TISAX (Trusted Information Security Assessment Exchange) is an information security assessment and exchange mechanism developed by the German Association of the Automotive Industry (VDA) and managed by the ENX Association. It provides a standardized approach to evaluating information security in the automotive supply chain based on the VDA Information Security Assessment (ISA) criteria catalog. TISAX enables companies to share assessment results with partners through the ENX portal, eliminating the need for multiple individual audits from different OEMs.

TISAX is primarily required for companies in the automotive supply chain that handle sensitive information from OEM partners such as Volkswagen, BMW, Mercedes-Benz, and other European manufacturers. This includes Tier 1 and Tier 2 suppliers, engineering service providers, IT service providers, and any organization that processes confidential automotive data. If an OEM or partner requests TISAX compliance as a prerequisite for doing business, you need to complete the assessment at the level they specify.

What are the TISAX assessment levels?

TISAX defines three assessment levels. Assessment Level 1 (AL 1) is a self-assessment with no external verification and is rarely accepted by OEMs. Assessment Level 2 (AL 2) involves a remote plausibility check where an auditor verifies your self-assessment through interviews and documentation review. Assessment Level 3 (AL 3) is a comprehensive on-site assessment with full evidence examination and is the level most commonly required by major OEMs. The level required depends on the sensitivity of the information you handle and your partners' specific requirements.

How much does TISAX assessment cost?

Total TISAX costs typically range from $30,000 to $150,000 depending on the assessment level, number of locations, and current security maturity. Cost components include ENX registration and annual fees ($3K-$8K), audit provider fees ($15K-$60K depending on scope and level), consulting and readiness support ($10K-$50K), and internal remediation costs. Organizations with multiple sites or prototype protection requirements will trend toward the higher end. Companies with existing ISO 27001 certification can leverage that work to reduce TISAX implementation costs.

How long does TISAX assessment take?

The complete TISAX process from registration to receiving labels typically takes 6-12 months. This includes ENX registration (1-2 weeks), self-assessment and gap analysis (3-4 weeks), control implementation and remediation (2-4 months), assessment preparation (2-3 weeks), the formal assessment (2-4 weeks), and result processing (2-4 weeks). Organizations with mature security programs and existing ISO 27001 certification can often complete the process in 4-6 months. Those starting from scratch should plan for the full 12 months.

What is the VDA ISA catalog?

The VDA Information Security Assessment (ISA) is the criteria catalog that forms the basis for TISAX assessments. It is maintained by the German Association of the Automotive Industry (VDA) and contains control areas covering information security management, human resources security, physical security, identity and access management, IT security, supplier relationships, and compliance. The catalog uses a maturity model scored from 0 to 5, where Level 3 (established process) is typically the minimum required for most controls. The ISA is updated periodically to reflect evolving security requirements in the automotive industry.

Your Step-by-Step Guide to TISAX Assessment & Compliance

TISAX

The Complete TISAX Compliance Checklist

TISAX is the trusted information security assessment standard for the automotive industry. This checklist guides you through the ENX registration process, VDA ISA self-assessment, control implementation, and achieving your TISAX label from an approved audit provider.

Get Expert Help

Understanding TISAX

What Is TISAX — and Why Does It Matter?

TISAX (Trusted Information Security Assessment Exchange) is an assessment and exchange mechanism for information security in the automotive industry, established by the German Association of the Automotive Industry (VDA).

TISAX provides a standardized approach to information security assessments based on the VDA Information Security Assessment (ISA) catalog, which is derived from the ISO/IEC 27001 standard but tailored specifically for the automotive industry.

The primary goal of TISAX is to ensure mutual recognition of information security assessments among participants in the automotive industry, reducing redundant assessments and establishing a common security level across the supply chain.

Assessment Levels

VDA ISA

Catalog

3-Year

Validity

Your Roadmap

The 8-Step TISAX Compliance Checklist

Click each step to expand the details. Work through them in order — each step builds on the previous one.

Step 1

1 week

Determine Assessment Level

Understand which assessment level your partners require

TISAX defines three assessment levels with increasing rigor. Assessment Level 1 (AL 1) is a self-assessment only. AL 2 includes a plausibility check by an auditor. AL 3 is a comprehensive on-site assessment. Your OEM partners will specify which level they require, with AL 3 being the most common for suppliers handling confidential data.

Key Actions:

Review your OEM partner requirements to determine the required assessment level

Understand AL 1: self-assessment with no external verification (rarely accepted by OEMs)

Understand AL 2: self-assessment verified through remote interviews and evidence review

Understand AL 3: comprehensive on-site audit with full evidence examination (most commonly required)

Determine the assessment objectives: Information Security, Prototype Protection, or Data Protection

Identify all locations and sites that need to be included in the assessment scope

Helpful Resources:

Learn about TISAX Get TISAX guidance

Step 2

1 week

Register on ENX Portal

Create your participant account on the ENX platform

The ENX portal is the central platform for TISAX registration, assessment management, and result sharing. Registration initiates the formal TISAX process and gives you access to select an approved audit provider and manage your assessment lifecycle.

