TISAX® or ISO 27001? What an existing certificate brings

Is our ISO 27001 certificate enough for TISAX®? Does the label help us with ISO 27001? And what does TISAX® mean for our obligations under NIS2? Three questions from almost every initial consultation with automotive suppliers. The short answer: neither replaces the other, but the overlaps are large enough to use them deliberately. Here is how large they really are, with figures from the catalog.

Both deal with information security, but in different ways. ISO 27001 is an international standard for a management system; the end result is a certificate from an accredited certification body. TISAX® is the automotive industry’s exchange mechanism, operated by the ENX Association; the assessment is against the VDA ISA catalog, and the end result is a label in the ENX portal that you share with your customers.

The most important difference lies in the evaluation. ISO 27001 asks whether your management system meets the requirements of the standard. The VDA ISA rates each individual requirement with a maturity level from 0 to 5 and as a rule requires maturity level 3, that is, a defined, implemented and demonstrably lived process. A certificate therefore says nothing yet about the maturity level of your measures in the sense of the VDA ISA.

An ISMS based on ISO 27001 that is actually lived is the best starting point for TISAX®, but no sure thing. How close the two are can be counted in the catalog. VDA ISA 6 consists of three modules, and they relate to ISO 27001 very differently:

For the Information Security module, this means: if you run your ISMS properly, you already bring along policies, organization, risk management, access, IT security, supplier management and compliance. The evidence exists, the people responsible know their processes, and internal audits have already examined the workflows. That saves a great deal of work in the self-assessment and in preparing for the assessment.

What the standard does not provide can be named just as clearly. First, the maturity rating per requirement: conformity is not the same as maturity level 3, and the audit provider wants to see evidence in the form the catalog specifies. Second, the process itself: registration in the ENX portal, assessment objective, self-assessment, assessment, label. Third, the Prototype Protection and Data Protection modules, whose 34 requirements have no link to ISO 27001; if you handle prototypes or process data on behalf of customers, you are building from scratch here. And fourth, the scope: the ISO scope follows your management system, the TISAX scope follows the locations where you process the customer’s information. The two rarely coincide.

A label does not replace a certificate, but it does provide solid building blocks. The 42 requirements of the Information Security module that reference ISO have already been rated for maturity in the assessment and are backed by evidence. This evidence can be reused for an ISO project, and in a quality that a certification auditor rarely encounters.

What the standard additionally requires is the management system framework in its ISO form: a defined scope, the Statement of Applicability, internal audits and management review as a documented cycle with continual improvement. Much of this exists in substance in a TISAX-assessed company but has to be brought into the structure of the standard. Outside the automotive supply chain, hardly any customer knows the label anyway; whoever demands a certificate there means ISO 27001.

Many suppliers fall under NIS2 themselves. The German implementing act lists the manufacture of motor vehicles and motor vehicle parts as well as other vehicle manufacturing among the sectors of important entities. Companies are in scope if they employ at least 50 people or have an annual turnover and a balance sheet total of more than €10 million each. This raises the question of whether the TISAX label helps with the legal obligations.

In April 2025, ENX published an expert opinion by its ISA working group on this. It concludes that companies whose locations affected by NIS2 are set up in compliance with TISAX have fully implemented the requirements of the Directive, and it regards the label as evidence for the responsibility of management (Art. 20) and the risk management measures (Art. 21). ENX ties this to two conditions: the selected assessment objectives must reflect the company’s overall risk, and all locations affected by NIS2 must be included in the assessment. Important for putting this into perspective: this is the expert opinion of the standard owner, not a finding by the BSI. We are not aware whether the VDA ISA has been recognized as an industry-specific security standard under Section 30(8) BSIG.

What the label does not take off your hands are the obligations that the BSI Act imposes regardless of any standard: registration with the BSI within three months (Section 33), reporting significant security incidents with an early warning within 24 hours, a notification within 72 hours and a final report after one month (Section 32), and the personal obligation of the management body to implement the measures, monitor them and undergo regular training (Section 38). The ENX expert opinion itself points out that reporting channels must be anchored in incident management. The law does not impose a regular obligation to provide evidence through audits on important entities; Section 39 applies only to operators of critical facilities. A current TISAX label is therefore not mandatory proof, but solid evidence that the measures have been implemented.

Conversely, if you have to build up information security systematically for NIS2 anyway, you can do so along the VDA ISA. According to the ENX expert opinion, the catalog covers the measures of Art. 21 that Section 30 BSIG adopts in its minimum catalog: risk analysis, incident handling, backup and crisis management, supply chain, training, cryptography, access control and multi-factor authentication. On top of that, you end up with the label your customers require.

At their core, ISO 27001, TISAX® and NIS2 require the same things: management responsibility, risk management, effective technical and organizational measures, evidence. They just package them differently: as a certificate, as a label, as a legal obligation. If you build the measures properly once and align them with the techniques of real adversaries, you serve all three from a single source. What is missing in each case is the packaging: the proof of maturity for TISAX®, the standard’s cycle for ISO, registration and reporting channels for NIS2.

This is exactly how we work: we first check what you already have and build on it instead of setting up a second system next to it. How we guide you to the TISAX® label is described on our TISAX® consulting page; we explain building an ISMS and the NIS2 obligations on the respective pages.