The request usually arrives from a customer. An enterprise buyer in the United States asks for a SOC 2 report. A European customer asks for the ISO 27001 certificate. Then a German carmaker, or a tier one supplier to one, asks for a TISAX label, and a company that thought it had information security covered discovers a third framework with its own vocabulary, its own platform and its own rules about who can assess you.
The three overlap heavily in their controls, and a company that runs one well has done much of the work for the others. But they are not interchangeable, because they produce three different kinds of result: a certificate, an attestation report and an assessment label. Understanding that difference is what lets a company reuse its work instead of starting three separate projects.
Three frameworks, three kinds of result
ISO 27001 is an international standard for an information security management system. An accredited certification body audits the organisation and, if it conforms, issues a certificate valid for three years, with surveillance audits in the intervening years. The certificate states a scope and can be shown to anyone. Its strength is that it proves a management system exists and is maintained: risk assessment, internal audit, management review and continual improvement.
SOC 2 is not a certification at all. It is an attestation engagement under the standards of the AICPA, in which a licensed CPA firm examines controls against the Trust Services Criteria and issues a report with its opinion. A Type I report covers control design at a point in time; a Type II report covers operating effectiveness over a period, usually several months to a year. The report is shared with customers, usually under a non disclosure agreement, and North American buyers often ask for it by name.
TISAX, the Trusted Information Security Assessment Exchange, is an assessment and exchange mechanism for the automotive industry, created by the German automotive association VDA and operated by the ENX Association. An audit provider accredited by ENX assesses the organisation against the VDA ISA catalogue, and the result is a label registered on the ENX portal. The company then decides which partners can see it. TISAX exists so that a supplier can be assessed once and share the result with every carmaker that asks, rather than being audited by each of them.
Where the three overlap
The common ground is large because all three describe the same underlying security practice. The VDA ISA catalogue is built on ISO 27001, and the SOC 2 common criteria cover much of the same territory as Annex A. A company with a working ISMS will recognise most of what the other two ask for.
- Governance: an approved security policy, defined roles and responsibilities, management involvement and periodic review appear in all three.
- Risk management: ISO 27001 requires a repeatable risk assessment, SOC 2 includes risk assessment in its common criteria, and VDA ISA asks for risk management of information security.
- Asset and access control: inventories of information assets, classification, access rights based on need, privileged access management and regular access reviews.
- Operations security: vulnerability and patch management, malware protection, logging and monitoring, backups and change management.
- Suppliers: security requirements for suppliers and service providers, and oversight of them.
- Incidents and continuity: incident handling, lessons learned and business continuity planning.
- People: awareness training, confidentiality agreements and joiner, mover and leaver processes.
The differences in this shared ground are mostly of emphasis and wording. VDA ISA asks about the maturity of each process, SOC 2 asks whether a control operated throughout the period, and ISO 27001 asks whether a selected control is implemented and justified by risk. The same access review, for example, can satisfy all three if it is performed on schedule, recorded with dates and owners, and its exceptions are followed up.
In practice this means one control set, documented once and mapped to all three, can carry most of the evidence. The AICPA publishes mapping material between the Trust Services Criteria and other frameworks, and VDA ISA references its ISO 27001 origins in the catalogue. The same logic of one documentary base serving several audits applies when ENS is in the picture, as described in running ISO 27001 and ENS as a single programme.
What TISAX adds
TISAX is not simply ISO 27001 with an automotive badge. Several of its requirements have no direct counterpart in the other two, and companies that assume their ISO certificate will carry them through are usually surprised at the assessment.
Assessment objectives and labels
Before an assessment, the company chooses its assessment objectives, which determine which parts of the VDA ISA catalogue apply and which labels it can obtain. Under VDA ISA version 6, mandatory for assessments since April 2024, the objectives cover information with high and very high protection needs, availability, prototype protection and data protection. The customer's contract or request usually states which objectives it requires, so the scope is driven by the carmaker, not chosen freely by the supplier.
Each label is tied to a defined scope, commonly one or more locations, and is valid for three years. Unlike an ISO 27001 certificate, there are no annual surveillance audits in between, but corrective action plans for findings must be closed within agreed periods for the label to be issued or kept. The label is visible only to the partners the company chooses to share it with through the ENX portal.
Assessment levels
TISAX has three assessment levels. Assessment level 1 is a self assessment and does not produce a TISAX label, which is why carmakers rarely accept it. Assessment level 2 is a plausibility check by an accredited audit provider, usually remote, with interviews and a review of evidence. Assessment level 3 is a thorough verification, including an on site visit, and is required for very high protection needs and for prototype protection.
