TISAX assessment in Germany

TISAX assessment in Germany at a glance

Prototype parts, design data and customer information are what TISAX exists to protect. The scheme, operated by the ENX Association, assesses a company's information security management against the Information Security Assessment catalogue that ENX maintains and the German automotive association VDA publishes. Instead of every manufacturer auditing every supplier, a TISAX audit provider assesses the chosen scope once, and the resulting labels are shared with business partners through the ENX platform — the scheme's principle is assessed once, recognised by many. TISAX is not a certificate and there is no DAkkS accreditation behind it; the audit providers are listed by ENX, and the participant selects the assessment objectives that match the data it handles. For suppliers that already run an ISO/IEC 27001 ISMS, much of the groundwork exists, though prototype protection adds physical and process controls of its own. Sterling prepares the scope, gap closure and evidence from its Frankfurt office for automotive suppliers across Germany. TISAX questions follow.

Who needs TISAX in Germany, and what happens without it

In Germany the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.

• Automotive suppliers handling OEM design data, prototypes or customer informationTISAX was developed to protect exactly this information across the supply chain.
• Engineering and development service providersThey receive design data and intellectual property from OEMs and tier-1 suppliers.
• IT, data-centre and logistics partners in automotive supply chainsBusiness partners may ask for TISAX labels instead of individual supplier audits.
• Automotive suppliers that also fall under NIS-2The same ISMS can serve TISAX and § 30 BSIG measures.

TISAX requirements in Germany

Strip away the vocabulary and TISAX asks an automotive supplier to be assessed on six things about protecting its customers' information.

In Germany these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: TISAX explained →

How to get a TISAX assessment in Germany

One team from the Frankfurt office carries the work from scoping to assessment result. All German states (Länder), on-site from Frankfurt; remote delivery for distributed teams.

1. Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
2. Gap assessment against TISAX and the German requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
3. Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
4. Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
5. The assessment by an approved audit providerAn approved audit provider assesses and records the result. Sterling supports the assessment.

The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.

How long does TISAX assessment take in Germany?

There is no standard duration: it depends on your scope and on how much of the system already runs. In Germany these are the factors that set the timeline.

• Assessment objectives chosen (information, prototype, data protection)
• Number of locations in the assessment scope
• Existing ISO/IEC 27001 ISMS that can be reused
• Audit-provider scheduling

Sterling agrees a dated plan with you on the discovery call, once the scope is known.

• Scope and timeline estimator

How much does TISAX assessment cost in Germany?

The cost has two parts: the consulting work to build and prove the system, and the audit provider’s fees, which are quoted separately. In Germany these factors move both.

• Assessment level and number of objectives
• Number of locations in scope
• Audit-provider fees quoted separately from consulting
• Physical security upgrades for prototype protection

Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.

TISAX consultants and assessors in Germany

Two different organisations are involved. A consultant helps you build the system and prove it works; an approved audit provider then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.

• Check that the body’s accreditation or approval covers TISAX and your sector, and that its certificates can be verified online.
• Ask the consultant how the local requirements in Germany are mapped into the same system, so nothing runs twice.
• Ask for client references in your sector; Sterling’s client letters are available on request.
• Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.

TISAX in Germany: questions clients ask

More on TISAX for German organisations

• TISAX: the complete guide
• Watch: How to get TISAX labels
• Sterling in Frankfurt
• TISAX assessment in Germany and every other standard Sterling delivers there

Other standards German businesses ask Sterling for

Organisations in Germany often combine TISAX with one of these, under one management system where the scopes allow.

All 23 standards Sterling delivers in Germany →