TISAX Compliance

Introduction

TISAX is an information security assessment and exchange mechanism for the automotive industry, established by the German Association of the Automotive Industry (VDA) and run by the ENX Association.

What is VDA TISAX?

TISAX permits automotive suppliers to share their information security assessment results with clients across the ENX platform, removing the need for duplicate customer audits.

Benefits of VDA TISAX Certification

• Mandatory requirement for bidding on OEM and Tier 1 German automotive contracts
• Removes the need to repeat security audits for different automotive clients
• Protects prototype data, design drawings, and sensitive client information
• Shares verified security assessment results across the entire ENX network
• Signals to German and European automotive buyers that data-handling practices meet industry norms

Who Needs VDA TISAX Certification?

• Automotive parts manufacturers supplying German OEMs
• Software and engineering providers serving the automotive sector
• Logistics and service providers handling automotive design files
• Tier 1 and Tier 2 automotive supply chain partners

VDA TISAX Requirements

• Registration on the ENX portal as a TISAX participant
• Self-assessment against the VDA ISA requirements catalog
• Selection of an accredited TISAX audit provider
• Conducting the TISAX audit — Assessment Level 2 or 3
• Publishing and sharing assessment results on the ENX exchange

VDA TISAX Certification Process

Documents Required

• VDA ISA self-assessment spreadsheet
• Information Security Policy and procedures
• Prototype protection plan if applicable
• Access logs and physical security records
• Internal audit and corrective action logs

VDA TISAX Certification Cost

We don’t publish a fixed price, because cost depends on organisation size, number of locations, scope, process complexity, audit duration, consulting requirements and certification body fees. Request a scoped estimate and we’ll walk you through each factor.

Certification Timeline

Timelines depend on organisational readiness, scope and the complexity of your processes. A well-prepared, single-site organisation typically moves faster than a multi-site or highly regulated one — we’ll give you a realistic timeline after the initial gap analysis.

TISAX vs ISO 27001

TISAX is heavily based on ISO 27001 but introduces specific automotive industry requirements, such as prototype protection and third-party connection controls. TISAX results are shared on the ENX platform, whereas ISO 27001 yields a standard certificate.

Frequently Asked Questions