The level is set by the protection need of the information the supplier handles, not by the supplier's preference. A supplier that handles only internal design data may need level 2; one that works with prototype vehicles or components will need level 3. Moving from level 2 to level 3 later means a new assessment, not an extension of the existing label.
Prototype protection and maturity levels
The prototype protection module is the clearest example of something ISO 27001 does not cover by default. It asks for physical and organisational measures around prototype parts and vehicles: secured areas, controlled access, camouflage and transport rules, protection of test vehicles on public roads, and rules for events and photo shoots. A company that never handled prototypes has never needed these controls, and they cannot be inferred from an ISMS.
VDA ISA also scores each control on a maturity scale from 0 to 5, and the general target is level 3, meaning the process is defined, documented and applied consistently. That is a different question from an ISO audit, which asks whether a requirement is met. A control that exists but runs informally can pass an ISO sample and still fall short of the maturity TISAX expects.
How a TISAX assessment works
The process starts on the ENX portal. The company registers as a participant, accepts the TISAX terms and defines its assessment scope: which locations are included and which assessment objectives apply. ENX then confirms the registration and the scope, and the company receives the identifiers that the audit provider and, later, its customers will use to find the result.
Before the audit provider arrives, the company completes a self assessment against the VDA ISA catalogue, control by control, scoring its own maturity. This is not a formality. The self assessment is the document the audit provider works from, and a company that scores itself generously will see the gap exposed in interviews and evidence review. The company then selects an audit provider from those accredited by ENX and agrees dates for the assessment at the required level.
The assessment produces a report and, where controls fall short, findings that must be addressed through a corrective action plan agreed with the audit provider. Depending on the severity of the findings, a temporary label may be issued while corrections are completed, followed by the full label once they are verified. The result is registered on the ENX portal, and the company shares it with the customers that need to see it. The ENX participant handbook sets out each step and the rules that apply to it.
What SOC 2 adds
SOC 2 has its own specifics. The scope is defined by a system description written by the company and by the Trust Services Criteria it selects: Security is always included, and Availability, Processing Integrity, Confidentiality and Privacy are added when they match the commitments the service makes to customers. The scoping choices are explained in detail in the five SOC 2 Trust Services Criteria.
The other difference is time. A Type II report covers a period during which the auditor tests that controls operated, which means evidence has to be produced continuously across that period rather than gathered before a single audit. Companies coming from ISO 27001 often underestimate this: an ISO surveillance audit samples the system once a year, while a Type II engagement looks at how controls behaved month by month. That gap between periodic and continuous evidence is examined in what a certification audit actually tests.
What ISO 27001 adds
Of the three, ISO 27001 is the only one that requires a complete management system: context and interested parties, leadership, a documented risk assessment methodology, a Statement of Applicability, measurable objectives, internal audit, management review and continual improvement under clauses 4 to 10. SOC 2 and TISAX assess controls and, in the case of TISAX, their maturity; neither requires the full governance cycle in the same form.
That is why ISO 27001 often works best as the foundation. A management system gives the other two something stable to sit on: the risk assessment justifies the controls, the internal audit checks them, and the management review keeps them current between external assessments. Without it, SOC 2 and TISAX tend to become two separate preparation exercises that both decay after the auditor leaves.
A sensible order for tackling them
The right order depends on who is asking and when. If an automotive customer requires a TISAX label by a contractual date, TISAX leads, and the work focuses on the chosen assessment objectives, the required level and, where relevant, prototype protection. If a North American customer requires SOC 2, the clock of the Type II observation period usually decides the timeline. Where there is no single urgent request, starting with ISO 27001 builds the management system the other two can reuse.
Whatever the order, three principles keep the work from tripling. Build one control set and map each control to ISO 27001 Annex A, the Trust Services Criteria and the VDA ISA catalogue from the start. Collect evidence continuously, because SOC 2 Type II needs it over a period and TISAX maturity is judged on consistent practice. And keep the scopes aligned, or at least explicitly documented, so that a location in the TISAX scope and a system in the SOC 2 description are not described differently in each programme.
Common mistakes when adding TISAX
The most frequent mistake is assuming an ISO 27001 certificate replaces TISAX. It does not: carmakers ask for the label specifically, and the assessment covers requirements, such as prototype protection and maturity levels, that the certificate does not evidence. The ISO work shortens the path considerably, but it does not remove it.
The second is choosing the assessment level or objectives without checking the customer's actual requirement, which can mean a level 2 assessment that the customer then rejects, followed by a new level 3 assessment. The third is treating the three year validity as three quiet years. The label does not lapse during that time, but the customer relationship can change, new objectives can be requested, and an assessment started late can leave the supplier without a valid label when the old one expires. Planning the renewal well before expiry, and keeping the controls operating in between, is part of the work. For a wider view of how these programmes are run day to day, see the compliance operations hub.
