TISAX · VDA · automotive

A TISAX label for automotive suppliers — with a VDA ISA gap analysis, an ISMS and preparation for the assessment

OEMs require TISAX before they will share sensitive data categories. We take you through assessment level 2/3 — with templates, an ISMS and personal preparation for the assessment.

  • A named consultant — with automotive experience
  • Assessment Level 2/3 — matched to the OEM's requirement, your scope and your protection needs
  • ENX portal sharing — audited once, shared many times
  • Setup of your ISMS platform — set up to TISAX, subscription separate
Book a free appointment Send a short enquiry
notivia since 2003· +50 ISMS clients*· +20 Full-service projects*· Experience with VDA ISA, ISO 27001 & TISAX preparation· ★★★★★5.0

* Audit success relates to completed full-service certification projects since 2019.

Quick check

This page is for you if …

  • … an OEM or tier 1 requires TISAX of you.
  • … you supply Audi, BMW, Mercedes, Porsche or VW .
  • … you want to prepare for prototype or sensitive OEM data .
  • … you have to prepare for an assessment level (AL 1/2/3) .
  • … you want to know what TISAX compliance costs and how long it takes.
Our services for TISAX

Four building blocks. One route to compliance.

From the VDA ISA gap analysis to a successful TISAX assessment by an accredited audit provider — every building block under one roof.

Maximum support

Full-service support

We prepare your company for the TISAX assessment in a structured way — from the VDA ISA gap analysis through the evidence review to support during the assessment.

This suits you if you want TISAX compliance with as little internal project load as possible.
  • Gap analysis against VDA ISA 6.0
  • Implementing the controls for every objective
  • Internal pre-assessment
  • Support on the audit day
from €7,000 one-off (AL 2) · M from 14,000 € · L from 23,200 €for AL2 preparation · the external audit provider's assessment fee is not included · all prices exclude VAT
Request a quote
Ongoing

External security officer (TISAX)

An information security officer — who also looks after your OEM customers' requirements.

This suits you if you want to outsource the ongoing ENX upkeep and OEM reporting.
  • A contact for OEM requirements and TISAX evidence
  • ENX portal upkeep
  • Quarterly security reviews
  • Preparation for the re-assessment
from €500 / month
Enquire about consulting
12-month minimum term · 3 months' notice
One-off / yearly

Internal audit

An internal pre-audit ahead of the official TISAX assessment.

This suits you if you want your TISAX maturity verified before the audit.
  • A VDA ISA score for each control
  • A list of findings to work through
  • Action plan
  • A dress rehearsal from the auditor's view
from €3,400 one-off (pre-assessment)
Enquire about an audit
Self-service

Build it yourself

Build TISAX yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

Additionally for TISAX

Standard-specific extras — bookable individually

ENX portal registration

Registering in the ENX portal, agreeing the scope, setting up the sites.

from €490

Prototype protection package (AL 3)

Special documentation for prototype protection — an OEM requirement.

from €3,900

On-site assessment support

Our consultants are with you on the assessment day — the accredited TISAX audit provider carries out the assessment itself.

from €1,890/day
Ongoing TISAX / security officer support: 12-month minimum term · 3 months' notice to the end of the month · all prices exclude VAT.
Free initial assessment

A TISAX assessment in 30 minutes

Label 1, 2 or 3? An honest read on audit depth, effort and timeline — without obligation.

Lead consultant
Lead consultant
Your contact
  • A quick answer
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·A quick answer·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free TISAX check · 3 min

    Are you ready for TISAX?

    Maturity check on the ISO 27001 basis, prototype protection and data protection. Rate your TISAX maturity in 3 minutes.

    Start the check

    Or do it yourself

    The ISMS platform with its TISAX module

    The multi-standard ISMS digitalises the ISO 27001 base and the prototype and data protection modules — made for internal teams that want to document the TISAX requirements in a structured way.

    Explore the platform
    Guide · PDF

    TISAX guide for automotive suppliers

    What the VDA requires, which assessment levels exist, what OEMs expect — explained plainly.

    Download the guide
    The standard in brief

    What has to be in place for ISO 27001?

