Who needs it
Suppliers and service providers to car manufacturers and large automotive suppliers, especially German ones, when they handle confidential information, prototypes or personal data on their behalf. Customers usually make a TISAX label a contractual requirement, and it is increasingly requested from IT, engineering, design and logistics companies, not only parts makers.
How it works
TISAX is run by the ENX Association on behalf of the German Association of the Automotive Industry (VDA). The company registers, defines the scope and the assessment objectives it needs, completes a self assessment against the VDA ISA questionnaire, and is then assessed by an accredited audit provider. The result is published on the exchange platform as labels, which the company can share with its customers. Labels are valid for three years.
Assessment levels
There are three assessment levels, set by the sensitivity of the information involved. Level 1 is essentially a self assessment, mainly for internal use. Level 2 is usually a remote assessment with document review and interviews, used for high protection needs. Level 3 is an on site assessment for very high protection needs, such as prototypes.
TISAX and ISO 27001
The VDA ISA catalogue is based on ISO 27001 and ISO 27002, with additional requirements for prototype protection and data protection. Companies with ISO 27001 have a strong starting point, but TISAX is a separate assessment and the certificate does not replace it.
