TISAX · Trusted Information Security Assessment Exchange
TISAX assessment consulting for labels your automotive customers can rely on.
Get your TISAX labels through an ENX-approved audit provider, at the objectives and level your customer has asked for, on the deadline in the supplier portal. Sterling's expert and experienced consultants put the VDA ISA requirements in place with your people, bring every control to target maturity, prepare the evidence and stay with you through the assessment and the exchange of results, in 60+ countries. We ensure a successful TISAX assessment for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced automotive information security consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not assess; the ENX-approved audit provider assesses and the labels are published on the ENX portal
8,100+ client engagements in 60+ countries.
TISAX client experience
What it is
What is TISAX and what is it used for?
TISAX, the Trusted Information Security Assessment Exchange, is the automotive industry's mechanism for assessing a company's information security once and sharing the result with every partner that needs it. It is governed by the ENX Association, a non-profit association founded by automotive manufacturers, and its requirements are the VDA ISA, the Information Security Assessment catalogue developed by the ENX Working Group ISA and published by the German automotive industry association, the VDA. More than 21,000 locations have been assessed since TISAX began in 2016.
The assessment is carried out by an audit provider approved by the ENX Association, not by a certification body, and it verifies the maturity of your controls rather than the existence of documents. The result is a set of TISAX labels on the ENX portal, released to the partners you choose; results are not public, and the ENX handbook says plainly that no certificate is provided. And the scope is predefined: it covers every process, procedure and resource under your responsibility that is relevant to the information in question, so you cannot narrow it the way you shape an ISO/IEC 27001 scope statement.
Current catalogue. Assessments ordered until 31 December 2026 are conducted against VDA ISA 6, released in October 2023 and effective for assessments ordered from 1 April 2024. On 1 July 2026 the VDA published VDA ISA2027, which applies to every assessment ordered from 1 January 2027; the final date to open an initial assessment under ISA 6 is March 2027, and the catalogue now moves to an annual release, published in summer and effective on 1 January of the following year. ISA2027 clarifies how requirements are interpreted, strengthens supply chain requirements, updates the mappings to ISO/IEC 27001:2022, NIST CSF 2.0 and ISA/IEC 62443 and rebuilds prototype protection; labels keep their three-year validity. What changes in VDA ISA2027 and how to plan for it
Who it is for
Who needs a TISAX assessment?
No regulator requires TISAX. Your customers do: a manufacturer or a tier-one supplier asks for labels before it shares design data, production information, prototypes or personal data with you, and it usually names the objectives and the level in its supplier portal. Organisations come to Sterling for TISAX from four starting points:
- A customer has asked for TISAX labels, with a date. The request names an objective such as Confidential or Proto parts. We confirm exactly what is asked, which locations fall into the scope and whether temporary labels can bridge the gap if the deadline is tight.
- You are bidding for automotive work for the first time. Engineering firms, IT providers, logistics companies, BPOs and agencies find that supplier qualification stops at the information security question. Labels answer it once for every automotive customer.
- You hold ISO/IEC 27001 and the customer still wants TISAX. The two are not interchangeable: one is a certificate with a scope you define, the other a set of labels on a predefined scope, assessed for maturity. Most of your ISMS carries over; the gap is usually specific, not structural.
- Your labels are expiring, or the last assessment did not go well. A result of major non-conform, temporary labels running out of time, a new location outside the scope, or ISA2027 arriving before the renewal.
The intended benefit is a security posture your customers can verify without auditing you themselves.
Business benefits
How TISAX supports automotive sales and supply chain trust
A TISAX programme should make you easier to qualify as a supplier and harder to compromise. We start with the information your customers entrust to you, the locations where it is handled and the points where a control exists on paper but not in the workflow, and build the programme around them.
- One assessment, every customerLabels on the ENX portal answer the same question for each manufacturer and tier-one that asks, in place of a separate audit or questionnaire for every account.
- Qualification that does not stallObjectives and level matched to what the customer's portal requires, so labels arrive before the sourcing decision.
