TISAX VDA ISA Audit Preparation & Labeling

TISAX audit preparation starts with a gap analysis based on the VDA ISA questionnaire. You assess your current information security posture against TISAX requirements, identify gaps, and create an action plan. Then you implement the required measures, prepare documentation, and conduct an internal self-assessment before the accredited audit provider performs the official assessment.

Assessment Level

2 (AL2) is conducted remotely through document review and plausibility checks via phone or video. Assessment Level

3 (AL3) requires a full on-site audit by the audit provider, typically lasting two to three days. The required level depends on the protection needs of the information processed — Level

3 is mandatory for prototype protection or highly confidential data.

In Stage 1, the auditor reviews your ISMS documentation, policies, risk analyses, and the implementation status of VDA ISA requirements. In Stage 2, the auditor verifies practical implementation on-site: checking whether documented processes are actually followed, conducting employee interviews, and inspecting technical measures such as access controls and data encryption.

The most common major findings in TISAX audits include: incomplete or outdated risk analyses, missing evidence of employee security awareness training, gaps in access and authorization concepts, insufficient documentation of security incidents, and missing emergency plans. Lack of regular ISMS reviews and inadequate prototype protection are also frequently cited.

The audit fees from the accredited provider range from EUR 3,

000 to EUR 15,000, depending on the assessment level and company size. Total costs including preparation, ISMS implementation, and external consulting typically range from EUR 15,

000 to EUR 40,

000 for mid-sized companies. Preparation time ranges from three to twelve months depending on your current maturity level.

A TISAX label is valid for three years. After that, a new assessment by an accredited audit provider is required. It is recommended to plan recertification six to nine months before expiry to allow sufficient time for any remediation. Between audits, the ISMS should be maintained through internal audits and continuous improvement.

If major findings are identified, you receive an action plan with deadlines for remediation. Typically, you have up to nine months to address the findings before a follow-up audit takes place. Minor findings can often be resolved through the regular improvement process. Important: the ENX Association allows a maximum of nine months between registration and successful completion of the assessment.