TISAX

A partner in the automotive supply chain asks you to show a defined level of information security management. TISAX is the way the industry does that once, and shares the result with every partner who asks. The VDA says the ISA catalogue defines the security requirements for companies across that chain. ENX says the catalogue is also used for a company’s own purposes and for assessing suppliers and service providers.

TISAX is an assessment with a label. ENX’s own words are assessment, assessment result and label. It is not a certificate in the ISO sense, so do not describe it as one to a customer. The label shows that an approved audit provider assessed a scope you defined, against the ISA catalogue, for the objectives you chose.

Not for the law. No EU rule on this site requires it. The trigger is a contract or a questionnaire from a partner. The ENX FAQ says some participants require it of their suppliers and sets no general duty.

Possibly for sales. Ask the partner which assessment objectives and which level it wants. ENX says business partners name the label level they need, and that the objective follows from the kind of information you handle for them. The answer decides the scope, the level and the audit provider’s quote.

You register your company as a participant with at least one scope. ENX confirms the registration and gives a participant ID, which you need before you can order an assessment. You then choose one of the audit providers that ENX approves, and they assess the scope and report to you. Each company is a participant for TISAX, and a company can both be assessed and ask partners for their results.

The scope says which locations, processes and information the assessment covers. It has to cover every part of the company that handles the partner’s information, or the result may not meet the partner’s requirement. The handbook says that once ENX has registered a scope you cannot change it yourself, so settle it before you ask for quotes.

The ENX FAQ lists ten assessment objectives that you can choose, and you pick at least one. They cover information protection levels, availability, prototype protection and personal data handled for a partner. Each objective gives you a label. The handbook sets the level for each objective, from a plausibility check at level 2 to full verification, with the provider on site, at level 3. It also says level 1 is a self-assessment that is not used in TISAX.

The handbook describes an optional level 2.5, a full remote verification that counts as level 2 and can later be raised to level 3. It also says a higher level always includes the lower ones.

A label shows that an assessment of a scope, by an approved audit provider, passed for an objective. The labels are visible in the ENX portal, and the handbook says they do not appear in the report. A temporary label equals a permanent one but has a shorter life, and a partner usually accepts it on condition that the permanent one follows.

A label does not show that you meet a law, or that the whole company is secure. It does not cover a site, process or system outside the scope. It does not say the audit provider is accredited in the way an ISO certification body is, because the ENX pages read for this guide say approved and name no accreditation. It is not public: by default only you see the result, and you decide which partners see which level of detail. You cannot take back a publication or a sharing once made.

ENX says the labels are generally valid for three years, and the handbook adds that this can be shorter after a major change of scope, such as a move or a new site. The handbook is not consistent about the start: one section says the period starts on the day of the closing meeting of the initial assessment, another at the end of the assessment process. Ask ENX which date your label carries.

Temporary labels apply when the result is minor non-conform, can be valid up to nine months after the closing meeting and cannot be renewed. A major non-conformity means no label until the issue is resolved. ENX recommends starting the renewal at least a year before the labels expire. The renewal runs the process again with a new scope and needs no new registration.

The assessment runs against the ISA catalogue, published by the VDA and maintained by an ENX working group. The VDA says it aligned the current catalogue with ISO/IEC 27001:2022 and that it covers prototype protection as well. ENX says ISA2027 applies to all assessments ordered from 1 January 2027, that ISA 6 applied to assessments ordered from 1 April 2024, and that existing labels keep their validity. The announcement does not say how orders on either side of the change are handled, so ask your audit provider which version applies to yours.

The ISA catalogue itself, the audit providers’ own terms, ENX fees and the full text of every handbook section were not read. The handbook read is version 2.8 of 13 March 2025, and the English text governs. The pages gave no list of approved audit providers and no statement on how ENX approves them. No price, time or duration is given here because no page read gave one. Check the current handbook and your partner’s requirement before you plan.