TISAX requirements explained: video brief

Three criteria catalogues

The TISAX requirements are the control questions of the VDA ISA, organised in three criteria catalogues: information security, prototype protection and data protection. Each question carries requirements graded as must, should and, where relevant, additional requirements for high and very high protection needs. This short film walks through the structure.

Each question is rated on a six-level maturity model: incomplete, implemented, controlled, established, predictable and optimising. The target for a successful assessment is level 3, established, on every applicable question, and the overall result is the score across the questions that apply. The information security catalogue opens with information security policies and organisation and continues through areas such as human resources, physical security, identity and access management, IT security and cyber security, supplier relationships and compliance.

Prototype protection, data protection and the 2027 revision

The prototype protection catalogue applies where a supplier handles customers' prototype parts, vehicles or test activities, and the data protection catalogue applies where it processes personal data on a customer's behalf. Which catalogues and protection levels apply follows from the assessment objectives the customer requires, and the objectives in turn decide whether Assessment Level 2 or 3 is needed.

VDA ISA 6 applies to assessments ordered until 31 December 2026, and VDA ISA2027, published in July 2026, applies to every assessment ordered from 1 January 2027; it revises the requirements, most substantially in prototype protection, which it consolidates into two domains. Assessments are conducted by audit providers approved by the ENX Association, and results are issued as TISAX labels on the ENX portal, valid for three years.

There are currently ten assessment objectives across the three catalogues, from Confidential and Strictly confidential information to prototype parts, vehicles, test vehicles and events, and personal data. At Assessment Level 2 the audit provider performs a plausibility check on the self-assessment, supported by evidence and an interview, generally by web conference; at Level 3 it visits the locations and verifies everything. An ISO/IEC 27001 system carries much of the substance, since the catalogue was originally built from it, but no formal recognition: the scope is predefined by the information handled, and the catalogue adds automotive requirements.