TISAX / VDA ISA: TISAX / VDA ISA – Tutorial (about 60 minutes)

TISAX is the information security assessment and exchange scheme of the automotive industry. A carmaker or supplier that wants to share confidential designs, prototype parts or personal data with a partner asks that partner to pass a TISAX assessment, which is carried out by an approved audit provider against a common requirements catalogue called the VDA ISA. The result, expressed as TISAX labels, is then shared through a central portal so that one assessment can satisfy many customers. After this tutorial you will be able to explain how the scheme is organised, read the ISA catalogue, choose the right assessment objectives, and prepare an organisation for its first TISAX assessment.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: TISAX (Trusted Information Security Assessment Exchange) is governed and operated by the ENX Association on behalf of the German Association of the Automotive Industry (VDA). Its requirements catalogue is the VDA Information Security Assessment (VDA ISA), written by the ENX Working Group ISA and published by the VDA. The catalogue is free to download under a Creative Commons Attribution-NoDerivatives licence. Two catalogue generations matter at the time of writing. ISA 6, released in October 2023, has been mandatory for assessments ordered from 1 April 2024 and is still the basis for assessments ordered during 2026. ISA2027 was published by the VDA on 1 July 2026 (the English file currently carries version 2027.1, dated 2026-09-30, and a German version followed on 1 October 2026). ENX states that assessments ordered from 1 January 2027 are conducted against ISA2027 and that the final date to open an initial assessment under ISA 6 is in March 2027. Catalogues are now named after the year in which they take effect and will be released every summer (ISA2028 is planned for summer 2027). Existing TISAX labels stay valid for their full term of up to three years. The process rules come from the ENX TISAX Participant Handbook (version 2.8, 2025-03-13). This tutorial teaches the ideas that are common to both catalogue generations and points out where ISA2027 differs. Verified 2026-10-29 against the ENX TISAX, ISA and downloads pages, the ENX ISA2027 news items, the ISA2027 (2027.1) and ISA 6 catalogue files and the Participant Handbook.

Who it is for: information security officers, IT and OT managers, quality and project managers, purchasing and supplier management staff, and consultants at automotive suppliers, engineering service providers, logistics companies, IT service providers and carmakers who are new to TISAX and expect to prepare for, run or rely on an assessment.

Prerequisites: none. A basic idea of what an information security management system is (policies, risk assessment, controls, audits) will help, and familiarity with ISO/IEC 27001 makes some parts easier, but every term is explained when it first appears.

By the end of this tutorial:

You will be able to explain why the automotive industry created TISAX and how the roles of VDA, ENX, audit providers and participants fit together.
You will be able to describe the structure of the VDA ISA catalogue: its three modules, its requirement columns and its maturity model.
You will be able to choose assessment objectives from a customer request and work out the assessment level each one implies.
You will be able to walk through the three TISAX steps of registration, assessment and exchange, including the self-assessment.
You will be able to interpret findings, overall results, corrective action plans, temporary labels and label validity.
You will be able to plan a realistic first assessment for a supplier with more than one site.
You will be able to explain how TISAX relates to ISO/IEC 27001, data protection law and automotive cybersecurity standards.

Lesson 1 – Origins, purpose and scope

The problem TISAX solves

Building a car is a team effort spread over thousands of companies. A carmaker (often called an OEM, original equipment manufacturer) shares detailed drawings, software, test data and unreleased prototype parts with tier-1 suppliers, who share parts of that information with tier-2 suppliers, engineering service providers, test laboratories, logistics firms and IT providers. Every one of those companies becomes a place where secrets can leak. A photo of a camouflaged prototype on social media or a stolen set of design files can cost a carmaker a great deal of money and reputation.

For many years each carmaker protected itself in its own way, with its own questionnaire, its own audits and acceptance of only its own results. A supplier working for five carmakers might face five audits per year asking broadly the same questions in different words, which cost both sides a lot of effort.

The German automotive industry first agreed on a shared questionnaire. The VDA, the association of German carmakers and suppliers, published the Information Security Assessment catalogue so that everyone would at least ask the same questions. The remaining problem was trust: a carmaker had no reason to accept an assessment that a competitor had commissioned or that the supplier had performed on itself. TISAX closed this gap by adding a governed scheme around the catalogue: common rules for how assessments are performed, a list of approved audit providers whose quality is monitored, and a portal through which results can be shared with any partner the assessed company chooses. The idea in one line: assess once, share the result with many partners.

