the whole job

TISAX: the whole job, in order

A partner in the automotive supply chain asks you for a TISAX label. The label shows that an audit provider approved by the ENX Association assessed a scope you defined, against the VDA ISA catalogue, for the objectives you chose. It is an assessment and a label. It is not an ISO certificate and not compliance with a law. This plan takes you from the partner's request to the three-year cycle, in six stages.

last checked 2 November 2026

how to read this plan

TISAX asks for an assessment of how you handle a partner's information, so most steps set a scope, a level and the evidence. The ISA catalogue was not read for this plan, which is why every step says practice and no catalogue item is cited: take the requirements from the current catalogue. GDPR sits in the list of laws only because two assessment objectives cover personal data handled for a partner, and no article is cited. The order follows dependencies. Under each step a small note names the basis.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

find out what the partner needs

Learn which objectives, which level and which part of the company the partner's request means.

  1. ask the partner what it requires

    Ask each partner that raised TISAX which assessment objectives and which level it requires, whether it accepts a temporary label while you finish, and by when it wants the label. Record each answer with the date and the contact.

    • owner board
    • decide and document
    what it produces
    a list of partners, the objectives and level each requires and what each would accept
    the proof it leaves
    the list, with the source of each answer

    the work page

    basis working practice. No legal text sets this.

  2. map the information you handle for the partner

    List which partner information, prototypes or personal data you handle, where it sits and who touches it. The objective follows from the kind of information, so this list is what you check the requirement against.

    • owner head of IT
    • decide and document
    what it produces
    a list of the partner's information, systems, sites and people
    the proof it leaves
    the list, owned and dated

    the control: asset-inventory

    basis working practice. No legal text sets this.

  3. decide whether to go ahead

    Decide whether to be assessed now, later or not at all, and name an owner at management level. Weigh the contract at stake against the work and the audit provider's quote, once you have one.

    • owner board
    • decide and document
    what it produces
    a decision naming the owner and the objectives to pursue
    the proof it leaves
    the minutes of the decision

    basis working practice. No legal text sets this.

you are done with this phase when you can show the partner's written requirement, the objectives it implies and a board decision to go ahead or not.
02

define the scope and register

Write down what the assessment covers and register the company with ENX.

  1. define the scope in writing

    State the locations, processes and systems that handle the partner's information, and what is out. Cover every part that handles it, because a narrower scope may not meet the partner's requirement. Settle it before you ask for quotes, since ENX registers the scope and you cannot change it yourself afterwards.

    • owner board
    • decide and document
    what it produces
    a scope statement that names locations, processes, objectives and what is out
    the proof it leaves
    the statement, approved by management

    basis working practice. No legal text sets this.

  2. register as a participant

    Register the company with ENX, with its scope and contacts, and accept the participation terms. Someone who can bind the company must do it. You receive a participant ID, which you need to order an assessment.

    • owner legal or DPO
    • build and configure
    what it produces
    a registered participant with a participant ID
    the proof it leaves
    ENX's confirmation and the registered scope

    basis working practice. No legal text sets this.

  3. name the contacts and a lead

    Name the person who leads the assessment, the person who answers on information security and the people the audit provider will interview. Give them time for it.

    • owner head of IT
    • decide and document
    what it produces
    a named lead and a list of interviewees
    the proof it leaves
    the list, approved by management

    basis working practice. No legal text sets this.

you are done with this phase when you can show a registered participant and a written scope with its objectives.
03

check where you stand against the catalogue

Compare what you do with what the current ISA catalogue asks, and turn the differences into work.

  1. get the current catalogue and read it

    Download the current ISA catalogue from the VDA or ENX and give it to the lead. This plan did not read it. Ask the audit provider which catalogue version your order falls under.

    • owner head of IT
    • build and configure
    what it produces
    the catalogue version that applies, in the lead's hands
    the proof it leaves
    the version noted, with the date and the source

    basis working practice. No legal text sets this.

  2. self-assess against it

    Go through the catalogue for the objectives you need, with the people who run the systems, and mark what you meet, what you meet in part and what is missing. Keep to the scope. Work you did for ISO 27001 or for a law covers part of it.

    • owner head of IT
    • prove and operate
    what it produces
    a completed self-assessment with proof noted for each item
    the proof it leaves
    the self-assessment, dated and signed by the lead

    basis working practice. No legal text sets this.

  3. order the gaps into one plan of work

    Put the gaps in dependency order, give each an owner and a date, and decide what you will accept for now. Management approves the plan.

    • owner board
    • decide and document
    what it produces
    an ordered plan of work with owners and dates
    the proof it leaves
    the plan, approved by management

    basis working practice. No legal text sets this.

you are done with this phase when you can show a self-assessment and a gap list with an owner and an order of work.
04

close the gaps

Put the rules and controls in place for everything inside the scope, and keep the evidence.

  1. write the rules and name the roles

    Write the security policy and the rules the gap list calls for, name who decides and who carries what, and run the risk work for the scope. Record who accepted each risk.

