What Is TISAX? Assessment Process and Preparation Guide

An automotive customer requires TISAX, but your business is unsure whether it needs AL2 or AL3, which records to prepare or how to budget. First, establish the customer's requirements and the assessment scope. This provides the basis for a suitable information security management improvement plan.

This article explains the key concepts, suggests a preparation checklist and outlines how businesses in Vietnam can organise the work. The content was reviewed on 19 October 2026 and includes the implementation date for ISA2027.

What is TISAX?

TISAX stands for Trusted Information Security Assessment Exchange. It is an automotive industry mechanism for assessing and exchanging information security results, managed by the ENX Association. Assessments use the ISA criteria catalogue, and results are shared with partners through the ENX Portal. (ENX — About TISAX)

People often search for “TISAX standard” or “TISAX certification”. The distinction matters: TISAX is an assessment and exchange mechanism, while ISA is the catalogue of assessment criteria. ISA is developed and maintained by the ENX Working Group ISA and published by the VDA as VDA ISA. (ENX — ISA)

For a business, the practical questions are: which information needs protection, which departments handle it, are the existing measures effective and is there evidence to demonstrate this?

Which businesses should prepare for TISAX?

Start with the requirements in contracts, supplier selection documents or customer notices. Clarify these before setting project objectives. Situations that merit an immediate review include:

• Receiving drawings, design data or unreleased product information from automotive customers.

• Providing engineering, software or system operation services with access to customer information.

• Having several factories, offices or contractors involved in handling project data.

• Being asked by a customer to provide TISAX results before a supplier approval deadline.

Bring each customer's requirements together in a table showing the objective, relevant locations, deadline and person confirming the requirement. This helps avoid an incomplete scope or a project larger than the actual need.

How do TISAX AL2 and AL3 differ?

The assessment level describes how the assessment is performed; it is not a system maturity score. Confirm the assessment objectives and scope rather than asking only whether to “do AL2 or AL3”. (ENX — TISAX Participant Handbook)

The VDA ISA2027 update and assessment planning

ISA2027 was published in 2026. It applies to TISAX assessments ordered from 1 January 2027. (ENX — VDA ISA2027)

If the project extends into 2027, obtain written confirmation from the audit provider of the assessment order date, applicable ISA version and initial assessment schedule. Do not select the version solely from the date consultancy begins. Keep the ISA version in use together with its download date to prevent departments from self-assessing against different versions.

The TISAX assessment process and project organisation

The process covers scope registration, selection of an ENX-approved audit provider, assessment and exchange of results. ISA self-assessment is an important preparation activity. (ENX — About TISAX) A business can organise the work into the following steps. These are implementation planning steps, not additional TISAX assessment levels.

Step 1. Clarify customer requirements

List the information to protect, participating locations, required results and completion deadline. Appoint a customer contact to resolve uncertainties. The output should be a confirmed requirements table with an owner for each item.

Step 2. Confirm the scope and ISA version

Map information flows from receipt through storage, use, sharing and disposal. Identify where data is held, who has access and which service providers are involved. Use the map to discuss the scope and applicable version with the audit provider.

Step 3. Self-assess and identify gaps

For each applicable requirement, record the current practice, responsible person and evidence location. Clarify answers that state only “implemented”. Prioritise actions according to risk, implementation time and dependencies between departments.

Step 4. Implement measures and retain operational evidence

Update procedures together with system configurations, user training and site checks. For example, after revising an account revocation procedure, examine an actual employee departure to check whether the procedure was followed completely and on time.

Step 5. Prepare for the assessment

Agree the schedule, contacts and method of providing evidence. Prepare a document index for quick retrieval while controlling access and sensitive data. Responsible personnel should be able to explain actual practice rather than simply read a procedure.

Step 6. Correct findings and check effectiveness

For each finding, establish the cause, action, responsible person and completion evidence. For a recurring issue, also check departments or locations with similar conditions. Agree corrective action timing and verification with the audit provider.

Step 7. Complete the exchange of results and maintain the system

Check that partners have received the required results. After the project, include access reviews, exercises, training and change management in routine schedules. Consider the effect on the assessed scope when locations, systems or information processing activities change.

TISAX preparation checklist: records and evidence

The table below suggests how to organise the work. It is not a mandatory document list for every business; check each applicable ISA requirement against the agreed objectives and scope.

Preparation example at a component factory

Illustrative example: a factory receives customer drawings, passes them to engineering to prepare instructions and shares some data with a subcontractor. A review finds that too many people can access the project folder and a former employee's account remains active.

The improvement plan should identify the folder owner, establish role-based access, revoke the account, check external data recipients and define project closure. Evidence should show that access rights changed in the system, that changes were approved and that a follow-up check took place. A newly issued but unused procedure would not resolve the situation.

What costs should a TISAX budget cover?

One price should not be assumed for every factory. Clarify the scope, number of locations, protection objectives and current system condition when requesting quotations. Audit providers need this information to determine the work and appropriate fees. (DQS — TISAX assessment)

Compare quotations for the same scope and separate assessment fees from consultancy, infrastructure and internal resource costs. Cutting essential activities merely to reduce the budget on paper may create urgent corrective work before the assessment.

How long does TISAX preparation take?

Prepare a schedule after understanding the actual gaps and the audit provider's availability. A stable, established system requires different work from a factory with inadequate account controls, backups or contractor management. Procurement, construction and coordination across several locations often have a substantial effect on timing.

A useful approach is to work backwards from the customer's deadline for results: allow time for corrections, confirm the assessment schedule, provide an operating trial period and confirm procurement activities. Each task should have an owner and clear completion criteria. Update the estimated schedule when the scope changes.

Frequently asked questions about TISAX

Do we still need TISAX if we have ISO 27001?

ISO/IEC 27001 and TISAX both concern information security, but their assessments and outputs differ. Check the customer's TISAX requirements. An ISO 27001 system can support preparation but does not automatically replace TISAX results. (DQS — TISAX assessment)

How long is a TISAX label valid?

TISAX labels normally have a three-year validity period. Check the dates for the specific result in the ENX Portal; temporary labels have their own conditions and validity periods. (ENX — TISAX Participant Handbook)

Does AL2 mean that documents alone are sufficient?

No. The self-assessment must be supported by appropriate evidence. Be prepared to explain how work is performed, who is responsible and the review results, rather than supplying only a list of procedures.

Do we need new software to prepare for TISAX?

Assess the existing system's adequacy and risks before deciding to invest. A new tool is useful when it addresses a specific gap and has people responsible for operating and monitoring it. Consider configuration, processes, staff competence and ongoing costs.

What should we provide when requesting TISAX consultancy?

Provide the customer requirements, number of locations, types of information handled, current IT environment, management systems in use and deadline for results. During initial discussions, describe the data rather than immediately sending drawings or confidential documents.

How ITVC can support your TISAX preparation

Topics may include a review of current arrangements, organising the self-assessment, guidance on records and evidence, assignment of responsibilities and preparation for working with the audit provider. Confirm the specific service scope in the proposal and contract. Independent assessment is performed by an ENX-approved TISAX audit provider.

Related reading: ITVC Global's TISAX consultancy services.