- Controls that are mature, not merely presentThe maturity model rewards processes that are defined, measured and reviewed, which keeps them working between assessments.
- Prototypes and test vehicles protectedPhysical, organisational and handling controls for parts, vehicles, events and shoots, built to the prototype protection catalogue your customer cites.
- A supply chain you can vouch forISA2027 asks organisations handling information with high protection needs to document, review and monitor their own suppliers' security; the programme gives you the method and the records.
- A base for the frameworks that followThe same ISMS and evidence extend to an ISO/IEC 27001 certificate, IATF 16949 supplier expectations and NIS2, with the ENX mapping to Article 21 already published.
Track a few measures that reflect these priorities: the time information security adds to a customer qualification, the share of controls at or above target maturity, and how quickly a deviation found in an internal review is closed.
Requirements
What are the main TISAX requirements?
The requirements are the control questions of the VDA ISA, organised in three criteria catalogues: information security, prototype protection and data protection. Each question carries requirements graded as must, should and, where relevant, additional requirements for high and very high protection needs, and each is rated on a six-level maturity model: incomplete, implemented, controlled, established, predictable and optimising. The target for a successful assessment is level 3, established, on every applicable question; the overall result is the score across the questions that apply to you. The table follows the chapters of ISA 6; ISA2027 revises the requirements, most substantially in prototype protection, which it consolidates into two domains, organisational requirements and physical and environmental security.
| Catalogue and chapter | What it requires of you | What it looks like in practice |
|---|---|---|
| 1 IS policies and organisation | Information security governed: policies, responsibilities, risk management, incident and crisis management, and the ISMS itself | A policy set management signs, a security officer with authority, a risk register with owners, and an incident and crisis process that has been exercised |
| 2 Human resources | People vetted, obligated, trained and offboarded in a way that protects the customer's information | Screening proportionate to the role, confidentiality obligations, awareness training with records, and an exit process that removes access promptly |
| 3 Physical security | Sites, security zones and equipment protected against unauthorised access, loss and environmental threats | Zoned premises, visitor handling, controlled areas for sensitive work, and clear-desk and equipment rules that people follow |
| 4 Identity and access management | Users identified, access granted on need, privileged access controlled and reviewed | Joiner, mover and leaver records, periodic access reviews, multi-factor authentication for remote and privileged access, no shared accounts |
| 5 IT security / cyber security | Systems, networks, data and development protected: cryptography, change, backup, logging, vulnerabilities, malware and cloud | Hardened configurations, patching to a timetable, tested backups, monitored logs, encrypted data and devices, change control with evidence |
| 6 Supplier relationships | Your own suppliers and service providers assessed, contractually bound and monitored for the information they handle | A supplier register with security requirements in contracts and, under ISA2027, proof of each supplier's security through a TISAX label, an equivalent assessment or your own audit |
| 7 Compliance | Legal, regulatory and contractual requirements identified and met; personal data protected in line with the applicable law | A requirements register, privacy controls where personal data is processed, and internal audits and reviews with findings closed |
| 8 Prototype protection | Prototype parts, vehicles, test vehicles and events protected against disclosure, physically and organisationally | Secured storage and work areas, camouflage and transport rules, controlled photography and, in ISA2027, lifecycle traceability and controlled disposal |
| 9 Data protection | Personal data processed on a customer's behalf handled as Article 28 of the GDPR requires, with additional care for special categories | Processing agreements, a record of processing, the controller's instructions followed, sub-processors approved, and breach handling that meets the deadlines |
What does useful TISAX evidence look like?
Maturity is proved by operation. Level 3 asks for a process that is defined, followed, measured and reviewed, so the audit provider wants last quarter's access review, the incident handled by the procedure and the supplier assessment that led to a contract clause. We help define, for each control question, the record that shows the level you claim, and those records live in Effivity from the first workshop, so the self-assessment you submit and the evidence the audit provider samples describe the same system.
VDA ISA requirements explained, chapter by chapterAssessment process
How do you get your TISAX labels?