Who runs it

Three parties shape TISAX. The VDA publishes the ISA catalogue and represents the industry that requires it. The ENX Association, an association of automotive companies and national automotive associations registered under French law, governs the scheme, operates the registration and exchange portal, approves and monitors the audit providers, and maintains the ISA through its Working Group ISA. The audit providers are independent companies, typically testing, inspection and certification firms, that ENX has approved to perform TISAX assessments. ENX marked ten years of TISAX in 2026 together with the release of ISA2027.

What it covers

TISAX assessments can cover three subject areas, which correspond to the three requirement modules of the ISA:

Information security – protecting the confidentiality, integrity and availability of business information, IT systems and services. This is the core module and is part of every assessment.
Prototype protection – physical and organisational protection of prototype parts, prototype and test vehicles, and prototypes shown at events or photo shoots.
Data protection – handling personal data on behalf of a customer as a processor in the sense of Article 28 of the EU General Data Protection Regulation (GDPR).

TISAX is used wherever automotive partners exchange sensitive information: parts suppliers, but also design studios, testing houses, software developers, IT service providers, event agencies and transport companies that move prototypes. The requirement usually reaches a company through a customer request or purchasing contract.

What TISAX is not

Two misunderstandings are common. First, TISAX is not a certification in the ISO sense. The output is an assessment report and a set of TISAX labels that are visible only to the partners the company chooses. Second, TISAX is not a law. No regulation requires it; it becomes mandatory only because customers make it a condition of doing business. That makes the customer request, and exactly which labels the customer asks for, the starting point of every TISAX project.

Lesson 2 – Key concepts and vocabulary

The list below defines the words you will meet in customer requests, in the portal and in the Participant Handbook.

TISAX – Trusted Information Security Assessment Exchange: the scheme of rules, approved audit providers and a portal for performing and sharing information security assessments in the automotive industry.
VDA ISA – the Information Security Assessment catalogue, an Excel workbook containing the control questions, objectives and requirements against which organisations are assessed. It can also be used on its own for internal audits and self-checks.
ENX Association and ENX portal – the scheme owner and its web platform where companies register, order assessments, pay fees and share results.
Active participant – the company that gets assessed and shares its result. Usually the supplier.
Passive participant – the company that asked for the assessment and receives the result. Usually the customer. Any company can be active towards its customers and passive towards its own suppliers at the same time.
Audit provider – an independent company approved by ENX to conduct TISAX assessments. The active participant chooses and pays it.
Assessment scope – the defined part of the organisation (which locations, which assessment objectives) that is assessed. TISAX normally uses a predefined standard scope that all participants accept, so that results are comparable.
Assessment objective – a named reason for the assessment, such as handling confidential information or protecting prototype parts. The objective decides which ISA modules and requirement columns apply and which assessment level is used.
TISAX label – the visible outcome for each assessment objective that was passed. Labels are what partners look for in the portal.
Protection need – how much damage the organisation or its customer would suffer if information were disclosed, altered or unavailable. The ISA distinguishes normal, high and very high protection needs.
Assessment level (AL) – the depth of the assessment method. AL 1 is a self-assessment only, AL 2 a plausibility check with evidence and an interview, AL 3 a thorough verification including on-site activities.
Maturity level – a score from 0 to 5 that describes how well established a process is, from incomplete to optimizing. Information security and prototype protection controls are rated this way; the data protection controls are answered with yes or no.
Target maturity level – the level the ISA expects for each control. In current catalogues it is level 3, Established, for every control question.
Self-assessment – the organisation's own evaluation of every applicable ISA control before the audit provider arrives. It is the basis for the plausibility check at AL 2 and an essential preparation for AL 3.
Finding – a deviation recorded by the auditor, classified as a major non-conformity, minor non-conformity, observation or room for improvement.
Corrective action plan (CAP) – the participant's plan to fix non-conformities, with actions, owners and dates.
Temporary label – a label with a limited lifetime that can be granted when only minor non-conformities remain and an approved corrective action plan exists.
Simplified group assessment (SGA) – an option for organisations with at least three locations and a strong, centrally run ISMS, assessed with a group-level method instead of location by location.
Information security management system (ISMS) – the policies, roles, processes and records through which management steers information security in a planned and lasting way rather than by chance.

