What does the success of a TISAX certification depend on? The success of a TISAX certification depends above all on correctly establishing at the outset which labels and which assessment level your customer requires – because it is the contract, not your own preference, that determines the audit’s scope and depth. A mistake at this stage is the costliest: it leads to an audit that does not meet the recipient’s expectations.
Canonical definition: TISAX (Trusted Information Security Assessment Exchange) is the ENX Association-run mechanism for assessing and exchanging information security results in the automotive industry, based on the VDA ISA requirements catalogue, in which a company is assessed once and shares the result with partners instead of undergoing many separate audits.
This article distils TISAX preparation into two lists: five things to do first, and five mistakes that most often cost time and money.
TISAX top 5 – key takeaways:
- TISAX is run by the ENX Association, and the assessment is scored against the VDA ISA catalogue – currently version 6.0 (effective 1 April 2024).
- The assessment level (AL1, AL2, AL3) follows from the information’s protection needs and the customer’s requirement, not the company’s own choice – the contract decides.
- To obtain a label, every relevant MUST requirement must reach maturity level 3 or higher, backed by real evidence, not a document alone.
- The process runs in three steps on the ENX platform: registration, assessment (self-assessment plus audit), and exchange of results with selected partners.
- TISAX labels are valid for 3 years; choosing the right label and level at the outset decides whether the result is usable for the customer.
- Patronusec supports automotive companies in preparing for TISAX – from establishing the scope and level to audit readiness.
Table of Contents
What is TISAX and what determines the assessment scope?
TISAX is an automotive industry mechanism in which a company undergoes an information security assessment once and shares its result with business partners, instead of undergoing repeated, individual audits by each customer. The assessment scope is determined not by the company but by its customer’s requirement – the specific labels and assessment level written into the contract.
TISAX (Trusted Information Security Assessment Exchange) is run by the ENX Association, and all assessments are scored against the VDA ISA (Information Security Assessment) catalogue – currently version 6.0, effective 1 April 2024. This catalogue is the binding reference point of every assessment: the company demonstrates the maturity of its information security practices against its requirements.
Two dimensions define the assessment scope and both follow from the customer contract:
- The label (assessment objective). Defines which protection objective must be demonstrated. Since VDA ISA 6.0 there are four information security labels: “Confidential”, “Strictly Confidential”, “High Availability”, “Very High Availability”, and optional data-protection and prototype-protection modules are additionally available.
- The Assessment Level (assessment depth). Defines how thoroughly the audit is conducted: AL1 (self-assessment without external validation), AL2 (remote plausibility check of the self-assessment by an accredited assessor), AL3 (on-site assessment with inspection and interviews).
The key point: the assessment level follows from the information’s protection needs and the customer’s requirement, not the company’s own preference. The customer (usually a manufacturer or higher-tier supplier) states in the contract or via the ENX platform which label and level it expects.
In TISAX the most important decision is made before you implement anything: you do not choose how deep the audit will be – your customer does, and your task is to read that requirement correctly and match your preparation to it.
Top 5 things to do first
The five tasks below set the right order for TISAX preparation. The common denominator: first establish exactly what the customer requires, and only then build – the reverse order leads to an audit that does not meet expectations.
Establish the required labels and assessment level with the customer. This is the first and most important step. Ask the customer directly which label and Assessment Level it expects – the requirement is usually in the contract or communicated via the ENX platform. Without this, all the rest of the preparation may turn out mismatched.
Define the assessment scope correctly. Establish which locations, processes and systems the assessment covers. You enter the scope when registering on the ENX platform – it is worth doing this precisely, though the assessor can usually accommodate minor corrections.
Run a self-assessment against VDA ISA and identify gaps. Complete the VDA ISA questionnaire (version 6.0) and compare the current state with the required maturity level. This shows where you are and how much work separates you from readiness.
Raise maturity to the required level with real evidence. For every relevant MUST requirement, aim for maturity level 3 or higher – backed by evidence that the practice is genuinely applied, not just described in a policy. A document without evidence of implementation is not enough.
Register on the ENX platform and choose an accredited audit provider. The process runs through the ENX platform in three steps (registration, assessment, exchange). Choose an accredited audit provider appropriate to the required level and plan the schedule with room for remediation.
Top 5 things to avoid
The five mistakes below most often cost companies time and money on the way to TISAX. The common denominator: treating certification as a purely formal exercise instead of a real demonstration of maturity against the customer’s requirement.
❌ Choosing the assessment level by guesswork. The assumption “we’ll go with AL2, that should be enough” is risky. If the customer expects AL3 and you present AL2, your label is worthless to them. The level follows from the customer’s requirement and protection needs, not convenience – check the contract before you decide.
❌ Confusing a level change with a minor correction. If you start with AL2 and it later turns out you need AL3, in practice you pay twice – it is a fundamentally different audit depth, not a minor change. Establish the level correctly at the outset.