First bring the controls to target maturity. Then register on the ENX portal, choose an approved audit provider and have the assessment done. Sterling prepares your organisation and supports it through the assessment; the result belongs to the audit provider and the labels are published by ENX.
- 01Define the scope, the objectives and the level.Confirm which customer information, prototypes or personal data you handle and where, which of the ten assessment objectives the customer requires, and whether that means Assessment Level 2 or 3.
- 02Gap analysis: review the current controls against the VDA ISA.The gap analysis rates every applicable control question against the target maturity, keeps what works, identifies what is missing or undocumented and agrees actions, owners, dates and resources.
- 03Implement, register and complete the self-assessment.Close the gaps, train the people who operate the controls and let the processes run; register as a participant with a scope on the ENX portal and complete the ISA self-assessment with evidence behind every rating.
- 04Internal audit and readiness before the audit provider is booked.Sterling tests the controls the way the audit provider will, question by question, on site for an AL 3 scope, so deviations are found and fixed before the initial assessment.
- 05Complete the assessment and any corrective actions.Request offers from ENX-approved audit providers with your Scope ID, then the initial assessment: a plausibility check with evidence and interviews at AL 2, a comprehensive on-site verification at AL 3. If non-conformities remain, a corrective action plan, temporary labels where the result is minor non-conform, and follow-up assessments within nine months.
- 06Share the result and maintain the system to renewal.Release the result to your partners on the ENX portal at the sharing level you choose. Labels are valid for three years; the renewal is a new scope and a new assessment, best started a year before expiry.
Check who will assess, not just the quoted price. Ask for the audit provider's name and confirm it on the list of approved audit providers at enx.com, and ask which objectives, level and locations the offer covers. Be cautious of one provider offering both the consulting and the assessment, of a "TISAX certificate" and of labels promised in days: a partner checks labels on the ENX portal, not on a PDF. How to choose a credible TISAX provider
Cost
How much does a TISAX assessment cost?
There is no useful universal price for TISAX. A single-site software supplier with an ISO/IEC 27001 ISMS that needs Confidential at AL 2 is a different programme from a three-plant manufacturer that needs Strictly confidential and Proto parts at AL 3, on site at every location. What we can promise is a proposal in which every component is visible and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Current maturity against the VDA ISA, the objectives in scope, the number of locations, the level, and how much of the work your team takes on (Design™ or Drive™) |
| ENX participation | The registration fee the ENX Association invoices, calculated on the locations in your scopes at the rates in the published TISAX price list |
| Independent assessment | The audit provider's fees, driven by the level, the objectives, the number and location of sites, travel for AL 3, and any corrective action plan and follow-up assessments |
| Internal resources | Control-owner time, IT changes such as multi-factor authentication, logging or encryption, and physical measures for prototype areas |
| Software and learning | Included in a Sterling engagement: Effivity for the ISMS and the evidence, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, scope changes and new locations, catalogue updates and the renewal assessment every three years under Sustain™ |
What moves the price
- Assessment Level 2 or 3, and whether prototype protection or data protection objectives are in scope
- Number of locations and countries, and whether one scope or several
- Whether an ISMS exists today, and how much of it operates at target maturity
- The technical and physical work needed to close gaps
- The customer's deadline, and how much of the evidence work your team can carry
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Audit-provider and ENX registration fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does a TISAX assessment take?
The calendar is set by maturity, not by writing. Controls have to be established, which means defined, followed, measured and reviewed, before an audit provider can rate them at level 3, and that takes months of operation. For an organisation with a competent IT team and some existing controls, four to six months to the initial assessment is realistic; a first ISMS across several locations with prototype protection at AL 3 is nearer nine. We plan backwards from the customer's date, with the evidence calendar tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope, registration and gap analysis | Access to people, locations, systems, existing policies and any earlier self-assessment or ISO/IEC 27001 documentation |
| Build to target maturity | The technical and physical changes needed, approval times, training and internal capacity, and the time processes must run to show they are established |
| Self-assessment and readiness | Evidence gathered per control question, an internal audit and a management review |
| Assessment and result | The audit provider's availability, on-site days for AL 3, the corrective action periods for any non-conformities, and the follow-up assessment that closes them |
If a customer has given you a date, share it at the start. Sometimes the right answer is an initial assessment with a short corrective action plan and temporary labels while the permanent labels follow. A label date quoted before anyone has rated your controls is not a plan; it is a sales tactic.