Lesson 3 – Structure of the VDA ISA catalogue

The workbook and its tabs

The ISA is published as a spreadsheet so that organisations can fill it in directly. Besides a welcome page, a cover sheet and the licence, the important tabs are the maturity level definitions, the definitions of key terms, the three requirement tabs (Information Security, Prototype Protection and Data Protection), a results tab that summarises the scores with a spider web chart, examples of key performance indicators, and a change history that lists what changed from one release to the next. Reading the definitions tab first is a good habit: it explains how the columns are meant to be read and what words such as "must" and "should" mean.

Figure 1 – The ISA catalogue has three modules; information security is the core, prototype and data protection are added when the scope needs them.

The Information Security module

The Information Security tab holds the basic controls, which are built on the ideas of ISO/IEC 27001 but phrased as questions and organised in seven chapters. In ISA2027 the chapters are:

Information security policies and organisation – policies, responsibilities, security in projects, asset inventory and classification, approval of external IT services and software, risk management, internal and independent reviews, and incident and crisis management.
Human resources – qualification for sensitive roles, contractual obligations, awareness and training, and rules for mobile work.
Physical security – security zones, supporting assets, and mobile devices and storage media.
Identity and access management – identification means, secure login, account management and assignment of access rights.
IT security and cyber security – cryptography, protection in transit, change management, separation of environments, malware protection, logging, vulnerability management, technical audits, network management, IT continuity, backup and recovery, and security in the acquisition and development of IT services and in shared external services.
Supplier relationships – security with contractors and cooperation partners, non-disclosure, and the split of responsibilities with external IT service providers.
Compliance – legal, regulatory and contractual obligations, and the protection of personal data within information security.

Control numbers follow the pattern chapter, sub-chapter, control, for example 5.2.5 for the vulnerability management question. ISA2027 keeps the same control numbers as ISA 6 in most places and revised the wording of most information security controls for clarity. It also renumbered the control on splitting responsibilities with external IT service providers from 1.2.4 to 6.1.3, so that it now sits with the other supplier controls, and turned a small number of former "should" items into "must" items (for example, making security policies available to employees). If you inherited an ISA 6 self-assessment, the change history tab and the redline document from ENX show you exactly what moved.

The Prototype Protection module

This module (chapter 8) applies only to organisations that handle prototypes their customers classify as needing protection. It covers organisational matters, such as prototype protection rules, customer-specific requirements, training, qualification, non-disclosure, subcontracting, access to security areas, visitors, photography and image material, incidents, and traceability and return or disposal of protected items. It also covers physical matters such as a security concept, perimeter security, the construction of the building shell, protection against being seen, access control, intrusion detection and separation between different customers on site. ISA 6 organised these controls into five groups; ISA2027 consolidates them into two domains, 8.1 organisational requirements and 8.2 physical and environmental security, and adds controls for traceability and for the proper return, recycling or disposal of protected vehicles, parts and tools.

The Data Protection module

Chapter 9 applies when the organisation processes personal data on behalf of a customer, for example a service provider that analyses connected-car data or runs an HR system for a carmaker. It asks about data protection policies and responsibilities, the record of processing activities, data protection impact assessments for high-risk processing, data transfers including to countries outside the EU, passing obligations on to subcontractors, handling data subject requests and data breaches, staff confidentiality and training, and following the controller's instructions. Unlike the other two modules, its controls are answered with a simple yes or no rather than a maturity level. It complements, rather than replaces, the organisation's legal duties under the GDPR.

The requirement columns

Every control row has the same layout. The control question asks to what extent something is in place. The objective explains what the control is meant to achieve. Then come the requirement columns, and understanding them is the key to reading the ISA:

Requirements (must) – strict requirements without exemptions.
Requirements (should) – requirements that must in principle be implemented, but where a deviation is acceptable if there is a valid justification and the organisation understands and accepts its effects.
Additional requirements for high protection needs – apply on top of the basic requirements when the scope includes high protection needs.
Additional requirements for very high protection needs – apply on top of all the others when the scope includes very high protection needs.
Additional requirements for simplified group assessments – apply only when the SGA option is used.

