Automotive Information Security Assessment (TISAX)

TISAX (Trusted Information Security Assessment Exchange) is a mechanism enabling mutual recognition of information-security assessments in the automotive sector. It is based on the VDA ISA question catalogue. It is NOT a certification scheme: the outcome is a TISAX label, not a certificate, and the label is shared through the ENX portal. The aim is to prevent every OEM from auditing the same supplier separately.

• Suppliers receiving prototype, design data or personal data from OEMs
• Firms providing automotive engineering and design services
• Organisations manufacturing prototype parts and carrying out testing
• Automotive software and IT service providers

Not mandatory; it is effectively required in OEM and Tier 1 contracts. The assessment level (AL 1, 2, 3) is determined by the protection needs of the information processed: AL 2 is remote/document-based, while AL 3 includes an on-site audit and a deeper review of evidence.

• VDA ISA — Information security: policy, organisation, asset management, access control, cryptography, physical security, operations security, communications, supplier relationships, incident management, continuity, compliance
• VDA ISA — Prototype protection: physical and environmental security, access management, transport, and protection during testing and events
• VDA ISA — Data protection: additional requirements for processing personal data (related to GDPR alignment)
• Maturity-level scoring and meeting the target maturity
• Determining the assessment level (AL 1/2/3)
• Registration on the ENX portal, defining the scope, and sharing the label

1. 1Determining Scope and ProgrammeThe sites and processes to be audited, and the audit duration the scheme requires, are determined.
2. 2Pre-assessmentA gap analysis is optionally carried out; gaps become visible before the main audit.
3. 3On-site AuditRecords review, site observation and worker interviews are carried out against the scheme's checklist.
4. 4Reporting of FindingsFindings are reported according to the scheme's classification. The output of these schemes is an audit report, not a certificate.
5. 5Corrective Action and Follow-upA corrective action plan is submitted for the findings; it is closed with a follow-up audit under the scheme.

The validity period of audit reports is set by the scheme and is mostly between one and two years. The report is used for the period the buying brand accepts.

• Organisation and site details
• Headcount and shift pattern
• Legal permits and licences
• Relevant policies and procedures
• Payroll, time and personnel records

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The number of sites to be audited and the headcount
• The audit duration the scheme prescribes
• Whether a pre-assessment (gap analysis) is requested
• Whether a follow-up audit is required

Most of these schemes produce audit reports, not documents, and are subject to the scheme owner's (e.g. Sedex, amfori, RBA) own approval system; Accreditation in the classical sense is not found in every scheme. Auditor competence and report validity are determined by the scheme owner's rules.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• ISO 26262Functional Safety
• ISO/SAE 21434Vehicle Cybersecurity
• SOC 1Financial Reporting Controls
• SOC 2Service Organization Trust Controls
• PCI DSSPayment Card Data Security
• IATF 16949Automotive Quality Management
• VDA 6.1Automotive Quality Management System Audit
• VDA 6.3Process Audit