Key Actions:

Navigate to the ENX portal and create your participant registration

Provide required organizational information including company details, locations, and contact persons

Select the assessment scope: which sites and objectives (information security, prototype protection, data protection) are included

Specify the required assessment level based on your partner requirements

Pay the ENX registration and management fees (annual fees apply)

Familiarize yourself with the ENX portal functionality for assessment management and result sharing

Helpful Resources:

Get registration help ENX Portal

Step 3

1-2 weeks

Select Audit Provider

Choose an ENX-approved audit provider for your assessment

TISAX assessments must be conducted by audit providers approved by the ENX Association. Select a provider with experience in your industry segment and the capacity to conduct the assessment within your desired timeline.

Key Actions:

Review the list of ENX-approved audit providers on the ENX portal

Request proposals from multiple providers evaluating experience, methodology, timeline, and cost

Consider providers with specific expertise in your automotive segment (OEM, Tier 1, Tier 2)

Confirm the provider can assess all required objectives and locations within your timeline

Negotiate the engagement terms including assessment schedule, evidence requirements, and deliverables

Formalize the engagement and share your self-assessment results with the selected provider

Helpful Resources:

Get audit provider recommendations

Step 4

3-4 weeks

Conduct VDA ISA Self-Assessment

Evaluate your current state against the VDA ISA catalog

The VDA Information Security Assessment (ISA) is the criteria catalog used for TISAX assessments. Conduct a thorough self-assessment against all applicable ISA criteria to understand your current maturity level and identify gaps that need remediation.

Key Actions:

Download the latest VDA ISA criteria catalog from the VDA website

Assess your organization against each ISA control area using the maturity model (0-5 scale)

Evaluate controls across all ISA modules: information security, prototype protection (if applicable), and data protection (if applicable)

Identify controls where your maturity level falls below the minimum required level (typically 3 for most criteria)

Document your current maturity scores, evidence, and justifications for each control

Produce a gap analysis report identifying all areas requiring remediation before the formal assessment

Helpful Resources:

Get self-assessment guidance VDA ISA Catalog

Step 5

2-4 months

Implement Required Controls

Close gaps and achieve target maturity levels

Implement the controls and improvements identified in your self-assessment gap analysis. The VDA ISA uses a maturity model where most controls require at least Level 3 (established process) to pass the assessment. Focus remediation on the highest-risk gaps first.

Key Actions:

Implement information security controls including access management, cryptography, and network security

Establish incident management and business continuity capabilities aligned with ISA requirements

If prototype protection is in scope, implement physical and digital protections for pre-production materials

If data protection is in scope, implement GDPR-aligned privacy controls and data processing documentation

Deploy monitoring, logging, and vulnerability management processes

Ensure all controls reach at least the minimum required maturity level with documented evidence

Helpful Resources:

Get implementation support

Step 6

2-3 weeks

Prepare for External Assessment

Organize evidence and brief your team

With controls implemented and gaps remediated, prepare your organization for the external assessment. This includes organizing evidence, briefing staff who will participate in interviews, and ensuring your documentation is complete and current.

Key Actions:

Organize all evidence mapped to VDA ISA control areas in an accessible repository

Ensure policies, procedures, and technical documentation are current and approved

Brief staff members who will participate in assessor interviews on the assessment process and their responsibilities

Conduct a mock assessment or internal review to identify any remaining weaknesses

Verify that all locations in scope are prepared for on-site assessment visits (AL 3)

Confirm logistics with the audit provider including dates, access requirements, and interview schedules

Helpful Resources:

Get assessment preparation help

Step 7

2-4 weeks

Complete TISAX Assessment

Undergo the formal assessment by your ENX-approved audit provider

The formal TISAX assessment evaluates your information security posture against the VDA ISA criteria. For AL 3, this includes an on-site audit with documentation review, staff interviews, and physical inspections. The assessor scores each control and produces a formal assessment report.

Key Actions:

Support the assessor during the documentation review phase by providing all requested evidence promptly

Participate in assessor interviews, demonstrating knowledge of policies and procedures

Facilitate on-site inspection of physical security controls, server rooms, and prototype areas (if applicable)

Review preliminary findings with the assessor and clarify any misunderstandings

Address any major nonconformities identified during the assessment, as these must be resolved before labels are granted

Minor nonconformities may be accepted with a corrective action plan and timeline for remediation

Helpful Resources:

Get assessment support

Step 8

1-2 weeks

Share Results via ENX Portal

Receive your TISAX label and share with partners

Once the assessment is complete and any major findings are resolved, your TISAX labels are published on the ENX portal. You can then share your results with OEM partners and other organizations through the portal's controlled sharing mechanism. Labels are valid for three years.