The additional requirements for high and very high protection needs are marked with the protection goal they serve: C for confidentiality, I for integrity and A for availability. This matters because a company can have very high availability needs (it supplies parts just in time to an assembly line) while having only high confidentiality needs, or the reverse. Further columns map each control to other standards such as ISO/IEC 27001 and NIST CSF 2.0, point to implementation guidance, and give room for the organisation's own implementation description, reference documents, findings and actions.

ISA2027 also defines a phrase that appears in many requirements: when a requirement says that certain aspects are considered, the organisation is expected to have made a conscious, reasoned decision about each listed aspect and to be able to explain that reasoning to the auditor. It does not mean that every listed aspect must be implemented in full.

The maturity model

In the information security and prototype protection modules, the answer to each control question is not "yes" or "no" but a maturity level. The ISA uses a six-step scale (levels 0 to 5) derived from process assessment models:

Figure 2 – The ISA rates each control on a six-step maturity scale; level 3 is the target, and higher levels earn no extra credit in the result.

In plain words: at level 1 something is done but depends on individuals; at level 2 it is planned, documented and you can show records; at level 3 it is a standard process woven into the management system, with interfaces to other processes and evidence that it has worked over a longer period; levels 4 and 5 add measurement and systematic improvement. Level 3 is the target for every control. When the results tab calculates the overall score, any level above 3 is cut back to 3 so that excellence in one area cannot hide weaknesses in another. With all controls at target, the result score reaches the maximum of 3.0. The ISA also offers a KPI examples tab, but defining KPIs is optional and not a requirement for passing.

Lesson 4 – How TISAX works in practice

Step 0: understand the request

Most TISAX projects begin with an email or contract clause from a customer. A good request names the assessment objectives (or labels) required, the locations that will handle the customer's information or prototypes, and a deadline. If any of these is missing, ask. Assessing too little means the customer may not accept the result; assessing too much wastes time and money. Customers usually provide their Participant ID so that the result can later be shared with them.

Choosing assessment objectives

Each assessment objective corresponds to a label and to an assessment level. Under ISA 6 and the current Participant Handbook the objectives that can be selected are:

Assessment objective	What it covers	Assessment level
Confidential	Information with high protection needs for confidentiality	AL 2
Strictly confidential	Information with very high protection needs for confidentiality	AL 3
High availability	Information and services with high availability needs	AL 2
Very high availability	Information and services with very high availability needs	AL 3
Proto parts	Prototype parts and components on own premises	AL 3
Proto vehicles	Prototype vehicles on own premises	AL 3
Test vehicles	Handling test vehicles, for example on public roads	AL 2
Proto events	Prototypes at events and film or photo shoots	AL 2
Data	Processing personal data on behalf of a customer	AL 2
Special data	Processing special categories of personal data on behalf of a customer	AL 3

Two older objectives, "Info high" and "Info very high", covered high and very high protection needs for information before ISA 6 split confidentiality and availability into separate objectives. They could only be selected until 31 March 2024; labels that were issued under them remain in the portal until they expire. Because "Info high" is a superset of "Confidential" and "High availability", and "Info very high" a superset of "Strictly confidential" and "Very high availability", holders of the old labels automatically received the matching new ones.

Some labels are hierarchical: a "Strictly confidential" label also satisfies a request for "Confidential", "Very high availability" covers "High availability", and "Special data" also covers "Data". For prototype protection, ISA2027 brings a bigger change. Audit providers that have explained the new catalogue (for example DQS) report that the four prototype objectives are being replaced by two labels, where the higher one includes the lower: a basic label at AL 2 for processes and trained people handling prototypes, and a facilities label at AL 3 that adds physical protection of the sites where prototypes are kept. The exact names and mapping are set in ENX's updated documents, so check the current Participant Handbook before registering a prototype scope in 2027.

Step 1: registration

The active participant registers in the ENX portal. It provides company data, contact persons, the locations in scope and the assessment objectives, accepts the general terms and conditions, and pays a participation fee to ENX. The fee depends on the number of locations and is due whether or not the assessment is later passed. After registration the company receives a Participant ID and a Scope ID. The scope can still be adjusted until the audit provider concludes the assessment, but changes later in the process may require a new assessment, so it pays to get it right at the start.

