Protecting information entrusted by the customer
TISAX is an information security assessment and results exchange mechanism for the automotive industry, managed by ENX Association. Assessments are based on the ISA catalogue. The scope and objectives matter when interpreting the result.
My approach to TISAX preparation starts with a broader question: does the organisation understand the customer’s requirements for protecting entrusted information and apply them in everyday work? This includes information relating to the customer’s project and other data involved in the relationship.
It is not one person’s task
I do not treat preparation as the responsibility of one person or a single department. A coordinator can organise activities and maintain consistency, but delivery requires cooperation between the areas that influence how information is processed and protected.
Everyone should understand the requirements relevant to their work and the dependencies on other processes. Shared responsibility should not blur individual duties. People need to know who performs a task, who makes a decision and whom to contact when a problem arises.
Coordination needs management support
I would organise preparation as a project: with a designated coordinator, a clear point of contact and management backing. The coordinator needs support in agreeing responsibilities, priorities and available resources.
Planning should start with an internal gap analysis based on requirements and self-assessment: what already works, what is missing and who is responsible for addressing each gap. This grounds preparation in the organisation’s actual needs.
This is my approach to organising the work, not a requirement for every company to create an identical project structure. What matters is effective coordination and a team that communicates and solves problems together.
Preparation starts with understanding requirements
An organisation cannot be well prepared if the people involved do not know the requirements relevant to their work. Distributing a document is not enough. Each requirement needs to be understood, related to actual tasks and applied in practice.
A useful starting point is a joint meeting to explain the objective, the scope of preparation and the role of each area. It creates space for questions and clarification of dependencies. Continued cooperation helps establish whether everyone understands their tasks and whether the teams’ activities fit together.
I associate good preparation with knowing the requirements and practising their application. The evidence collected should reflect that way of working. External assessment verifies it within the agreed scope.
Scope, assessment levels and the meaning of the result
TISAX uses assessment levels AL2 and AL3. AL1 results are not used in TISAX. The assessment level determines the method and depth of verification; it should not be equated with the organisation’s maturity level.
Labels relate to specific assessment objectives and scope. They are neither ISO/IEC 27001 certificates nor a general guarantee of security across an entire company. Before preparation begins, it is worth establishing what result the partner expects and how this relates to the organisation’s activities.
What should remain after the assessment?
For me, the most important outcome is understanding that every employee influences information security within their role. The coordinator connects activities but does not replace the responsibility of individual areas. Preparation should strengthen engagement that remains part of daily work after the assessment ends.
I also see value in this approach in business relationships. An organisation that can explain and demonstrate how it meets requirements for protecting entrusted information gives its partner a basis for trust. A TISAX assessment result matching the required scope and objectives can support discussions about new contracts and responses to customer enquiries.
I do not consider it a guarantee of winning an order. It is a way to demonstrate organisational preparation, backed by real activities and engaged people. Results should be shared in accordance with TISAX rules.
Summary
Preparing for TISAX connects customer requirements with coordination, cooperation and the daily application of rules. Management support and a cohesive team help turn gap analysis into action. The lasting value is responsibility for information that remains within the organisation after the assessment.
Sources and documentation
- ENX - TISAX documents and downloads - official ISA versions, participant handbook, and process documents.
- TISAX Participant Handbook - the official description of registration, assessment scope, result exchange, and participant roles.
- ISO/IEC 27001:2022 - ISMS requirements used as an important information-security reference.
Q&A: TISAX ®
What is TISAX ®?
TISAX ® (Trusted Information Security Assessment Exchange) is an information security assessment and exchange mechanism developed for the automotive industry. It allows companies within the supply chain to demonstrate that they meet defined information security requirements.
What is the VDA ISA questionnaire?
The VDA ISA (Information Security Assessment) questionnaire is the core assessment catalog used in TISAX ®. It contains a structured set of information security controls that organizations must evaluate during self-assessment and external audit.
What is the difference between AL1, AL2, and AL3?
The levels differ in their verification methods:
- AL1 - checking self-assessment completeness without verifying content; results outside TISAX.
- AL2 - checking the plausibility of self-assessment, evidence and explanations.
- AL3 - comprehensive verification, including on-site activities.
Is self-assessment required for TISAX ®?
Yes. Every organization must first perform a self-assessment using the VDA ISA questionnaire before starting the official assessment process. The self-assessment helps identify gaps and prepare the organization for the formal audit.
How long does it take to obtain a TISAX ® label?
Timing depends on gaps, scope, team capacity and audit provider availability. A schedule should follow self-assessment; one typical number of months would be misleading without this context.
Does every TISAX ® assessment cover prototype protection and personal data protection?
No. The applicable VDA ISA catalogues and requirements depend on the selected assessment objectives, the organization's activities and the partner's requirements. Prototype protection may fall outside the assessment if it is not relevant to the activities performed. The Data Protection catalogue applies to the corresponding objectives for processing personal data on behalf of a controller under Article 28 GDPR, including special categories of personal data.
Leaving the Data Protection catalogue outside the assessment does not exempt the organization from its obligations under the GDPR.
What is the relationship between TISAX ® and ISO/IEC 27001?
TISAX ® and ISO/IEC 27001 are closely related. Many organizations use ISO/IEC 27001 as the foundation for their information security management system, while TISAX ® focuses specifically on information security requirements in the automotive supply chain.