TISAX (automotive supply chain information security assessment), explained

Per ENX's own page, TISAX "was developed to create a standardized and scalable approach to information security in the automotive industry," covering the protection of "design data, production information, customer information, prototypes, and intellectual property" that flows between OEMs and their supplier base. The scheme is maintained through industry collaboration — ENX states it is "continuously developed by automotive manufacturers, suppliers, and audit providers working together in expert groups and committees" — rather than being a fixed standard an outside body wrote once and left alone. The actual assessment content is the separate VDA ISA catalogue, which ENX describes as serving as the requirements framework for assessments; TISAX itself is the governance, process and label-exchange layer sitting on top of that catalogue.

ENX's own page describes the process in four stages: registration (defining the assessment's scope — which locations, which protection goals, such as confidentiality of prototypes or protection of personal data), provider selection (choosing an ENX-approved audit provider), assessment (a combination of self-assessment against the VDA ISA questionnaire and, depending on the assessment level, external verification), and exchange of results via the ENX Portal, where the resulting TISAX label is valid for three years and can be securely shared with the specific partner companies the assessed organization selects — it isn't a public certificate list by default.

The AL1/AL2/AL3 distinction is about how rigorously a given scope is checked, not a different requirements catalogue for each level:

A supplier handling unreleased vehicle prototypes or classified OEM data should expect to be pushed toward AL3 by the OEM's own scope requirements regardless of company size, since prototype protection is treated as inherently high-risk rather than negotiable down to AL2.

Independently of which AL level applies, each individual VDA ISA control gets scored on a capability-maturity scale modeled on CMMI-style process maturity, roughly: 0 (no process exists), 1 (ad-hoc and unstructured), 2 (planned and tracked, with assigned responsibility), 3 ("Established" — a standardized, documented process consistently applied, not just written down), 4 (measured with quantitative metrics), and 5 (subject to continuous, data-driven improvement). The VDA ISA catalogue splits requirements into "must" and "should" categories, and the consistent account across this guide's secondary sources is that an organization's applicable "must" controls generally need to reach at least maturity level 3 without open non-conformities to receive a label — a control scoring below that threshold becomes a documented finding rather than an automatic failure of the whole assessment, but enough open findings can still block the label.

The detail most worth tracking for anyone commissioning an assessment around this guide's publication date: per ENX's own portal downloads page, the current catalogue, ISA 6.0.3 (dated 2024-04-25), has applied to assessments starting after 1 April 2024. A successor catalogue, ISA2027.1 (dated 2026-07-01), is already published on the same ENX page and is described there as the basis for "TISAX Assessments ordered in 2027." ENX's page states the final date to open an initial assessment under the ISA 6 catalogue is March 2027, after which ISA2027 becomes the sole active version. Independent secondary reporting adds that ISA2027 also drops the old incremental version-numbering convention in favor of year-based naming and moves to an annual summer release cadence — but the commissioning date, not the publication date of whichever catalogue is newest, is what determines which version a given assessment is actually run against. A supplier planning an assessment in late 2026 should confirm with its chosen audit provider whether the order date puts it under ISA 6.0.3 or the incoming ISA2027 catalogue before preparing evidence against the wrong version's control set.

TISAX is automotive-sector-specific and runs on its own VDA ISA questionnaire rather than directly certifying against a general ISO management-system standard — it is not the same instrument as ISO/IEC 27001 certification, though organizations that already run an ISO/IEC 27001 ISMS typically find substantial control overlap and can reuse much of that documentation as TISAX evidence. For suppliers whose products are industrial-automation components rather than purely information-security scope, TISAX also doesn't substitute for the IEC 62443 series' own certification schemes (see IEC 62443-4-1 and IEC 62443-4-2) — a supplier selling both into general automotive OEM relationships and into industrial/OT buyers may need to maintain both tracks rather than assuming one covers the other.