Most companies use the standard scope, which is fixed by ENX and accepted by all participants. Its value is comparability: a customer reading "Confidential, standard scope" knows what was examined without studying the company's own scope statement. A single scope gives one report and one expiry date for all locations, but if one location fails, the whole scope fails. Large organisations sometimes split their sites into several scopes for flexibility, or choose the simplified group assessment if they have at least three locations and a centrally run ISMS in very good shape.

Step 2: assessment

The assessment step contains four activities: preparation, choosing an audit provider, the assessment itself and the result.

Preparation centres on the self-assessment. The organisation downloads the applicable ISA version, decides which controls apply, and for each one writes a short implementation description, lists the reference documents and evidence, and honestly rates its maturity level. Gaps found here are fixed before the audit provider arrives. Typical preparation work includes writing or updating the information security policy, building the asset inventory with a classification scheme, documenting a risk assessment, setting up incident reporting, reviewing user accounts and access rights, establishing patch and vulnerability management, testing backups, and reviewing supplier contracts for security and non-disclosure clauses.

Choosing an audit provider means requesting offers from companies on the ENX list. The active participant pays the audit provider directly.

The assessment follows the method of the required assessment level, explained in Lesson 5. It always begins with an initial assessment and may be followed by further assessments to close gaps.

The result is a TISAX assessment report and, if the result is good enough, labels that appear in the portal.

Figure 3 – A TISAX project runs from the customer request through registration and assessment to sharing the result with the customer.

Step 3: exchange

Labels are useless until a partner can see them. In the exchange step the active participant decides who sees what. It can share the result with a specific passive participant at a chosen sharing level, from only the basic scope information and labels up to the full content of the assessment report. If the overall result is conform, it can also publish limited information, such as the scope and labels, to all TISAX participants so that any customer can find it. Sharing is deliberate and permanent: once granted, access lasts for the validity period and cannot be withdrawn, so the organisation should share exactly the depth its partner needs. Sharing reports outside the portal undermines the trust model.

Lesson 5 – Assessment levels, results and labels

Protection needs drive assessment levels

TISAX links the depth of the assessment to how sensitive the information is. Normal protection needs correspond to AL 1, high protection needs to AL 2 and very high protection needs to AL 3. If a scope contains several objectives, the highest required level applies to the assessment, and a higher-level assessment automatically satisfies requests for lower levels.

Figure 4 – Each protection need maps to an assessment level, and only AL 2 and AL 3 assessments lead to TISAX labels.

AL 1 – the auditor only checks that a completed self-assessment exists, without examining evidence or interviewing anyone. Because trust is low, AL 1 results are not used in TISAX and produce no labels. Companies may still use the ISA this way internally or at a customer's request outside TISAX.
AL 2 – the audit provider checks the self-assessment for plausibility for every location in scope, reviews evidence and interviews the person responsible for information security, usually by web conference. Evidence that must not leave the premises can be inspected on site on request. There is also a fuller remote variant, sometimes called AL 2.5, in which the auditor verifies compliance rather than plausibility; it is formally rated as AL 2 but makes a later upgrade to AL 3 easier.
AL 3 – the audit provider performs a comprehensive verification: document review, planned and spontaneous interviews, and observation of the actual conditions and processes on site. If on-site activities are temporarily impossible, a video-supported remote method may be used, but it is recorded as a minor non-conformity and the on-site part must be completed later in a follow-up assessment.

How findings are classified

For each requirement the auditor decides whether it is met. Deviations are recorded as one of four types:

Major non-conformity – a deviation that creates a significant immediate risk or raises doubt about whether the management system works at all.
Minor non-conformity – a deviation without significant immediate risk and without doubt about the effectiveness of the system as a whole.
Observation – no immediate risk, but one could develop; the organisation must investigate, monitor and decide how to handle it.
Room for improvement – no risk, but an obvious opportunity to do better; acting on it is the organisation's choice.

The individual findings are then merged into an overall result. "Conform" means the requirements are fulfilled and labels can be issued. "Minor non-conform" means only minor non-conformities remain; labels require the gaps to be closed, but temporary labels are possible. "Major non-conform" means at least one major non-conformity exists and no labels are issued until it is resolved. The Participant Handbook adds an important detail: until a corrective action plan has been approved, every non-conformity counts towards a major non-conform overall result. An approved plan (with compensating measures where a major finding exists) is what moves the result to minor non-conform. The Participant Handbook adds a formal limit based on the maturity scores: if the result score, after cutting back to target levels, is more than 10 % below the maximum, the overall result can be no better than minor non-conform, and more than 30 % below makes it major non-conform. A score at the maximum is no guarantee of passing, because individual non-conformities still count.