Challenges
Common TISAX implementation challenges
Most TISAX programmes stall for the same five reasons. Each has a practical answer.
Controls exist, but nobody can show they are established.
Level 3 is not a document; it is a process with a measure and a review behind it. We define, for every applicable control question, the record that proves the level you claim and who produces it, and put the calendar in Effivity, so access reviews, supplier assessments and incident drills leave a trail as they happen.
The self-assessment is optimistic.
Ratings given from memory come apart in the interview. We rate every question with the control owner and the evidence on the table, and test the way the audit provider tests, so the self-assessment submitted is the one the initial assessment confirms.
The scope covers a location nobody planned for.
The standard scope follows the information, so a warehouse that stores prototype parts or a support centre that sees customer data is inside it. We walk the flows of the customer's information before registration and register the locations the objectives require, not the convenient ones.
The security lead is one person with a day job.
Split the work explicitly between Sterling and your team. Design™ gives you the structure, templates and coaching to run the programme yourselves; Drive™ has Sterling carry the agreed control design, documentation and evidence work with your owners.
The initial assessment ended with non-conformities and the clock is running.
Follow-up assessments must be completed within nine months of the initial assessment, and each corrective action has a limited implementation period. We write the plan with root causes the audit provider will accept, sequence the fixes and prepare the follow-up so temporary labels become permanent before they lapse.
Your engagement
What your TISAX engagement includes
Your agreed scope brings together everything an established ISMS and a prepared team need to earn the labels your customer asked for. A Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.
Scope, gap analysis and maturity plan
Objectives, level and locations agreed, every applicable control question rated, and a plan with responsibilities, dates and decision owners before work starts.
ISMS, procedures and prototype controls
Policies, procedures and physical measures tailored to your sites and your customer's information, on Sterling's own template sets, built with your process owners.
Effivity ISO & GRC software
Your ISMS, risk register, control evidence and supplier records run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Self-assessment, internal audit and readiness
The ISA self-assessment completed with evidence, controls tested the way the audit provider will test them, and deviations closed before the initial assessment.
Registration, audit-provider coordination and assessment support
Help with the ENX registration and audit-provider offers, evidence during the assessment, the corrective action plan and follow-up, and the release of results on the portal.
The assessment result remains with the ENX-approved audit provider and TISAX labels are issued only through the ENX portal; Sterling does not assess.
How we deliver
How Sterling supports your TISAX implementation
Every TISAX engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Choose the level of support that matches your capacity; the method, the software and the accountability stay the same.
- 01Design™Guided implementation: your team builds and operates the controls with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed control design, documentation and evidence work with your process owners.
- 03Sustain™After the labels: internal audits, control testing, new locations and scope changes, refreshers and new-hire training, and the renewal planned a year ahead.
- 04Automate™The ISMS running in Effivity: policies, risks, control questions with evidence, suppliers, incidents, changes, access reviews and management reporting in one workspace.
- 05Revise™Catalogue updates such as VDA ISA2027, additional objectives when a customer's requirement changes, and the extension to ISO/IEC 27001, IATF 16949 or NIS2.
At the start we agree the engagement team, the weekly working session, the deliverables and the decision owners. During delivery, progress is reviewed against those commitments, so gaps are visible early, not in the audit provider's findings list.
How Sterling OS™ worksOften combined with
Standards organisations pair with TISAX
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- AIAG core toolsAutomotive core tools implementation and training: APQP, Control Plan, PPAP, FMEA, MSA and SPC applied on your live parts.
- AQAP 2110AQAP 2110 compliance for defence suppliers: what the NATO contract requirement covers, AQAP 2105 quality plans, government quality assurance and an all-inclusive proposal.
- AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
- AS9110AS9110 certification for aviation maintenance organisations: the 9110 requirements, the IAQG audit route, cost and timeline factors, and Sterling's support.
- AS9120AS9120 certification for aerospace distributors and stockists: requirements, the IAQG audit route, OASIS listing, cost and timeline factors, with Sterling.
Effivity · TISAX and ISMS software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the VDA ISA, from ISA 6 to ISA2027.
Every Sterling TISAX engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the control questions with their maturity ratings and evidence, the risk register, policies, access reviews, incidents, supplier assessments, prototype handling records and management review live in one place, the controls run in daily work and the audit provider samples a live system rather than a folder assembled the week before. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Policies, roles, risks and incidents
The policy set with versions and approvals, security responsibilities, a risk register with owners and review dates, and an incident and crisis log with the exercises that prove the process has been rehearsed.
Screening, obligations and awareness
Joiner records with screening and confidentiality obligations, awareness training for every person linked to Sterling Academy, and leaver checklists that show access was removed.
Zones, visitors and equipment
Security zones and their rules, visitor and contractor records, equipment and media registers, and inspections of controlled areas.
Access requests, reviews and privileged accounts
Access granted on request and approval, periodic reviews recorded as they run, privileged accounts listed and reviewed, with evidence attached.
Changes, vulnerabilities, backups and logs
Change records with approval and test evidence, vulnerability findings with remediation dates against policy, backup and restore tests logged, and log reviews with follow-up.
Supplier register, requirements and monitoring
Suppliers classified by the information they handle, security requirements and contract clauses recorded, labels or assessments on file.
Requirements, internal audits and reviews
Legal, regulatory and customer requirements tracked to the processes they affect, an internal audit programme with findings and closure.
Prototype handling and processing records
Prototype parts, vehicles and events tracked from receipt to return or disposal; processing agreements, records of processing and sub-processor approvals for the data protection objectives.
What this means at the audit
The audit provider works through the control questions and asks, for each rating, what proves it: the last access review, the supplier assessment, the incident handled by the procedure, the visitor log for the prototype area. In Effivity each answer is a screen, with dates, owners and evidence attached to the question, not a folder assembled before the interview.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your policies, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, QMS, BCMS and more when you integrate other standards
TISAX client experience
Client letters on file, available on request.
Signed client letters for TISAX are available on request. The client feedback wall lists every letter by standard.
Programmes with TISAX in scope
How an integrated automotive security programme runs.
- 01How integrated programmes run
Automotive supplier: TISAX labels on an ISO/IEC 27001 ISMS, beside IATF 16949
TISAX is commonly implemented within an integrated programme in which the supplier holds, or is working towards, ISO/IEC 27001 and IATF 16949 certification. In such a programme the ISMS supplies the risk method, the policies and most technical controls; the VDA ISA control questions are mapped to them and rated for maturity; the quality system shares document control, internal audit and management review; and one Effivity workspace holds one evidence base, so every auditor samples the same system.
Sterling Academy · TISAX e-learning
Train every employee on TISAX, not just the security team.
Sterling Academy delivers e-learning for the whole workforce and for the people who own the controls: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- TISAX awareness for every employee, the training evidence the human resources chapter of the VDA ISA asks for
- Practitioner courses for control owners, the information security officer and the prototype protection lead
- Internal auditor training for the people who will test the controls before the assessment, as applicable to your standard, as part of the engagement
- Learner progress by department and a training status report for the audit provider
- New hires trained as they arrive, so awareness evidence is complete for every person the audit provider meets
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about TISAX
Watch a video on how to get TISAX labels here.
Watch a video on TISAX requirements here.
Why Sterling
Want a successful TISAX assessment? Come to Sterling.
Whether you supply one manufacturer from one plant or serve the automotive industry from locations across countries, Sterling helps you build an ISMS with clear owners and controls at target maturity. We work through the differences between what your customer's portal demands, what your ISO/IEC 27001 certificate covers and what your sites actually do.
