certification
TISAX
An information security assessment for the automotive supply chain, run by the ENX Association on the VDA ISA catalogue. No law requires it. Car makers and their suppliers ask for the label, and it is valid for three years.
at a glance
- what it is
- An assessment and exchange mechanism run by the ENX Association, on the VDA ISA catalogue. ENX speaks of assessments, results and labels.
- who asks
- A business partner in the automotive supply chain, in its contract. No law sets it.
- who assesses
- An audit provider that ENX approves. You choose one after you register as a participant.
- what you get
- A report and TISAX labels for the assessment objectives you passed, for a scope you define.
- validity
- ENX says the labels are generally valid for three years. Temporary labels last up to nine months.
basis ENX TISAX page; TISAX Participant Handbook v2.8, sections 5.4.9.4 and 5.4.14.2
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my ruleshow a tisax assessment runs
- 1registerthe company becomes a participant and defines a scope and objectives
- 2assessan audit provider approved by ENX assesses that scope
- 3get labelsa passed assessment gives the labels for the objectives
- 4exchangeyou decide which partners see the result in the ENX portal
the labels are generally valid for three years, and ENX recommends starting the renewal a year before they expire
basis ENX TISAX page; TISAX Participant Handbook v2.8, sections 3, 5.4.14.2 and 5.4.14.3
the objective sets the assessment level
- self-assessment only
- plausibility check
- full verification
basis TISAX Participant Handbook v2.8, sections 4.3.3.1 and 4.3.3.5, tables 5 and 6
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- find out what the partner needs
Learn which objectives, which level and which part of the company the partner's request means.
- define the scope and register
Write down what the assessment covers and register the company with ENX.
- check where you stand against the catalogue
Compare what you do with what the current ISA catalogue asks, and turn the differences into work.
- close the gaps
Put the rules and controls in place for everything inside the scope, and keep the evidence.
- pass the assessment
Choose an audit provider, go through the assessment and deal with what it finds.
- share the result and renew
Give partners the result you choose, and renew before the labels expire.
what a certificate does and does not show
Read this before a customer asks you for one.
car makers and their suppliers, when a customer asks for the label
an assessment by an approved audit provider against the VDA information security catalogue, and a label on the ENX platform
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
the long read
The full explanation, section by section, with the sources.