The TISAX® (Trusted Information Security Assessment Exchange) assessment and exchange mechanism is based on the German Association of the Automotive Industry audit catalog (VDA ISA):

• Alignment with ISO 27001: Within the "Information Security" module, the VDA ISA catalog heavily draws on ISO 27001 controls while supplementing them with industry-specific criteria.
• Prototype Protection: Specific physical and organizational security requirements for handling prototypes, test vehicles, and sensitive components.
• Data Protection Integration (GDPR): Assessment of data processing agreements and compliance with data privacy standards for connected vehicle and telematics data.
• Industry-Wide Recognition: Once earned, TISAX® labels can be securely shared with multiple OEMs and partners via the ENX platform.

Lacking proof of an auditable Information Security Management System (ISMS) based on VDA ISA leads to immediate competitive disadvantages:

• Loss of Supplier Status & New Business: No awarding of new projects or prototyping contracts without the required TISAX® Assessment Level.
• Project Delays: Lengthy, customer-specific security questionnaires waste valuable internal capacity.
• Exposure of Sensitive Customer Data: Inadequate protection of CAD files, engineering designs, or prototypes causes severe reputational damage.
• Audit Failure: Poor preparation results in non-conformities and costly re-assessments.

A TISAX® project involves far more than filling out questionnaires. It requires the seamless interplay of physical security, IT safeguards, and clearly defined processes.

Without experienced guidance, organizations often end up with over-engineered controls that paralyze daily operations.

Typical Challenges in TISAX® Preparation:

• Uncertainty around required scopes: Clutter and confusion regarding Assessment Levels (AL 1, AL 2, or AL 3) and the correct audit scope.
• Complex requirements: Overwhelm when interpreting granular VDA ISA criteria.
• Siloed security operations: Lack of integration between physical access controls, IT security, and vendor management.
• Documentation overload: High time expenditure for drafting audit-ready policy and process documentation.

Our TÜV-certified TISAX® consultants guide you efficiently to your target maturity level—pragmatically, transparently, and aligned with your budget.

We guide your organization step-by-step through every phase of the TISAX® process—right up to the publication of your label on the ENX platform.

1. Baseline Assessment & Scope Definition

• Customer Requirement Analysis: Evaluation of OEM mandates to determine the correct scope and Assessment Level (AL 1–3).
• VDA ISA GAP Analysis: Comprehensive gap analysis based on the latest VDA ISA catalog.
• Actionable Roadmap: Creation of a targeted remediation plan to address identified security gaps.

2. ISMS Implementation & Customization

• Policy & Documentation Framework: Drafting and optimization of required security policies, business continuity plans, and role profiles.
• Risk & Asset Management: Alignment of risk and asset management procedures with VDA ISA specifications.
• Specialized Modules: Integration of high-security modules such as prototype protection and third-party vendor management.

3. Pre-Audit & Team Readiness

• Mock Audit: Realistic simulation of the audit environment to evaluate current maturity levels.
• Awareness & Audit Training: Staff training on security policies and optimal conduct during auditor interviews.
• Documentation Package: Finalization of complete, audit-ready documentation.

4. Audit Defense & Label Publication

• ENX & Provider Selection: Registration support on the ENX platform and assistance in selecting an accredited audit provider.
• On-Site Audit Support: Active presence and backing by our TÜV-certified consultants during audit days.
• Corrective Action Plan (CAP): Swift resolution of potential non-conformities to ensure rapid label release.