Management systems in 60+ countries since 2003
Information security, privacy and quality systems implemented for manufacturers, engineering firms, IT providers and shared-service centres across every region we serve, with one engagement team accountable in every country.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with audit-provider and ENX registration fees identified separately. No surprises, ever.
Controls your people can operate
Fewer documents and more evidence: procedures, training and software connected to daily engineering, IT and plant work, so controls run because they are part of the job, not because an assessment is due.
Expert and experienced consultants
Consultants who have advised on information security management systems across sectors and countries since 2003, and who bring your controls to target maturity properly the first time, so the assessment confirms what already operates.
The Sterling Promise
What our TISAX success guarantee means
We stay with you until your agreed TISAX outcome is achieved, supporting implementation, readiness, the assessment and the corrective action plan and follow-up if findings are raised. Clear explanations, practical delivery, included software and employee learning turn the investment into capability that lasts, not a label that lapses.
The engagement identifies the assessment objectives, the level, the locations in scope, the outcome and the responsibilities. Your organisation supplies accurate information, gives access to the locations in scope and operates the agreed controls. The ENX-approved audit provider conducts the assessment, and its result remains its own; TISAX labels are issued through the ENX portal. Our commitment concerns the agreed readiness and assessment support, not a promise of every future contract award or an incident-free year.
After the assessment
What happens after your TISAX labels are issued?
Labels are generally valid for three years from the end of the assessment process, and the validity can be cut short if something significant in the scope changes, such as a relocation or a new location. Renewal is a fresh run through the process: a new scope registered on the ENX portal before you approach an audit provider, a new assessment, and the result shared again. ENX recommends starting the renewal at least a year before the labels expire, and from 2027 the assessment is ordered against the catalogue version of that year.
As the business grows, the ISMS should grow with it: new plants, new customers with different objectives, new suppliers to monitor and, each year, a revised catalogue. Under Sterling OS™ Sustain™ we run the internal audits, test controls against the current ISA and review supplier and scope changes with you, so the renewal finds a system that never stopped.
FAQs
Frequently asked questions about TISAX
Is TISAX a certification, and is there a TISAX certificate?
No. TISAX is an assessment and exchange mechanism: an ENX-approved audit provider assesses your locations against the VDA ISA and the result is issued as TISAX labels on the ENX portal, which you share with the partners you choose. The ENX handbook states that no certificate is provided and asks participants not to publish their assessment result, although you may say publicly that you take part in TISAX.
Which assessment objectives and which level do we need?
Ideally your customer tells you. There are currently ten objectives: Confidential, Strictly confidential, High availability and Very high availability from the information security catalogue; Proto parts, Proto vehicles, Test vehicles and Proto events from prototype protection; Data and Special data from data protection. Each fixes the level: Confidential, High availability, Test vehicles, Proto events and Data are assessed at AL 2, the other five at AL 3. You must select at least one, and you can select several.
What is the difference between Assessment Level 2 and Assessment Level 3?
At AL 2 the audit provider performs a plausibility check on your self-assessment, supported by evidence you submit and an interview with the person in charge of information security, generally by web conference. At AL 3 the audit provider comes to your locations and verifies everything: documents and evidence, planned interviews with process owners, observation of local conditions and of processes being executed, and unplanned interviews with the people who run them.
What does target maturity level 3 mean?
Every applicable control question is rated on a six-level model: incomplete, implemented, controlled, established, predictable and optimising. The target for a successful assessment is level 3, established: the process is defined, followed, measured and reviewed, not merely written down. The overall result is the score across the questions that apply to you.
How long are TISAX labels valid, and what are temporary labels?
Labels are generally valid for three years from the end of the assessment process. If the initial assessment finds non-conformities, an approved corrective action plan can turn the result into minor non-conform, which earns temporary labels. Temporary labels can be valid for up to nine months after the closing meeting of the initial assessment and cannot be renewed; follow-up assessments must be completed within that window, after which a new initial assessment is required.
We are certified to ISO/IEC 27001. How much of it counts for TISAX?
