Trusted Information Security Assessment Exchange (TISAX)

TISAX (Trusted Information Security Assessment Exchange) is the information security assessment and exchange mechanism used across the automotive industry. It is based on the VDA Information Security Assessment (VDA ISA) catalogue and governed by the ENX Association. Organisations are assessed once and share the result with any partner who needs it.

Any organisation that handles sensitive information or prototypes for automotive manufacturers or their suppliers may be asked for a TISAX label. That includes Tier 1, Tier 2 and Tier 3 suppliers, engineering and design partners, software providers and mobility service firms.

TISAX is often searched for as TISAX certification, but it results in a label rather than a certificate. After a successful assessment, ENX issues TISAX labels that reflect your assessment objectives, and you share them with partners through the ENX portal.

ISO 27001 is an international information security management standard for any sector. TISAX is specific to the automotive industry. Its VDA ISA catalogue is based on ISO/IEC 27001 and 27002 but adds requirements such as prototype protection, connection to third parties and data protection, so ISO 27001 certification alone does not lead to a TISAX label.

AL2 is a plausibility check of your self-assessment and evidence by an independent assessor, usually carried out remotely. AL3 is a comprehensive assessment that includes on-site inspection. Your assessment objectives determine which level you need.

TISAX labels are valid for three years if nothing changes in your scope. To keep a current label, you need to be reassessed before it expires or when something changes in your TISAX scope.

Yes. LRQA does not provide consultancy to the organisations it assesses for TISAX, so your assessment is carried out impartially and your result stands on its own.