TISAX® Consulting for Automotive Suppliers

We prepare automotive suppliers for the TISAX® assessment: from scoping and the self-assessment based on VDA ISA through to evidence that holds up in the assessment. We know both sides of the table. We have successfully led several assessments at AL 2 and AL 3 to the label and have conducted TISAX® assessments ourselves as assessors for TÜV. That is why we prioritize what really counts in the assessment.

Many companies search for a TISAX certification. Strictly speaking, the term is wrong, and the difference has consequences: a successful assessment does not end with a certificate but with a TISAX® label. It is stored only in the ENX portal, your customers see it only once you share it with them there, and it is generally valid for three years.

For most suppliers, the label is simply market access: OEMs require it before they hand over confidential data, prototypes or orders. Your customer specifies which label you need.

Anyone searching for “TISAX requirements” or the “TISAX questionnaire” actually means the VDA ISA. A picture helps: TISAX® is the stadium, the VDA ISA is the rulebook. You register with TISAX®, and you are assessed against the VDA ISA.

TISAX® (Trusted Information Security Assessment Exchange)

The scheme run by the ENX Association on behalf of the VDA: registration, approval of audit providers, assessment objectives, labels and the portal through which results are shared. TISAX® itself contains no security requirements.

VDA ISA (Information Security Assessment)

The criteria catalog of the German Association of the Automotive Industry (VDA), an Excel file with three modules: Information Security (46 requirements), Prototype Protection (22) and Data Protection (12). You assess yourself against it, and the audit provider assesses you against it.

Assessment objective

The link between the two: it determines which modules apply and at which assessment level you are assessed. If you pass, you receive the label of the same name.

In the Information Security and Prototype Protection modules, each requirement is rated with a maturity level from 0 to 5; as a rule, maturity level 3 is required, aggregated across all requirements and with limited deviations. The Data Protection module is answered with yes or no. VDA ISA 6.0.3 currently applies; ISA2027 applies to assessments commissioned from 2027 onward.

The assessment level determines how deeply the audit provider assesses. There are three levels, but only two of them lead to a label:

You do not choose the level yourself. Your customer tells you the required assessment objective, and the level follows from it. Since April 2024, there have been ten assessment objectives:

The path to the label follows the process set out in the ENX Participant Handbook:

1. Scoping: locations, assessment objective, assessment scope. This is where effort and costs are decided.
2. Registration as a participant in the ENX portal.
3. Contact audit providers early; ENX explicitly recommends this because they have lead times.
4. Self-assessment based on VDA ISA: an honest maturity rating with evidence.
5. Close gaps, prioritized by what counts in the assessment and what real adversaries would exploit first.
6. Initial assessment by the audit provider. It always takes place.
7. In case of findings: corrective action plan, corrective actions, follow-up assessment. For minor findings, temporary labels are issued.
8. Label in the ENX portal and release to your customers.

How long preparation takes depends on the maturity level that the honest self-assessment reveals. After the initial assessment, ENX sets fixed deadlines: you must justify corrective actions that take longer than three months, and for more than six months you must also provide evidence. All gaps must be closed no later than nine months after the closing meeting, otherwise the process starts over with a new initial assessment.

Why we won’t sell you a gap analysis

Many consultancies start with a gap analysis or a pre-assessment. We don’t: ENX explicitly advises against it in the Participant Handbook and devotes a separate annex to the reasons. With a pre-assessment, you pay for two full assessments; if you start directly, you pay for one assessment and, if there are findings, a short follow-up. You cannot fail for good, because a failed attempt counts as a preliminary assessment, and you decide what is shared in the portal. The intended tool for determining where you stand is the self-assessment, and we create it together with you.

Instead of an upfront gap analysis, we work from day one with the yardstick that counts in the assessment. Six building blocks, individually or as a whole:

Scoping and assessment objectives

Locations, processes, data flows; does the required assessment objective match what you actually do? Do data protection and prototype protection belong in scope, and under which catalog version do you commission the assessment?

Facilitated self-assessment based on VDA ISA

Together with the people responsible on your side, with an honest maturity rating and evidence for each requirement.

Prioritizing measures by real threats

First where the assessment and real adversaries would strike. That is our Threat-Informed Defense approach.

Preparing evidence and interviews

From our own assessment practice, we know what evidence assessors want to see and how interviews go.

Support through to the label

Corrective action plan, ENX deadlines, corrective actions through to the follow-up.

Maintaining the level until renewal

So that renewal after three years does not turn into a major new project.

The assessment itself is carried out by an ENX-approved audit provider of your choice. This separation is intentional: under ENX rules, an audit provider may only assess companies it has not previously advised. So we advise; we do not assess.

Anyone asking about the cost of a TISAX certification means the cost of getting to the TISAX® label. There are four blocks, and only the first has a fixed price:

• ENX participation fee: €405 per location and scope, one-time, plus VAT. From 5 locations in one scope, a 10 percent discount per location; from 10 locations, 20 percent.
• Audit provider: individual quote, depending on the assessment level (AL 3 on site takes more effort), the number of locations and the assessment objectives. A follow-up costs significantly less than the initial assessment.
• Internal effort: self-assessment, evidence, interviews, implementation of the measures.
• Consulting: depends on your starting maturity and on how much of the work you want to carry yourself.

We deliberately do not quote flat overall prices. The effort can only be estimated seriously after scoping, and scoping is often the biggest cost lever: sometimes a smaller scope is the more honest and cheaper route. After three years, you go through the process again for renewal.

An ISMS based on ISO 27001 that is actually lived is the best foundation for TISAX®, but no shortcut: in the Information Security module of VDA ISA 6, 42 of 46 requirements refer to the standard, the Prototype Protection and Data Protection modules have no link to it, and the maturity rating, the process and the label come on top. Conversely, the label does not replace a certificate. As for NIS2: under two conditions, ENX considers a TISAX label to be evidence for the measures required by the Directive; registration, reporting obligations and the obligations of the management body under the BSI Act (BSIG) remain your responsibility.

In our view, the availability assessment objectives, stand-alone since ISA 6, show what the industry is really concerned about: supply chains that cannot absorb an outage, and therefore ransomware. That is why we do not treat TISAX® as a documentation exercise but prioritize the measures along the techniques of real adversaries. That is Threat-Informed Defense. The result passes both the assessment and the attack, and the evidence emerges as a by-product of effective security.