Much of the substance, none of the formal recognition. The ISA was originally built from ISO/IEC 27001, so your risk method, policies and most technical controls carry over. But the TISAX scope is predefined by the information you handle, the catalogue adds automotive requirements, prototype protection and data protection, and every question is rated for maturity. A certificate is not accepted in place of labels; one programme can deliver both.
Who can conduct the assessment, and can Sterling do it?
Only an audit provider approved by the ENX Association; the list, seventeen providers at the time of writing, is published on enx.com, and all of them can assess worldwide. You request offers from them with your Scope ID. Sterling prepares your organisation, helps you compare the offers and supports you through the assessment; Sterling is not a TISAX audit provider and does not assess.
We are in the Philippines, India or the Gulf. Does TISAX apply to us?
Yes. TISAX is required by customers, not by a regulator, so a software house, an engineering centre or a shared-service operation serving German or European automotive clients is asked for labels wherever it is located. The audit providers assess worldwide, with AL 3 always on site.
Should we implement ISA 6 or VDA ISA2027?
If your assessment will be ordered from 1 January 2027, it is conducted against ISA2027, so build to it now. Assessments ordered before then may still run under ISA 6 provided the initial assessment is opened by March 2027; group assessments and scope extensions follow the catalogue version of the initial assessment. Existing labels keep their full validity. From 2027 a new catalogue is published each summer and takes effect the following January.
What do you need to prepare a TISAX proposal?
The objectives and level your customer named, the locations that handle its information or prototypes, approximate headcount, whether an ISMS or an ISO/IEC 27001 certificate exists, any earlier TISAX result, and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to complete the self-assessment first.
Before the first call
Prepare a useful TISAX readiness brief
You do not need a completed self-assessment before the first discussion. Bring a short account of the information you handle for automotive customers, where it is handled and what the customer has asked for. Seven questions are enough:
- Who is asking for TISAX labels, and what exactly does the request say: which objectives, which level, by when?
- Which customer information, prototypes or personal data do you handle, and at which locations?
- Which suppliers, cloud platforms and contractors touch that information, and what do you know about their security?
- How are access, changes, vulnerabilities, incidents and visitors handled today, and what records exist?
- Which policies, controls and tools already work well, and is there an ISO/IEC 27001 certificate or an earlier TISAX result?
- Who can make decisions and contribute time to control design, evidence collection and staff learning?
- Is there a sourcing decision, a contract date or a label expiry to plan the assessment around?
These answers let us scope the work and price it realistically. They are preparation for a discussion, not a scored assessment or an audit provider's result.
Don’t be fooled by “TISAX certified” claims
If it takes ten days, it is not a TISAX assessment.
TISAX labels are useful when an approved audit provider has verified the maturity of the controls at the locations your customer relies on, and the result sits on the ENX portal where that customer can check it. The market offers substitutes: "TISAX certificates" the scheme does not issue, badges from providers who are not on the ENX list, and consultants who promise labels before anyone has rated a control. They cost less, until the customer looks for your labels on the portal and finds nothing.
How to choose a credible TISAX provider
- Ask who will assess and confirm the name on the list of approved audit providers at enx.com; an assessment by anyone else produces no labels.
- Read the scope before the price: the objectives, the level, the locations and the catalogue version. Labels on the wrong objective or the wrong site help nobody.
- Ask how maturity will be demonstrated. Level 3 needs processes that have run, been measured and been reviewed; policies written last week cannot be established.
- Identify who carries each task, which fees are the audit provider's and ENX's, and what support exists if the initial assessment ends with a corrective action plan.
- Ask what your people will learn and what software the evidence will live in. No training and no system means the renewal in three years is as hard as the first assessment.
- Walk away from "TISAX certified in days", one provider that both consults and assesses, and a certificate to hang on the wall. The handbook says there is none; partners verify labels on the portal.
Keep exploring
More on TISAX and related standards
More in Automotive, aerospace, rail & defence
Talk to a consultant
Plan your TISAX assessment with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice