For automotive suppliers
That clause landed in your contract, and with it a pile of new words: scope, assessment objective, VDA ISA, audit provider. DM11 turns the request into plain language and a plan with owners and deadlines, then walks your company to the assessment with the outcome already predictable.
DM11 prepares your company for the assessment. The assessment itself, and the labels, come from an accredited auditor (an audit provider) contracted by the ENX Association, the body that runs TISAX. That separation is not our choice: it is a rule of TISAX itself.
Who runs the preparation
Where it starts
TISAX is not a law and not a government regulation. It is a requirement the carmaker (the OEM) or one of its major suppliers (a Tier 1) writes into the contract, with a deadline that customer sets. That is why the first conversation is not about information security: it is about understanding exactly what was asked, because the ask sets the size of everything that follows.
TISAX is run by the ENX Association, an industry body, which also contracts the accredited auditors (the audit providers). The list of criteria, called VDA ISA, is published by the German automotive industry association. ENX members include Audi, BMW, Bosch, Ford, Magna, Mercedes-Benz, Renault, Valeo and Volkswagen.
When your company receives engineering drawings, data on a part still in development or personal data from a customer, that customer's risk now lives on your network. TISAX is how the supply chain checks this once, instead of every carmaker auditing every supplier separately.
You publish the result once and release it to the partners you choose. That routine of answering a different security questionnaire for every customer ends, each with its own spreadsheet and its own deadline. The X in the name comes from exactly that: exchange.
What it actually is
The official participant handbook answers straight: there is no certificate to hang on your wall. TISAX is a way to assess your security and then exchange that result with whoever you choose. An auditor reviews your company against the VDA ISA catalogue, you receive labels, and you share them on the ENX platform only with whoever you authorise. Anyone who treats it as a certification usually gets the rest wrong too.
The result is labels published on the ENX platform, not a certificate. A supplier promising to “certify your company in TISAX” is promising something that does not exist.
The assessment uses the VDA ISA catalogue, a list of items covering information security, prototype protection and data protection. Each item gets a maturity score from 0 to 5, instead of a simple pass or fail.
Whatever version is in force when you order the assessment is the one that applies. VDA ISA 6.0.3 governs assessments ordered until 31/12/2026. From 01/01/2027, VDA ISA2027 applies. Published in July 2026, it strengthens supply chain security requirements and reorganises prototype protection.
Labels are valid for three years, counted from the closing meeting of the first assessment. Unlike ISO 27001, there is no yearly audit in that period. To renew, you repeat the process, and the official advice is to start a year before expiry.
The assessment covers addresses (your locations), not the company as a legal entity. Three plants can mean three locations in the same scope, and every location in a scope must carry the same assessment objectives. Getting this size wrong at registration costs you later: widening the scope afterwards is not a simple adjustment.
If the result is a minor non-conformity (a small problem), you receive temporary labels while you work through the corrective action plan. There is no permanent failure, and nobody has to see the result of an earlier attempt. What does exist is a deadline: corrective actions are capped at nine months.
Translation
In TISAX, what you order is the assessment objective (what needs protecting), and the objective sets the assessment level. If your customer's request does not name the objective, that is the first question to put to them, before any budgeting.
| What they ask for | What it means | What it demands of you |
|---|---|---|
| “We need you to have TISAX” | Incomplete request. The assessment objective is missing. | Go back to your customer and get the objective in writing. Without it any budget is guesswork and the registration may be wrong. |
| Confidential | Information that needs strong protection for secrecy. Assessment level AL 2 (the middle level, done remotely). | A self-assessment that stands up on its own, a check that it makes sense, and an interview, usually by web conference. |
| Strictly confidential | Information that needs very high protection. Level AL 3 (the top level, with an assessor at your site). | An assessor on your site, thorough examination of evidence, planned and unplanned interviews, observation of your processes. |
| High availability | Systems that must stay up and running (high availability). Level AL 2. | Business continuity with evidence of testing, not just a written plan. |
| Proto parts, Proto vehicles | Protection of prototype parts, components or vehicles (models not yet launched). Level AL 3. | Separated areas, physical access control with logging, camera and phone rules, and specific handling of media (USB drives, hard disks and the like). |
| Test vehicles, Proto events | Test vehicles and prototypes at events or shootings. Level AL 2. | Rules for handling, transport and covering the vehicles, with a named owner for each event. |
| Data | Protection of personal data, based on GDPR Article 28 (the EU data protection law) on processors. Level AL 2. | Processing records, impact assessment, transfer rules and handling of data subject requests. Directly connected to what privacy law already requires of you. |
| Special data | Sensitive personal data (special categories, such as health or biometrics). Level AL 3. | Everything above, with on-site verification and reinforced controls. |
The Info high and Info very high objectives stopped being selectable in April 2024. If your customer's request still uses those names, confirm with them: it usually means Confidential or Strictly confidential, and the difference changes the assessment level.
