COMPONENTS
DATA PROTECTION: GDPR ARTICLE 28 REQUIREMENTS FOR PERSONAL DATA PROCESSORS

Clients specify which objectives and assessment levels their suppliers require.

TISAX ASSESSMENT LEVELS

ASSESSMENT LEVEL 1 (AL1)

Self-assessment for internal purposes only. Organization evaluates its own controls against VDA ISA catalogue without external verification. Results cannot be shared with clients and don’t result in TISAX label. Limited applicability in automotive supply chain.

ASSESSMENT LEVEL 2 (AL2)

Self-assessment followed by remote plausibility check. Organization completes self-assessment, then TISAX audit provider conducts documentation review and remote interviews verifying plausibility. Results in shareable TISAX label. Suitable for low to medium protection needs.

ASSESSMENT LEVEL 3 (AL3)

Comprehensive on-site verification. Includes self-assessment, on-site audit with physical inspection, process observation, detailed interviews, and evidence review. Most rigorous level, required for high protection needs. Results in highest-confidence TISAX label.

Our Comprehensive TISAX Services

Gap Analysis and Readiness Assessment

We evaluate your current information security posture against TISAX requirements:

COMPREHENSIVE ASSESSMENT ACROSS ALL VDA ISA CONTROL
AREAS IDENTIFICATION OF GAPS AND NON-CONFORMITIES
PRIORITIZED REMEDIATION ROADMAP
RESOURCE REQUIREMENT ESTIMATION
REALISTIC TIMELINE DEVELOPMENT

ISMS Implementation

We help organizations implement information security management systems meeting TISAX expectations:

POLICY FRAMEWORK DEVELOPMENT
RISK ASSESSMENT AND TREATMENT PROCESSES
SECURITY CONTROL IMPLEMENTATION
DOCUMENTATION AND EVIDENCE PREPARATION
MANAGEMENT REVIEW MECHANISMS

Control Implementation

We support implementation of specific TISAX controls:

NETWORK SECURITY AND SEGMENTATION
ENCRYPTION FOR DATA PROTECTION
ACCESS CONTROL AND AUTHENTICATION
PHYSICAL SECURITY FOR PROTOTYPES AND SENSITIVE AREAS
SECURITY MONITORING AND LOGGING
INCIDENT DETECTION AND RESPONSE
SUPPLY CHAIN SECURITY MEASURES

Label Maintenance and Renewal

Three-Year Validity

TISAX labels are valid for three years. We establish ongoing compliance programs ensuring:

Continuous alignment with TISAX requirements
Monitoring for changes affecting certification
Periodic internal assessments
Label renewal and reassessment management

Scope Changes

Label scope may require updates when:

New sites or facilities are added
Business activities change significantly
Client requirements evolve
Additional assessment objectives are needed

Integration with ISO 27001

Leveraging Existing Certification

Organizations with ISO 27001 certification have foundational controls supporting TISAX:

Common ISMS framework and structure
Overlapping security controls
Similar documentation approaches
Aligned audit and review processes

We leverage ISO 27001 implementations to streamline TISAX preparation, addressing automotive-specific requirements efficiently while maintaining both certifications.

Prototype Protection

Enhanced Physical Security

Prototype protection objective requires stringent physical security:

Secured areas with access controls
Visitor management and escort procedures
Camera and photography restrictions
Prototype tracking and inventory
Transportation security
Disposal security for prototype materials

Balancing Security and Operations

We implement prototype protection controls that satisfy TISAX requirements while maintaining operational efficiency and collaborative development processes with automotive clients.

Data Protection Compliance

GDPR Article 28 Requirements

Data protection objective addresses processor obligations:

Processing agreements and documentation
Technical and organizational measures
Sub-processor management
Data subject rights procedures
Data breach notification processes
International data transfer safeguards

Achieve TISAX Certification Efficiently

TISAX certification protects your automotive business relationships and demonstrates information security commitment. Our automotive industry expertise ensures efficient certification and sustained compliance.

FAQ’s

What exactly is TISAX?

It is a maturity-based cybersecurity framework developed by the German Association of the Automotive Industry (VDA) and managed by the ENX Association. It allows automotive suppliers and service providers to demonstrate their information security capabilities to original equipment manufacturers (OEMs) through a single, shared assessment.

Is TISAX a legal requirement?

How does TISAX differ from ISO 27001?

What are the Assessment Levels (AL)?

How long is a TISAX label valid?

Latest Insights

All Articles →

DCC

DCC Is a Business Certification, Not an IT Au...

Defence Cyber Certification (DCC) is assessed on your whole organisation, not just your IT estate. Under Def Stan 05-138...

Cyber Security

10/10 CVSS on CVE-2026-109469: What We Know S...

What is CVE-2026-109469? CVE-2026-109469 is a critical, maximum-impact vulnerability in Microsoft Entra Device Registrat...

Cyber Security

Binance's $6.3 Billion Security Incident: Wha...

Binance, the world's largest cryptocurrency exchange, suffered a security incident on 29 October 2026 in which an estima...

Cyber Security

PHP2Shell: NCSC Warns UK Organisations to Pat...

On 21 October 2026 the NCSC told UK organisations to take immediate action on two critical PHP vulnerabilities, CVE-2026...

NHS DSPT

DSPT 9.5.11: Software Security Code of Practi...

Short answer: DSPT evidence item 9.5.11 is a new mandatory requirement for Category 2 IT suppliers in 2026-27. It requir...

NHS DSPT

Cyber Essentials Plus and ISO 27001 Help DSPT...

Which of the 102 Category 2 Evidence Items You Can Skip Short answer: Category 2 IT suppliers must evidence 102 mandator...

Cyber Security

Google Cloud Outage: What It Means for Your B...

On 20 October 2026, a fault in Google Cloud’s europe-west2 (London) region knocked out multiple services and disrupted o...

NHS DSPT

DSPT 4.5.6 Explained

The New MFA and Identity Federation Requirement for IT Suppliers Short answer: Evidence item 4.5.6 is a new mandatory re...