TISAX Readiness Check
How close are you to the label?
20 questions, 5 categories, 3 minutes. Find out whether your company meets the automotive industry's TISAX requirements.
Understanding TISAX — before you go into the assessment
TISAX (Trusted Information Security Assessment Exchange) is the proof of information security used in the automotive industry. It is operated by the ENX Association and its content rests on the VDA ISA catalogue of requirements. The decisive difference from ISO 27001: TISAX is not a certification but a label, whose result you share with selected customers. The check above estimates how close you are to being ready for assessment.
Assessment level: AL2 or AL3?
The level is not yours to choose — it follows from the protection needs of the information you handle. Your customer normally states which assessment objective they expect.
| Level | Typical trigger | Depth of assessment |
|---|---|---|
| AL2 | Information with high protection needs | Plausibility check: self-assessment plus evidence and interviews, mostly remote |
| AL3 | Information with very high protection needs, prototype protection | In-depth assessment with an on-site visit and sample testing of effectiveness |
Besides the classic objective of information security there are others — for instance prototype protection (with its own, very concrete structural and organisational requirements) and data protection. Prototype protection is regularly assessed at AL3.
The most common mistake: booking the assessment too early. Assessment providers have lead times, and an assessment with many deviations means remediation plus a follow-up appointment. Filling in the self-assessment honestly and closing the gaps first is faster and cheaper in the end.
How TISAX works
- Registration with the ENX Association — you decide which sites and which objectives are assessed.
- Self-assessment against the VDA ISA catalogue. You rate every requirement by maturity level.
- Assessment by an approved assessment provider — your choice, not ENX's.
- Action plan where there are deviations, followed by a re-assessment.
- Label — valid for three years; you release the results to your customers through the ENX portal.
Maturity levels instead of yes or no
The VDA ISA does not score “met / not met” but maturity levels. The target is usually level 3 — that is, an established, documented process. Doing something is not enough; it has to be defined, traceable and repeatable.
How to read your result
- Not yet ready for assessment — basics such as policies, risk management and evidence are missing. Expect several months of lead time.
- Partly prepared — much of it is lived practice but not documented. That is exactly what costs points in the assessment.
- Largely ready for assessment — you can tackle the self-assessment and approach an assessment provider.
The check is a self-estimate and is no substitute for the VDA ISA self-assessment.
How it relates to ISO 27001
The VDA ISA follows ISO 27001 closely but goes beyond it in places — notably on prototype protection and on very concrete physical requirements. If you are certified to ISO 27001 a good part is done, but you still have to add the automotive-specific requirements. The reverse also holds: a TISAX label is not an ISO 27001 certification, and outside the industry it is barely recognised.
Common questions about TISAX
Is TISAX a certification?
No. TISAX awards a label, not a certificate. The results are not published but shared through the ENX portal with the partners you choose. That is a deliberate difference from ISO 27001.
How long is a TISAX label valid?
Three years. After that a new assessment is required. Unlike ISO 27001 there are no annual surveillance audits.
Can we choose the assessment level?
No. The level follows from the protection needs of the information you handle, and therefore usually from what your customer requires. If you handle prototype data you will regularly end up at AL3.
Do we need ISO 27001 certification first?
No, it is not a prerequisite. An existing ISMS does speed up preparation considerably, because the overlap in content is large.
What does TISAX cost?
The cost is the ENX registration fee plus the assessment provider's fee, and depends on the level, the number of sites and the objectives. The larger item is usually your own internal effort in preparing.
Does the label cover the whole company?
No — it is tied to a site and an objective. If your customer takes services from another site, that site normally has to be assessed in its own right.
