TISAX (Trusted Information Security Assessment Exchange) is the binding information security standard of the German automotive industry, developed by the VDA. It is based on ISO/IEC 27001 and the VDA ISA questionnaire and defines how suppliers must demonstrate the protection of sensitive information. Results are shared exclusively via the ENX platform - not publicly accessible.
TISAX labels are valid for three years - after which a full recertification is required.
Results are shared exclusively via the closed ENX platform - there is no public certificate.
Mandatory for suppliers of BMW, VW, Mercedes-Benz, Porsche, Audi, Bosch, Continental, and other OEMs.
| Criterion | TISAX® | ISO 27001 |
|---|---|---|
| Industry focus | Automotive | Cross-industry |
| Framework basis | VDA ISA + ISO 27001 | ISO 27001 |
| Evidence type | Label via ENX platform | Public certificate |
| Pentest mandatory | ✓ From AL 2 | — Optional |
| Validity | 3 years | 3 years (annual surveillance) |
TISAX distinguishes three protection requirement levels. Your OEM specifies which level you must meet. We conduct penetration tests for all three assessment levels.
For organisations processing confidential information without particularly sensitive content. A qualified self-assessment is generally sufficient - a pentest is nonetheless recommended as voluntary evidence.
For organisations handling highly sensitive information such as development data or vehicle concepts. An external auditor and a technical penetration test are mandatory.
For organisations working with prototypes and strictly confidential data. The highest requirements for physical and technical security apply. Multiple audits by accredited bodies are mandatory.
The VDA ISA questionnaire covers all security-relevant areas. Our pentest delivers the technical evidence for the following controls - ready for direct use with your ENX auditor.
Evidence of a functioning ISMS: policies, roles, responsibilities, and awareness measures in line with VDA ISA Chapter 1.
Access control, building security, secure disposal of storage media, and protection of server rooms in line with VDA ISA Chapter 3.
Network segmentation, vulnerability management, patch management, access control, and logging in line with VDA ISA Chapter 4.
Special protection for prototype vehicles and components: covers, camouflage, secure storage, transport, and access control to prototype areas.
Processing of personal data in the automotive context: consent, deletion concepts, and technical protective measures in line with VDA ISA Chapter 6.
Security requirements for service providers and sub-suppliers: contracts, audits, remote access, and security clauses in line with VDA ISA Chapter 7.
TISAX is mandatory for all organisations that process confidential information from OEMs or Tier-1 suppliers - regardless of company size or headcount.
We guide you from scope definition to an audit-ready report - structured, on time, and fully aligned with the VDA ISA questionnaire.
Joint definition of TISAX assessment objectives, assessment level, systems in scope, and timeline. Exclusion zones are documented as binding commitments.
OSINT, network analysis, physical building walkthrough, and system inventory in line with the VDA ISA assessment catalogue.
Infrastructure pentest, Active Directory analysis, physical security assessment, and social engineering in line with VDA ISA requirements.
All findings are mapped directly to the corresponding VDA ISA controls - for maximum auditability and minimum effort during the ENX audit.
Detailed pentest report with CVSS ratings, VDA ISA mapping, prioritised remediation recommendations, and an executive summary for senior management.
We combine physical, digital, and social engineering attack vectors into a comprehensive TISAX assessment - everything from one provider, everything VDA ISA-mapped.
Access control, tailgating, lock bypass, camera blind spots, and prototype areas: we test whether your physical security holds up under TISAX AL 2 and AL 3 requirements.
Learn moreNetwork segmentation, patch status, Active Directory security, and remote access: technically verified and directly mapped to VDA ISA Chapter 4.
Learn morePhishing, vishing, and pretexting targeting your employees: we test the human firewall that VDA ISA Chapter 1 requires as a central protective measure.
Learn more
Think like an Attacker, Act as a Partner