Key Actions:

Receive your TISAX assessment results and labels through the ENX portal

Review the labels granted to confirm they match the objectives and assessment level required by your partners

Configure result sharing on the ENX portal to grant access to your OEM partners and customers

Communicate your TISAX status to relevant business contacts and update marketing materials

Implement corrective actions for any minor nonconformities within the agreed timelines

Plan for the three-year reassessment cycle and maintain controls effectiveness through ongoing monitoring

Helpful Resources:

Get ongoing compliance support TISAX framework details

Feeling overwhelmed? You don't have to do this alone.

Get Expert Help Learn More About TISAX

Budget Planning

What TISAX Compliance Actually Costs

Transparent cost ranges so you can plan and budget. Costs vary based on organization size, current security posture, and environment complexity.

Typical Cost Range

$30K - $150K

Including preparation, tooling, and assessment fees

Timeline to Compliance

6-12 months

Depending on current maturity and scope

Audit & Assessment

TISAX assessments are conducted by ENX-approved audit providers using the VDA ISA criteria catalog. Results are shared exclusively through the ENX portal. TISAX labels are valid for three years, after which a reassessment is required. The assessment level (AL 1-3) determines the rigor of the evaluation.

Independent verification of your compliance

Costs People Forget

GRC platform licensing

Compliance management and evidence collection tools

Security tooling

SIEM, EDR, vulnerability scanning, encryption tools

Internal staff time

Hundreds of hours across IT, security, and leadership

Ongoing maintenance

Annual reviews, continuous monitoring, recertification

The ROI of Compliance

The cost of non-compliance far exceeds the investment in getting certified. Consider what's at stake:

Win new business and contracts that require certification

Reduce breach risk and avoid costly incident response

Build trust with customers, partners, and stakeholders

Avoid regulatory penalties and reputational damage

Streamline operations with mature security processes

The question isn't whether you can afford compliance — it's whether you can afford not to have it.

How We Can Help

Don't Navigate TISAX Alone

Illumen specializes in helping organizations achieve TISAX compliance — from initial assessment through certification. We meet you wherever you are in the journey.

Gap Assessment

Know exactly where you stand against requirements

Remediation

Close gaps with expert guidance and support

Documentation

Policies, procedures, and evidence packages

Schedule a Free Consultation Explore TISAX Services

FAQ

Frequently Asked Questions

Common questions about TISAX compliance and certification.

The Complete TISAX Compliance Checklist

What Is TISAX — and Why Does It Matter?

Assessment Levels

VDA ISA

Catalog

3-Year

Validity

Don't Navigate TISAX Alone

Illumen specializes in helping organizations achieve TISAX compliance — from initial assessment through certification. We meet you wherever you are in the journey.

Gap Assessment

Know exactly where you stand against requirements

Remediation

Close gaps with expert guidance and support

Documentation

Policies, procedures, and evidence packages

The Complete TISAX Compliance Checklist

What Is TISAX — and Why Does It Matter?

The 8-Step TISAX Compliance Checklist

Determine Assessment Level

Key Actions:

Helpful Resources:

Register on ENX Portal

Key Actions:

Helpful Resources:

Select Audit Provider

Key Actions:

Helpful Resources:

Conduct VDA ISA Self-Assessment

Key Actions:

Helpful Resources:

Implement Required Controls

Key Actions:

Helpful Resources:

Prepare for External Assessment

Key Actions:

Helpful Resources:

Complete TISAX Assessment

Key Actions:

Helpful Resources:

Share Results via ENX Portal

Key Actions:

Helpful Resources:

What TISAX Compliance Actually Costs

Don't Navigate TISAX Alone

Gap Assessment

Remediation

Documentation

Frequently Asked Questions

What is TISAX?

Who needs TISAX?

What are the TISAX assessment levels?

How much does TISAX assessment cost?

How long does TISAX assessment take?

What is the VDA ISA catalog?

The Complete TISAX Compliance Checklist

What Is TISAX — and Why Does It Matter?

The 8-Step TISAX Compliance Checklist

Determine Assessment Level

Key Actions:

Helpful Resources:

Register on ENX Portal

Key Actions:

Helpful Resources:

Select Audit Provider

Key Actions:

Helpful Resources:

Conduct VDA ISA Self-Assessment

Key Actions:

Helpful Resources:

Implement Required Controls

Key Actions:

Helpful Resources:

Prepare for External Assessment

Key Actions:

Helpful Resources:

Complete TISAX Assessment

Key Actions:

Helpful Resources:

Share Results via ENX Portal

Key Actions:

Helpful Resources:

What TISAX Compliance Actually Costs

Don't Navigate TISAX Alone

Gap Assessment

Remediation

Documentation

Frequently Asked Questions

What is TISAX?

Who needs TISAX?

What are the TISAX assessment levels?

How much does TISAX assessment cost?

How long does TISAX assessment take?

What is the VDA ISA catalog?