Levels
AL stands for Assessment Level. It is not your choice: it follows from the assessment objective your customer requires.
Internal use
The assessor only confirms that a self-assessment exists, without examining its content. The part that surprises people: AL 1 produces no TISAX label. It serves internal purposes or a specific partner, outside the exchange mechanism.
Most suppliers
The assessor checks that your self-assessment makes sense, reviews the evidence and interviews whoever owns information security, usually by web conference. The internal effort here is high: your self-assessment has to stand on its own, with proof behind every score.
Prototypes and very high protection
The assessor comes to your locations. They examine documents and evidence, run planned interviews with process owners and surprise interviews with the people who do the work, observe local conditions and watch the processes actually run. This is the level where the gap between the written process and the real one shows.
If you already have ISO 27001
Having ISO 27001 helps a lot, but it does not exempt you from the TISAX assessment. The VDA ISA catalogue follows the good practice of that standard and shows where the two line up, so much of your documentation can be reused. What usually trips people up is not what already exists: it is what ISO does not ask for, and the way scope is defined, which works the other way around.
Self-assessment
Fourteen questions across the topics the VDA ISA catalogue covers. The full result appears on screen, with a score for each topic and an honest read on how far you are from an assessment. We do not ask for your email to show it.
Approved by management, with a review date. An old document with no owner usually counts as absent.
How we run it
Every phase ends with a deliverable, not a status report. You know what you get before you start.
Before any technical diagnosis, we translate what your customer required into assessment objective, level and locations. This decision drives the size of everything that follows, and it is the one most often rushed.
You get
We assess your current position control by control, in the catalogue version that will govern your assessment, using the maturity scoring the assessor will use. The output shows the real distance, not an impression.
You get
We turn the gaps into a plan with owners, deadlines and an execution order. Sequence matters: some controls depend on others, and running them out of order creates rework.
You get
We run execution alongside your team: policies, processes, physical and logical access control, supplier management and the documentation that supports each score. Your team learns to operate what was built.
You get
We simulate the assessment with the assessor's rigour, including interviews with process owners and with the people who execute. This is where the gap between the written process and the practised one appears, while there is still time to fix it.
You get
We support you during the assessment run by the audit provider and, if there are non-conformities, in building and executing the corrective action plan within the scheme's deadline.
You get
Stories
We change our clients' names with the same confidentiality that will protect your company later. The names change, but the pattern of the problems repeats. When the client agrees, we share named references in a conversation.
A question you should be asking
The participant handbook is explicit: an audit provider may only run your assessment if they have not done consulting work for you before. Whoever prepares you is barred from assessing you. This is not red tape: it is what makes the result credible to the OEM that will rely on it.
Frequently asked
Answers anchored in the official participant handbook. Where no official figure exists, we say so.
No. The official participant handbook answers this directly: there is no certificate to be issued. TISAX is an assessment and exchange mechanism. You are assessed against the VDA ISA catalogue, you receive labels, and you share them on the ENX platform with the partners you authorise. A supplier promising a certificate is describing something the scheme does not have.
More questions? See DM11's full FAQ
A thirty minute conversation is usually enough to turn your customer's requirement into scope, level and an order of magnitude for effort. No obligation.