    • owner board
    • build and configure
    what it produces
    a signed policy, a table of roles and a risk register for the scope
    the proof it leaves
    the documents with version and approval

    the work pagethe control: risk-register

    basis working practice. No legal text sets this.

  2. bring access and monitoring under control

    Build or fix who can reach the partner's information: access rights, reviews and logs. Write down for each control what it does and who runs it.

    • owner head of IT
    • build and configure
    what it produces
    access and logging controls running for the scope, with a short description of each
    the proof it leaves
    the descriptions and the settings or records that show each one working

    the work pagethe control: access-reviews

    basis working practice. No legal text sets this.

  3. set up incident handling and recovery

    Put in place how you detect, report and handle an incident that touches the partner's information, and how you restore from backup. Agree with the partner what it expects to be told.

    • owner head of IT
    • build and configure
    what it produces
    an incident procedure and a restore test record
    the proof it leaves
    the procedure and the test record

    the work pagethe control: incident-management

    basis working practice. No legal text sets this.

  4. bring suppliers and people into scope

    Sort the suppliers that touch the partner's information by what they can reach, and put terms in the contract. Train the people inside the scope and keep the record. For prototype protection, add the physical and handling rules the objective asks for.

    • owner procurement
    • build and configure
    what it produces
    a supplier register with contract terms, and a training record
    the proof it leaves
    the register, the answers received and the attendance record

    the work pagethe control: supplier-management

    basis working practice. No legal text sets this.

  5. close personal data duties where an objective needs them

    If you chose an objective for personal data handled for a partner, check your processor terms, records and security measures with your lawyer. A TISAX label for it is not compliance with GDPR.

    • owner legal or DPO
    • build and configure
    what it produces
    a note of what the objective needs and what your contracts and records show
    the proof it leaves
    the note and the contract terms it points to

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can show the rules, the registers and the controls running for the whole scope.
05

pass the assessment

Choose an audit provider, go through the assessment and deal with what it finds.

  1. choose an audit provider and agree the scope

    Ask several of the audit providers that ENX approves for a quote on your scope, objectives and level, and compare what each covers. Ask how the assessment proceeds and which catalogue version it uses, and get the answers in writing.

    • owner procurement
    • decide and document
    what it produces
    a chosen audit provider and a written offer for the scope
    the proof it leaves
    the offers and the written answers

    basis working practice. No legal text sets this.

  2. prepare the evidence and the people

    Gather the policies, registers, records and control evidence in one place organised by the catalogue, and brief the people who will be interviewed. An evidence map helps.

    • owner everyone
    • prove and operate
    what it produces
    an evidence folder and a list of interviewees
    the proof it leaves
    the folder, with each item dated

    the work page

    basis working practice. No legal text sets this.

  3. go through the assessment and answer the findings

    Give the audit provider access, answer what it asks and note every finding. For a minor finding, agree a corrective action plan, since a temporary label depends on it. For a major finding, fix the cause first, because no label follows until it is resolved.

    • owner everyone
    • prove and operate
    what it produces
    the assessment report, the finding responses and a corrective action plan
    the proof it leaves
    the report, the responses and the closing records

    basis working practice. No legal text sets this.

  4. read the labels and say what they cover

    Check in the ENX portal which labels you hold, for which scope, and when they expire. Use them as written when you answer a partner. Do not describe the label as a certificate or as compliance with a law.

    • owner legal or DPO
    • decide and document
    what it produces
    a short statement of what the labels cover, for sales and legal
    the proof it leaves
    the portal view and the statement

    basis working practice. No legal text sets this.

you are done with this phase when you can show the assessment report and the labels in the ENX portal.
06

share the result and renew

Give partners the result you choose, and renew before the labels expire.

  1. decide who sees the result

    By default only you see the result. Decide whether to publish to the TISAX community, share with a named partner or keep it private, and at which level of detail. A publication or a sharing cannot be revoked, so decide before you click.

    • owner board
    • decide and document
    what it produces
    a decision on publication and sharing, per partner
    the proof it leaves
    the decision and the portal settings

    basis working practice. No legal text sets this.

  2. set the renewal date and keep the system alive

    Put the expiry date of the labels in the calendar and start the renewal early, since ENX recommends beginning at least a year ahead. Keep the controls and the evidence current in between, and rerun the self-assessment when the scope changes.

    • owner everyone
    • prove and operate
    what it produces
    a renewal calendar and a yearly self-check
    the proof it leaves
    the calendar and the dated self-check

    basis working practice. No legal text sets this.

  3. report a change of scope

    When you move, add a site or change what you handle for a partner, decide whether the scope changes, and ask ENX and your audit provider what that does to the labels. The handbook says a major change can shorten their validity.

    • owner board
    • decide and document
    what it produces
    a scope change decision with its reason
    the proof it leaves
    the decision and the answer from ENX

    basis working practice. No legal text sets this.

you are done with this phase when you can show who sees what, and a renewal date in the calendar.

who carries what

The same steps, grouped by the person who has to act.

board

head of IT

legal or DPO

procurement

everyone

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Ask the partner who raised it which assessment objectives and which assessment level it requires, and write the answer down before you register.

    open the map