    Eight building blocks — the mandatory set for a TISAX label.

    1. The ISO 27001 base (all 93 Annex A controls)
    2. Prototype protection module (P module)
    3. Data protection module to GDPR (D module)
    4. Choosing the assessment level (AL 1/2/3)
    5. ENX portal registration & scope definition
    6. Preparing the self-assessment (VDA ISA)
    7. On-site audit support (accredited auditor)
    8. ENX publication & release to the OEM

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    WHO NEEDS TISAX?

    Does your company need a TISAX label?

    TISAX is not a legal duty but an industry requirement — yet without a TISAX label there is no business with many OEMs and tier 1 suppliers.

    Required Direct suppliers

    • Tier 1 and tier 2 suppliers to the OEMs
    • Engineering service providers with access to CAD and design data
    • IT service providers with access to OEM systems
    • Companies that handle prototype information

    Recommended Indirect partners

    • Logistics and transport providers
    • Tool and machine builders
    • Marketing agencies with pre-release vehicle data
    • Consultancies with confidential project data
    ASSESSMENT LEVELS

    Three levels — depending on how much protection is needed

    Which level you need depends on the kind of information you handle.

    1

    Assessment level 1

    A self-assessment against the VDA ISA catalogue. No external audit — for internal use only.

    Normal
    2

    Assessment level 2

    A plausibility check: a remote audit by an accredited TISAX audit provider.

    High
    3

    Assessment level 3

    A full on-site audit by an accredited audit provider. Required for prototype protection.

    Very high
    CORE REQUIREMENTS

    What TISAX asks of you

    The VDA ISA catalogue covers three objectives — plus optional modules.

    Information security

    The core module — based on ISO 27001

    • Security policies & organisation
    • Physical and logical access control
    • IT security & cryptography
    • Supplier management
    • Incident management

    Prototype protection

    An optional module for physical protection

    • Physical and environmental security
    • Test and development vehicles
    • Photography and filming
    • Visitor management
    • Camouflage & visual screening

    Data protection

    An optional module based on the GDPR

    • Data protection organisation
    • Record of processing activities
    • Data subject rights
    • Processing on behalf of a controller
    • Data protection impact assessment
    THE TISAX PROCESS

    From application to label in 5 steps

    1
    Preparation

    Register in the ENX portal

    Registering with the ENX Association, setting the objective (information security, prototype protection, data protection) and the assessment level.

    2
    Build the ISMS

    Self-assessment to VDA ISA

    Systematically working through every control question in the VDA ISA catalogue, identifying gaps and putting measures in place.

    3
    Audit preparation

    Documentation & evidence

    Documenting and assembling every policy, process and piece of evidence for the assessment.

    4
    Assessment

    Audit by the audit provider

    An accredited audit provider carries out the assessment (remotely or on site, depending on the level).

    5
    Result

    Receive the TISAX label

    On passing you receive your TISAX label — valid for 3 years and shareable through the ENX portal.

    OVERLAP

    ISO 27001 as the a strong basis for TISAX

    ISO 27001 is a strong basis for TISAX — but it does not replace the TISAX assessment. Many building blocks such as policies, access control, supplier management, incident management, physical security and internal audits can be reused. TISAX adds automotive-specific requirements such as the VDA ISA self-assessment, the ENX portal, prototype protection, the data protection module and customer-specific OEM requirements.

    TISAX / VDA ISACovered by ISO 27001
    Security policies & organisation ISO 27001 cl. 5 + A.5.1
    People security ISO 27001 A.6.1–A.6.8
    Physical security ISO 27001 A.7.1–A.7.14
    Identity & access management ISO 27001 A.8.1–A.8.5
    IT security & compliance ISO 27001 A.8.6–A.8.34
    Supplier relationships ISO 27001 A.5.19–A.5.23
    up to ~80 %
    already prepared by an ISO 27001 ISMS — depending on scope, assessment level and modules
    OUR SOLUTION

    Achieving TISAX with iso-easy

    1

    VDA ISA self-assessment

    Working systematically through every VDA ISA control question and establishing your maturity.

