Question 1

What is TISAX and who needs it?

Accepted Answer

TISAX (Trusted Information Security Assessment Exchange) is an automotive industry standard for information security. It's required by German OEMs (VW, BMW, Mercedes, etc.) and increasingly by global automotive manufacturers for their suppliers handling sensitive information or prototypes.

Question 2

What are TISAX assessment levels?

Accepted Answer

AL1 is a self-assessment for internal use only. AL2 is a remote audit by an accredited provider for high protection needs. AL3 is an on-site audit required for very high protection needs, prototype handling, or special category data processing.

Question 3

What are TISAX labels?

Accepted Answer

TISAX labels indicate what you're certified for: Information Security (High/Very High), Prototype Protection (Parts, Vehicles, Test Vehicles, Events), and Data Protection (Standard/Special Categories). Your OEM customer will specify which labels you need.

Question 4

How long does TISAX certification take?

Accepted Answer

Typically 6-12 months from start to certification, depending on your current security posture. The assessment itself takes 1-3 days. Results are valid for 3 years and shared via the ENX portal with your automotive customers.

Question 5

What is the difference between TISAX and ISO 27001?

Accepted Answer

TISAX is based on VDA ISA (which incorporates ISO 27001 controls) but adds automotive-specific requirements for prototype protection and data privacy. Many controls overlap, so ISO 27001 certified organizations have a head start on TISAX.

TISAX Assessment Scoping

TISAX Assessment Scoping