Initial, corrective action plan and follow-up assessments

Every TISAX process starts with an initial assessment. Its closing meeting starts two clocks: the label validity period and a nine-month window in which any non-conformities must be resolved. If gaps remain, the participant writes a corrective action plan. Implementation periods longer than three months need a justification, and longer than six months need evidence that faster implementation is impossible; no action may take longer than nine months.

A corrective action plan assessment is an optional check by the audit provider that the plan is adequate. If the plan is approved and the overall result is minor non-conform, the participant can receive temporary labels. They are otherwise equal to normal labels but expire when the longest planned corrective action is due, at the latest nine months after the initial closing meeting. A follow-up assessment then verifies that the actions were implemented and effective. Corrective action plan and follow-up assessments may happen several times, until all gaps are closed, the participant exits, or the nine months run out, after which a new initial assessment is needed.

Figure 5 – After the initial assessment a scope either receives labels directly or passes through corrective action and follow-up within a nine-month window.

Validity, renewal and catalogue versions

TISAX labels are generally valid for three years, counted from the end of the assessment process. Significant changes to the scope, such as moving to a new building or adding locations, can shorten that period. There is no surveillance audit between assessments as in ISO certification, so the organisation must keep its ISMS alive on its own; customers may ask about major changes in the meantime. Renewal means running the process again for a new scope, and ENX recommends starting at least one year before expiry.

The ISA version used is determined by the order date, not the audit date: the audit provider uses the version valid when the initial assessment is ordered, and a newer version published between order and assessment can be used by mutual agreement. ENX's rule for the 2027 transition is that assessments ordered during 2027 are conducted against ISA2027, while an initial assessment under ISA 6 can still be opened until March 2027. The new annual cycle does not mean annual assessments: a label stays valid for its full term, and the next catalogue only matters at the next assessment.

Is TISAX a certification?

Formally, no. ENX describes the outcome as an assessment result with labels that are shown only in the ENX portal, and it explicitly issues no certificate to hang on the wall. The assessments follow ENX's TISAX rules and are carried out by audit providers that ENX has approved for TISAX, not as accredited ISO certification audits. An ISO/IEC 27001 certificate and a TISAX label therefore do not replace each other automatically.

Lesson 6 – Worked example: a two-site supplier prepares for TISAX

The situation

Brightline Sensors (a fictional company) designs and builds camera modules for driver assistance systems. It has about 300 employees: an engineering office with 60 developers and a production plant 40 km away. In September 2026 its largest customer, a tier-1 supplier, sends a new request. Because Brightline will receive unreleased vehicle design data and will store pre-series camera housings for an unannounced model, it must hold TISAX labels for "Strictly confidential" and "Proto parts" before the next development phase starts. The customer gives its Participant ID and a deadline of nine months.

Step 1 – Clarify the scope

The information security officer, Mara, first checks the request with the customer. Which locations will handle the design data? Both, because production engineers at the plant need drawings. Where will prototype housings be stored? Only at the plant. Brightline decides on one standard scope with both locations, because the customer needs both and a single report is simpler to manage. Both requested objectives require AL 3, so the whole assessment will be at AL 3, including on-site activities at both sites. Mara notes that the "Strictly confidential" label will also satisfy any customer who only asks for "Confidential".

Because the order will be placed in 2026, the assessment will use ISA 6 and the ISA 6 prototype objectives. Mara records that a renewal in 2029 will use whatever catalogue is current then, and that the prototype labels will have different names under ISA2027 and later.

Step 2 – Register and order early

Mara registers Brightline in the ENX portal, enters both locations and both objectives, accepts the terms and arranges payment of the participation fee. She then asks three ENX-approved audit providers for offers, explaining the AL 3 scope and the two locations. She selects one with automotive electronics experience and books the initial assessment for five months ahead, leaving time to close gaps first.

Step 3 – Self-assessment

Mara downloads the ISA version matching the order date and works through every applicable control with the people who own the processes. For each control she writes how Brightline meets the requirements and links the evidence. Because "Strictly confidential" applies, she reads the must, should, high and very high columns marked for confidentiality. Because "Proto parts" applies, she completes the prototype protection module for the plant. The data protection module stays out of scope because Brightline does not process personal data for its customer.