❌ Treating a policy as evidence. A policy document alone, without proof that it is genuinely applied, will not pass. TISAX requires maturity level 3 on MUST requirements backed by real evidence of implementation – the assessor checks practice, not just paper.
❌ Assuming AL1 is enough for a customer relationship. AL1 is a pure self-assessment without content verification by an external assessor; its result is not used within TISAX and does not lead to a label usable in a customer relationship. No manufacturer accepts AL1 as evidence.
❌ Carelessly sharing results in the exchange step. In the “Exchange” step you decide which partners see your result and in what detail. Once you grant a partner access, you cannot revoke it – choose deliberately who and what you share.
Patronusec Insight: In our project experience, the costliest TISAX mistake is made at the very start – when setting the assessment level. Companies that choose a level by guesswork or assume a lower one is enough often discover the mismatch only after the audit, when the customer does not accept the result. Then the assessment must be repeated at a higher level, paying a second time. We recommend starting from one conversation: with the customer, about the exact label and level requirement, and with an advisor, about what that requirement means in practice. That conversation saves the most.
What does the assessment process and label maintenance look like?
The TISAX process runs in three steps on the ENX platform – registration, assessment, exchange – and the resulting label is valid for 3 years. The assessment covers a self-assessment against VDA ISA and an audit at the level the customer requires, whose depth depends on the Assessment Level.
The three process steps:
- Registration. You create an account on the ENX platform, provide company details and define the assessment objectives (labels) the customer requires. This step is self-service.
- Assessment (self-assessment and audit). You choose an accredited audit provider, complete the VDA ISA self-assessment, then go through the audit. The provider verifies the answers at the level the customer requires (AL2 remotely, AL3 on-site), then uploads the report and the resulting label.
- Exchange. You decide which business partners can see your result and in what detail. Remember: once access is granted, it cannot be revoked.
The audit depth depends on the level. AL2 is a plausibility check of the self-assessment based on evidence and interviews, usually remote – for objectives with high protection needs. AL3 is a comprehensive on-site assessment with document inspection and interviews – for objectives with very high protection needs, for example the “Strictly Confidential” label.
Maintenance: the label is valid for 3 years, after which the assessment must be renewed. It is worth treating information security as a continuous process, not a one-off project – between assessments the practices must genuinely work, not merely exist on paper. This approach also eases the next renewal, because maturity is maintained rather than rebuilt from scratch.
Patronusec guides automotive companies through this process within its TISAX service – from establishing the scope and level, through a gap analysis against VDA ISA, to audit readiness and maturity maintenance.
FAQ – TISAX certification
Can I choose the TISAX assessment level myself?
Not fully. The assessment level follows from the information’s protection needs and your customer’s requirement, not your own preference. The customer states the required label and level in the contract or via the ENX platform. Choosing a level by guesswork is risky – if the customer expects AL3, an AL2 label will be worthless to them.
What is the current version of the VDA ISA catalogue?
The current version is VDA ISA 6.0, effective 1 April 2024. It is the binding requirements catalogue against which every TISAX assessment is scored. Version 6.0 introduced four information security labels (“Confidential”, “Strictly Confidential”, “High Availability”, “Very High Availability”), replacing the earlier designations.
How do levels AL1, AL2 and AL3 differ?
AL1 is a pure self-assessment without external validation, whose result does not lead to a usable label. AL2 is a remote plausibility check of the self-assessment by an accredited assessor, for high protection needs. AL3 is an on-site assessment with inspection and interviews, for very high protection needs. AL2 and AL3 are scored against the same VDA ISA catalogue – what differs is the depth of verification.
What maturity level is required to obtain a label?
To obtain a label, every relevant MUST requirement must reach maturity level 3 or higher, backed by real evidence. A policy document alone is not enough – the assessor checks whether the practice is genuinely applied. This distinction between “described” and “genuinely working” is a frequent cause of failure in companies that treat TISAX formally.
How long is a TISAX label valid?
A TISAX label is valid for 3 years, after which the assessment must be renewed. It is worth maintaining the maturity of information security practices throughout this period, not just for the audit – this is not only a requirement but also eases the next renewal, because maturity is sustained rather than rebuilt from scratch.
How does Patronusec help prepare for TISAX?
We start by establishing with you the required label and assessment level (based on your customer’s requirement) and defining the scope correctly. We then run a gap analysis against VDA ISA 6.0, support raising maturity with real evidence and audit readiness. After a free scope-assessment call we present a fixed-price quote.
Recommended reading
A reading path for TISAX and information security in automotive:
- TISAX – how to start your information security journey in automotive (a 10-step checklist) – the first step for companies without a security policy.
- NIS2 – cybersecurity risk management – a related regime that may cover automotive suppliers.
- DORA – digital operational resilience – for companies also operating in the financial chain.
TISAX certification – free consultation
Patronusec supports automotive companies in preparing for TISAX – from establishing the required label and level, through a gap analysis against VDA ISA, to audit readiness. Book a free consultation to correctly establish the assessment scope and level for your company.
