TISAX VDA ISA Automotive Supply Chain Compliance

TISAX (Trusted Information Security Assessment Exchange) is the industry-specific information security standard for the automotive sector. Every supplier, development partner, or service provider working with OEMs such as BMW, Mercedes-Benz, Volkswagen, or Audi requires a TISAX label. The assessment is based on the VDA ISA questionnaire and conducted by ENX-accredited auditors. Without a valid TISAX label, collaboration with most automotive manufacturers is not possible.

ISO 27001 is the international standard for information security management systems (ISMS) and forms the foundation of TISAX. However, TISAX extends ISO 27001 with automotive-specific requirements: prototype protection, third-party connectivity, and special handling of confidential vehicle data. An existing ISO 27001 ISMS significantly eases TISAX certification but does not replace it.

TISAX defines three assessment levels: Level

1 is a self-assessment without a TISAX label. Level

2 involves a plausibility check of the self-assessment by an ENX-accredited audit provider, including a remote interview. Level

3 is the most comprehensive audit with a full on-site inspection of all locations. OEMs typically require Level

2 or Level

3 — the choice depends on the protection needs of the information being processed.

The timeline depends on the maturity of your existing information security. With an existing ISO 27001 ISMS,

3 to

6 months is realistic. Without an existing ISMS, expect

6 to

12 months — including gap analysis, ISMS setup, control implementation, and assessment preparation. The TISAX label is valid for three years after successful assessment, after which recertification is required.

The VDA ISA (Information Security Assessment) catalogue is the central assessment instrument for TISAX. It contains requirements across information security management, access control, cryptography, physical security, operational security, communications security, and supplier management. Additional modules cover prototype protection and data privacy. The catalogue is regularly updated by the ENX Association.

TISAX requires companies in the automotive supply chain to demonstrate adequate information security. This applies equally to Tier-1 and Tier-2 suppliers, development service providers, and IT service providers. Specifically, you must operate an ISMS, systematically assess risks, implement access controls, and contractually oblige your own subcontractors to maintain information security. OEMs increasingly audit the entire supply chain, not just direct suppliers.

ADVISORI guides automotive suppliers through the entire TISAX process: we start with a gap analysis of your existing security measures against the VDA ISA catalogue, develop a prioritised action plan, support ISMS implementation, and prepare you specifically for the assessment. Our consultants understand the specific requirements of the automotive industry, including prototype protection and supply chain security, and have a proven track record of successfully guiding suppliers to their TISAX label.