The self-assessment shows a mixed picture. Policies, access management and malware protection are at level 3. Several controls are only at level 1 or 2:

There is no complete inventory of information assets, and the classification scheme exists on paper but is not used in daily work.
Vulnerability scanning happens ad hoc when an engineer remembers, with no defined timelines for fixing critical issues.
Design data is exchanged with a small simulation subcontractor by email without encryption, and the contract lacks security clauses.
At the plant, the room planned for prototype storage has a window facing the car park, and there are no rules on phone cameras for visitors.
The backup of the engineering file server has never been restored in a test.

Step 4 – Close gaps before the audit

Mara builds a project plan with owners and dates. The asset inventory is created per department with information owners, and the classification labels are added to document templates. IT introduces monthly vulnerability scans with fixed remediation times by severity and keeps the reports. A secure file exchange platform replaces email for the subcontractor, and purchasing adds security and confidentiality clauses to the contract. Facility management frosts the window, installs an access-controlled door with logging and an alarm, and creates a visitor procedure including escorting, registration and covering phone cameras with seals. Prototype handling training is given to everyone who will enter the storage room. IT performs and documents a restore test.

Mara is careful about one thing: the ISA target is level 3, which needs evidence that processes have been running for some time. She therefore starts the new processes as early as possible, so that several months of records exist when the auditor arrives.

Step 5 – Initial assessment

The auditor reviews documents in advance, then spends time at both sites. She interviews Mara, the IT lead, facility management and a few randomly chosen developers, checks the vulnerability reports, tries the door of the prototype room, looks at the visitor log and asks a production worker what he would do if he saw someone photographing a housing. At the closing meeting she reports no major findings but two minor non-conformities, so the result can become minor non-conform once a corrective action plan is approved. Some leavers' user accounts were disabled late, and the intrusion alarm of the prototype room is not yet connected to a monitored alarm service. There is also an observation about the growing use of external AI tools that have not been evaluated, and a room-for-improvement note about the KPI reporting.

Step 6 – Corrective action plan and temporary labels

Mara writes a corrective action plan: an automated link between HR leaver records and account deactivation within two months, and a contract with an alarm monitoring company within three months. Because the customer's deadline is close, Brightline requests a corrective action plan assessment. The audit provider approves the plan, and Brightline receives temporary labels that expire when the last action is due. Mara shares the result with the customer at the sharing level the customer asked for, so the next project phase can start on time.

She also treats the observation seriously. The ISA asks that only evaluated and approved external IT services are used, so she adds AI chat tools to the external service approval process before it becomes a non-conformity.

Step 7 – Follow-up and life after the labels

After both actions are implemented, the audit provider performs a follow-up assessment, checks the evidence and confirms that the gaps are closed. Brightline now holds full labels valid for three years from the end of the assessment process. Mara adds the TISAX expiry date to the management review calendar, schedules internal audits against the ISA every year, keeps an eye on new ISA releases each summer, and plans to start the renewal at least a year before the labels expire.

Lesson 7 – Relationship to other standards and frameworks

Understanding how TISAX relates to frameworks you already know prevents both duplicate work and false assumptions.

Standard or framework	What it is	Relationship to TISAX / VDA ISA
ISO/IEC 27001	International requirements for an ISMS, with accredited third-party certification	The ISA information security module is based on ISO/IEC 27001 and maps its controls to it. An ISO certificate helps with preparation but does not replace a TISAX assessment, and TISAX adds automotive-specific requirements such as prototype protection and protection-need columns.
ISO/IEC 27002	Guidance on information security controls	Useful for understanding how to implement many ISA controls; the ISA is the assessed catalogue, ISO/IEC 27002 is background guidance.
EU GDPR (Article 28)	Legal duties for processors handling personal data for a controller	The ISA data protection module and the Data and Special data objectives check how a processor meets these duties; TISAX does not replace legal compliance or supervisory authorities.
NIST Cybersecurity Framework 2.0	Voluntary framework of cybersecurity outcomes	ISA2027 maps its controls to NIST CSF 2.0, which helps organisations that already report against CSF.
ISA/IEC 62443	Security for industrial automation and control systems	The ISA references 62443 for operational technology topics; ISA 6 and ISA2027 pay more attention to OT and availability, but 62443 goes much deeper into plant control systems.
ISO/SAE 21434 and UN Regulation No. 155	Cybersecurity engineering of road vehicles and type approval of the manufacturer's cybersecurity management system	These cover the security of the vehicle and its development; TISAX covers how companies protect information, prototypes and data. A supplier may need both, for different reasons.
VDA 6.3 and IATF 16949	Automotive process audit and quality management system	Same industry and similar supplier-audit culture, but quality rather than information security; they do not produce TISAX labels.

