Vehicle manufacturers share confidential information with their suppliers: design data, prototypes, test results, personal data. Instead of every manufacturer auditing every supplier, the industry agreed on a common procedure. TISAX is operated by the ENX Association, and assessments are carried out by approved audit providers.
Basis: the VDA ISA catalogue
Assessments follow the Information Security Assessment of the German Association of the Automotive Industry. The catalogue is based on ISO 27001 and adds requirements such as prototype protection and data protection. Before the assessment, the company rates its own maturity.
Assessment levels and labels
Depending on the protection needs of the information, the customer requires a specific assessment level. At level 2 the provider mainly reviews documents and holds interviews; level 3 adds a comprehensive on-site assessment. The results are labels, for example for high or very high protection needs or for prototype protection. Results are usually valid for three years and are shared with customers once the assessed company releases them.
TISAX is not a certification in the strict sense
Formally, TISAX is an assessment and exchange procedure, not a certificate against a standard. In practice it plays the same role for suppliers: without the required label, no contracts involving confidential data are awarded.
Relationship with NIS2
TISAX is a customer requirement, NIS2 a legal duty. Many automotive suppliers have been covered as important entities under Germany’s NIS2 implementation since December 2025. An ISMS built for TISAX covers many NIS2 duties, but not registration and the statutory reporting channels. A compliance assessment clarifies how the two fit together.