Assessed once.
Recognized everywhere.
TISAX is the automotive industry's standard for information security. If your OEM customers require it, you need it. We guide you from first gap analysis through successful assessment and label exchange — with IT infrastructure that stays compliant long after the auditor leaves.
The automotive industry's
trust standard
TISAX (Trusted Information Security Assessment Exchange) is governed by the ENX Association and built on the VDA Information Security Assessment (ISA) catalogue — itself based on ISO/IEC 27001. It provides a standardized way for automotive companies to prove their information security posture to OEM customers and supply chain partners.
Instead of every OEM running their own security audit of every supplier, TISAX lets you get assessed once by an accredited audit provider and share those results with any partner through the ENX Portal. Over 20,000 locations worldwide now hold valid TISAX labels.
Who Needs TISAX?
Three levels of
assessment depth
Your required assessment level depends on the sensitivity of information you handle. We help you determine the right scope and prepare accordingly.
Self-Assessment
Internal self-assessment based on VDA ISA. No external audit required. Suitable for companies handling normal information with lower sensitivity. Results are not shared on the ENX Portal.
Normal Assessment
Remote or on-site assessment by an accredited audit provider. Required for handling confidential information — the most common level for automotive suppliers. Plausibility checks and evidence review.
High Assessment
Comprehensive on-site assessment with in-depth verification. Required for strictly confidential information, prototype protection, or data from multiple OEMs. Full evidence audit with interviews and inspection.
What the assessment covers
The VDA Information Security Assessment is structured around key security domains. We help you implement controls across all of them.
| Domain | Key Controls | What We Do |
|---|---|---|
| Information Security Policies | ISMS framework, management commitment, policy documentation | Draft and implement your full ISMS policy set |
| Human Resources | Security awareness, training, onboarding/offboarding | Build training programs and procedures |
| Access Control | Identity management, MFA, privileged access, least privilege | Configure and audit access controls across all systems |
| Physical Security | Facility access, visitor management, clean desk, secure areas | Assess and recommend physical control improvements |
| Cryptography | Encryption at rest and in transit, key management | Implement encryption across storage, email, and network |
| Operations Security | Change management, malware protection, logging, monitoring | Deploy endpoint security, SIEM, and patch management |
| Network Security | Segmentation, firewalls, intrusion detection, remote access | Design and implement compliant network architecture |
| Supplier Management | Third-party risk, supplier agreements, monitoring | Establish vendor security assessment processes |
| Incident Management | Response plans, escalation, forensics, lessons learned | Create and test incident response procedures |
| Business Continuity | BCP, disaster recovery, backup testing | Design and validate backup and DR strategies |
| Prototype Protection | Physical and digital prototype controls (if applicable) | Implement secure storage, access logging, and handling procedures |
How we get you
through the audit
From initial scoping to label exchange on the ENX Portal — we walk with you through every step. No surprises on audit day.
Scope & Gap Analysis
We assess your current state against every VDA ISA control. You get a clear report of what's compliant, what's close, and what needs work — with effort estimates for each gap.
Remediation Plan
We build a prioritized roadmap to close every gap. Quick wins first, then the structural changes. Policies, technical controls, training — all mapped to your timeline and budget.
Implementation
We do the work — deploy technical controls, write policies, configure systems, train staff, and build the evidence documentation the auditor will ask for. Not just consulting. Execution.
Pre-Audit Review
Internal mock assessment against the full VDA ISA catalogue. We simulate the audit experience, identify any remaining weaknesses, and ensure your evidence package is complete and organized.
Audit Support
We're on-site (or on-call) during your TISAX assessment. We help present evidence, answer technical questions, and coordinate with the audit provider so nothing falls through the cracks.
Label & Maintenance
Once you receive your TISAX label, we help you share results on the ENX Portal and maintain compliance through the 3-year validity period. Continuous monitoring, annual reviews, and re-assessment preparation.
Not just consulting.
We do the work.
Most TISAX consultants hand you a gap report and wish you luck. We implement the fixes, build the infrastructure, and sit next to you during the audit.
Gap Assessment
Full VDA ISA-aligned assessment of your current security posture. Every control reviewed, every gap documented, every finding rated by severity and effort. You get a clear picture of exactly where you stand.
Policy & Documentation
Complete ISMS documentation suite — information security policy, acceptable use, access control, incident response, business continuity, data classification, and every supporting procedure the auditor expects to see.
Technical Controls
We deploy the infrastructure: MFA, endpoint detection, network segmentation, encryption, logging, SIEM, patch management, backup systems, and secure remote access. Every control implemented, tested, and documented.
Staff Training
Security awareness programs designed for your team — from shop floor operators to engineering leads to executives. Phishing simulations, role-specific training, and the documented evidence auditors require.
Evidence Package
Organized, audit-ready documentation that maps every VDA ISA control to your implemented solution, supporting evidence, and responsible owner. When the auditor asks "show me," you're ready in seconds.
Ongoing Compliance
TISAX labels are valid for 3 years, but compliance is continuous. We provide ongoing monitoring, annual internal reviews, policy updates, and re-assessment preparation so you never scramble before renewal.
Where most companies
get caught
These are the findings we see most often when companies first approach us for TISAX readiness. If any of these sound familiar, you're not alone — and we know how to fix them.
Security policies exist informally or not at all. No documented management system, no risk register, no formal review cycle.
OT and IT on the same VLAN. Guest WiFi bridged to production. A single firewall between everything and the internet.
VPN, email, ERP, and admin accounts accessible with passwords only. Single factor authentication is a guaranteed finding.
Backups run nightly, but nobody has ever tested a restore. No documented RTO/RPO. No off-site or immutable copies.
No documented procedure for what happens when a breach occurs. No roles defined, no communication plan, no lessons-learned process.
Annual compliance slide deck that nobody reads. No phishing simulations, no role-specific content, no evidence of effectiveness.
TISAX questions answered
Ready to start your TISAX journey?
Book a discovery call and we'll walk through your current state, the assessment level you'll need, and a realistic timeline to get your TISAX label. No pressure, no jargon — just a clear path forward.