Companies with an ISO/IEC 27001 certificate usually find much of the information security module covered. The extra work typically lies in the protection-need columns, prototype protection and the maturity-based evidence expected at level 3.

Common pitfalls and best practices

Pitfalls

Guessing the objectives. Registering "Confidential" when the customer needs "Strictly confidential" leads to a result that the customer cannot accept, and upgrading later means another assessment at a higher level.
Treating the self-assessment as paperwork. Rating everything at level 3 without evidence makes the AL 2 plausibility check fail and gives a false sense of readiness for AL 3.
Starting processes too late. Level 3 needs evidence that a process has been used over time. Policies written the week before the audit usually reach level 2 at best.
Forgetting the should requirements. Skipping a "should" without a documented justification and a conscious acceptance of its effects is recorded as a deviation.
Ignoring the protection-goal markings. Implementing the very high confidentiality requirements but not the availability ones, or the reverse, when the objectives call for both.
Underestimating physical prototype protection. Windows, fences, alarms and visitor photography rules often need building work and lead times that do not fit a short project.
Letting the ISMS sleep after the labels arrive. With no surveillance audits, controls can decay for three years and the renewal becomes a new project.
Sharing too much or too broadly. Sharing is permanent for the validity period, so granting full report access to every requester can expose details of the company's weaknesses.

Best practices

Confirm the request in writing: required objectives, locations, deadline and the customer's Participant ID.
Use the self-assessment as a real gap analysis, involving the process owners and collecting evidence for each control as you go.
Book the audit provider early and plan the initial assessment for a date that leaves time to run new processes for a few months.
Read the definitions tab and the change history of the ISA version that applies to your order date before you start.
Build on what exists: map existing ISO/IEC 27001 or GDPR documentation to the ISA controls instead of writing a parallel system.
Plan for findings: keep budget and capacity for a corrective action plan, and know when temporary labels can protect a delivery deadline.
Run annual internal audits against the ISA and include TISAX status in the management review.
Start renewal at least a year before expiry, checking which ISA version will apply and whether label names have changed.

Summary and key takeaways

TISAX is the automotive industry's scheme for performing information security assessments once and sharing the results with many partners; ENX operates it and the VDA publishes its catalogue.
The VDA ISA catalogue has an information security core module plus prototype protection and data protection modules; ISA 6 applies to orders until early 2027 and ISA2027 to assessments ordered from 1 January 2027.
Each control is rated on a 0 to 5 maturity scale with a target of level 3, and scores above target are cut back in the result.
Requirements are split into must, should, and additional requirements for high and very high protection needs, marked by confidentiality, integrity or availability.
Assessment objectives determine the labels and the assessment level: AL 2 for high and AL 3 for very high protection needs; AL 1 produces no label.
The process runs through registration, assessment and exchange; findings lead to corrective action plans, possible temporary labels and follow-up assessments within nine months.
Labels are valid for up to three years, are not ISO certificates, and are only seen by partners the company chooses to share them with.
TISAX complements ISO/IEC 27001, GDPR obligations and vehicle cybersecurity standards rather than replacing them.

Reflection questions

Think of a supplier you know. Which TISAX assessment objectives would it need, and what in its business tells you whether its protection needs are high or very high?
Your organisation holds an ISO/IEC 27001 certificate. Which parts of the VDA ISA would you expect to be largely covered already, and where would you look for gaps first?
Pick one ISA control area, such as vulnerability management. What evidence would convince an auditor that it is at maturity level 3 rather than level 2?
Your audit is in three months and the self-assessment shows several controls at level 1. How would you decide between postponing the audit and accepting a likely minor non-conform result with temporary labels?
A customer asks you to send them your full TISAX report by email. How would you respond, and which sharing level would you offer through the portal instead?