    2

    Gap analysis & measures

    Identifying the gaps and deriving concrete measures — with templates and recommendations.

    3

    Implement the ISMS

    Building an ISO 27001-based ISMS and adding the TISAX-specific requirements.

    4

    Pass the assessment

    Audit preparation, the document review and support through to the TISAX label.

    VDA ISA catalogue Gap analysis Risk management Document templates Supplier assessment Prototype protection

    Or do it yourself

    The ISMS platform for TISAX — and 10 further standards

    Digitalise TISAX prototype protection, assessment preparation and the VDA ISA catalogues in a multi-standard ISMS — made for teams with internal resources that want to maintain VDA ISA, prototype protection and evidence digitally.

    • Multi-standard ISMS
    • AI copilot & templates
    • Audit guide
    • Cancellable monthly

    from €249

    / month · Starter with 1 standard

    Explore the platform
    FAQ

    Frequently asked questions about TISAX

    What is TISAX?
    TISAX (Trusted Information Security Assessment Exchange) is an assessment and exchange mechanism for information security in the automotive industry. It is run by the ENX Association and is based on the VDA ISA catalogue (Information Security Assessment).
    Is TISAX a legal requirement?
    No, TISAX is not a legal duty. It is an industry requirement, though, and almost every large car maker (VW, BMW, Mercedes, Audi, Porsche and others) asks for it before working with you.
    Which assessment level do I need?
    That depends on your customer. Level 2 (remote) is enough for most suppliers. Level 3 (on site) is required if you work with prototype information or where protection needs are very high. Your OEM tells you which level is needed.
    Does ISO 27001 help with TISAX?
    Enormously. The VDA ISA catalogue is based on ISO 27001/27002 — around 80 % of the TISAX requirements are covered by a certified ISO 27001 ISMS. The remaining 20 % are automotive-specific additions (prototype protection, specific supplier requirements).
    How long does preparing for TISAX take?
    With our full service, typically 3–6 months, depending on where you start. If an ISO 27001 ISMS is already in place, the TISAX-specific additions can be done in 4–8 weeks.
    What does the TISAX assessment itself cost?
    The assessment by an accredited audit provider typically costs between €5,000 and €15,000 — depending on company size, number of sites and the assessment level chosen. Our full-service fee (from €14,000) covers the consulting that prepares you for it.
    How much internal work does this really mean for us?
    Conventional TISAX preparation swallows 30–60 person-days of internal time (self-assessment, documentation, audit preparation). With our approach plus the ISMS platform we bring that down to 15–25 person-days — because we set up most of the VDA ISA self-assessment, the document set and the audit preparation for you.
    Which assessment level (AL 1/2/3) applies to us?
    The level is set by the OEM or the customer. AL 1: self-declaration, low protection needs. Note: AL 1 does not usually produce a shareable TISAX label for customer requirements. AL 2: a plausibility check by an accredited auditor (the most common level). AL 3: an on-site audit, the highest protection needs (prototypes, for example). Our maturity check helps you work it out.
    What happens after the TISAX label? A re-assessment?
    TISAX labels are valid for 3 years. A re-assessment is needed before they expire. Significant changes (scope, site, data category) can make an additional assessment necessary. With our ISMS platform the self-assessment answers and the evidence stay current — which lowers the risk at re-assessment.
    Is ISO 27001 enough for TISAX?
    ISO 27001 covers around 80 % of the TISAX requirements — a very good base. But TISAX adds automotive-specific requirements: prototype protection (the P module), data protection (the D module) and ENX portal upkeep. With ISO 27001 in place, expect 20–30 % additional effort for full TISAX compliance — depending on scope and modules.
    Who audits TISAX, and how does the audit work?
    TISAX audits are carried out solely by accredited audit providers (DEKRA, TÜV NORD and TÜV SÜD, for example). The sequence: 1) register in the ENX portal and set the scope. 2) complete the self-assessment in the VDA ISA catalogue. 3) the audit by an accredited auditor (a plausibility check at AL 2, on site at AL 3). 4) publication in ENX. We are with you at every step.