Implementation walkthrough
How to get TISAX labels: video walkthrough
A walkthrough of preparing for a TISAX assessment so an automotive supplier can share its information security result with every customer that asks.
Key takeaways
- TISAX results are shared as labels on the ENX portal, not certificates.
- Assessments are carried out by ENX-approved audit providers.
- The customer decides the assessment objectives and level.
- Every applicable question must reach maturity level 3, established.
- Labels are valid for three years.
One assessment, recognised across the automotive industry
TISAX, the Trusted Information Security Assessment Exchange, is the automotive industry's mechanism for assessing a company's information security once and sharing the result with every partner that needs it. It is governed by the ENX Association, a non-profit association founded by automotive manufacturers, and its requirements are the VDA ISA, the Information Security Assessment catalogue published by the German automotive industry association, the VDA.
The assessment is carried out by an audit provider approved by the ENX Association, not by a certification body, and it verifies the maturity of controls. The result is issued as TISAX labels on the ENX portal, valid for three years; there is no certificate. This short film walks through how a supplier prepares.
From assessment objectives to labels
Define the scope, the objectives and the level: which customer information, prototypes or personal data the supplier handles and where, which of the assessment objectives the customer requires, and whether that means Assessment Level 2 or 3. The request usually arrives in the customer's supplier portal with objectives, a level and a date.
A gap analysis then rates each applicable VDA ISA control question on the six-level maturity model, and the information security management system is built until every applicable question reaches the target level, level 3, established. Depending on the objectives, that covers information security, prototype protection and data protection. A self-assessment confirms readiness. The supplier then registers on the ENX portal, chooses an approved audit provider and has the assessment carried out; the result belongs to the audit provider, and the labels are published by ENX for customers to see.
Sterling's expert and experienced consultants support scope and gap analysis, the ISMS build to target maturity and the self-assessment under Sterling OS™, and stay through the assessment and the renewal cycle. Assessments ordered from 1 January 2027 use the revised catalogue, VDA ISA2027.
TISAX at a glance
- Purpose
- One information security assessment, recognised across the automotive industry, so a supplier proves its security once and shares the result with every customer that asks
- Relevant to
- Suppliers, engineering partners, IT and service providers and agencies that handle an automotive customer's confidential information, prototypes or personal data
- Edition
- VDA ISA 6 for assessments ordered until 31 December 2026; VDA ISA2027, published in July 2026, for every assessment ordered from 1 January 2027
- Assessment
- Conducted by an audit provider approved by the ENX Association, at Assessment Level 2 or 3; the result is issued as TISAX labels on the ENX portal, valid for three years. There is no certificate
- Sterling's role
- Scope and gap analysis, ISMS build to target maturity, Effivity, training, self-assessment, readiness and support through the assessment, then Sustain™ to renewal
- Cost and timing
- Total investment for a TISAX programme depends on the current maturity of your information security management system, the assessment objectives and level, locations and number of employees. The process typically takes 4 to 9 months
TISAX: questions people ask
Is TISAX a certification, and is there a TISAX certificate?
No. TISAX is an assessment and exchange mechanism: an ENX-approved audit provider assesses your locations against the VDA ISA and the result is issued as TISAX labels on the ENX portal, which you share with the partners you choose. The ENX handbook states that no certificate is provided and asks participants not to publish their assessment result, although you may say publicly that you take part in TISAX.
Which assessment objectives and which level do we need?
Ideally your customer tells you. There are currently ten objectives: Confidential, Strictly confidential, High availability and Very high availability from the information security catalogue; Proto parts, Proto vehicles, Test vehicles and Proto events from prototype protection; Data and Special data from data protection. Each fixes the level: Confidential, High availability, Test vehicles, Proto events and Data are assessed at AL 2, the other five at AL 3. You must select at least one, and you can select several.
What is the difference between Assessment Level 2 and Assessment Level 3?
At AL 2 the audit provider performs a plausibility check on your self-assessment, supported by evidence you submit and an interview with the person in charge of information security, generally by web conference. At AL 3 the audit provider comes to your locations and verifies everything: documents and evidence, planned interviews with process owners, observation of local conditions and of processes being executed, and unplanned interviews with the people who run them.
What does target maturity level 3 mean?
Every applicable control question is rated on a six-level model: incomplete, implemented, controlled, established, predictable and optimising. The target for a successful assessment is level 3, established: the process is defined, followed, measured and reviewed, not merely written down. The overall result is the score across the questions that apply to you.
How long are TISAX labels valid, and what are temporary labels?
Labels are generally valid for three years from the end of the assessment process. If the initial assessment finds non-conformities, an approved corrective action plan can turn the result into minor non-conform, which earns temporary labels. Temporary labels can be valid for up to nine months after the closing meeting of the initial assessment and cannot be renewed; follow-up assessments must be completed within that window, after which a new initial assessment is required.
Keep exploring
Related to this video
The complete guide
Everything on TISAX
Start with the TISAX page, or go straight to the guide you need.
On the TISAX page
Often combined with TISAX
More videos: Information security, cyber and cloud
- How to comply with the UAE IA StandardCompliance walkthrough · 3 min 15 s
- UAE IA Standard requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27001Implementation walkthrough · 3 min 24 s
- ISO/IEC 27001 requirements explainedTwo-minute brief · 2 min
- How to implement PCI DSSImplementation walkthrough · 3 min 24 s
- PCI DSS requirements explainedTwo-minute brief · 2 min
- How to implement SOC 2Implementation walkthrough · 3 min 24 s
- SOC 2 requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27017Implementation walkthrough · 3 min 14 s
Talk to a consultant
Plan your TISAX assessment with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice