TISAX for Automotive Suppliers: Assessment Levels, Labels and Development Data

The request usually arrives as one line in a purchasing questionnaire or an NDA annex: please share your TISAX assessment result. For a Tier-2, a software house or an engineering partner seeing it for the first time, the vocabulary is the first obstacle: assessment objectives, labels, AL2, standard scope. This post explains TISAX as the ENX Association describes it in its TISAX Participant Handbook, where it overlaps with ISO/IEC 27001, and why it does not replace product cybersecurity under ISO/SAE 21434 and UNECE R155. It summarises public sources as of October 2026 and is not legal or audit advice.

What TISAX Is and Who Asks for It

TISAX, the Trusted Information Security Assessment Exchange, is how the automotive industry assesses a company’s information security and shares the result. The ENX Association governs it. The requirements come from the Information Security Assessment (ISA) catalogue, which ENX maintains and the VDA, the German automotive industry association, publishes. An ENX-approved audit provider assesses the supplier once. The supplier can then share that result with any number of partners through the ENX portal, instead of being audited separately by each customer.

TISAX is contractual, not statutory. No law requires it. It becomes mandatory when a customer writes it into a contract or purchasing condition, typically before sharing confidential development data, prototype parts or test vehicles. ENX’s handbook describes the usual trigger the same way: a partner asks the supplier to prove a defined level of information security management against the ISA. TISAX calls the assessed company an “active participant” and the company receiving the result a “passive participant”. One company can be both. A Tier-1 can share its own result with an OEM and also require its suppliers to be assessed if they handle the OEM’s information.

Assessment Levels: AL1, AL2 and AL3

TISAX has three assessment levels. The level sets the methods the audit provider must use, not the content of the requirements.

• AL1: self-assessment only. An auditor checks that a completed self-assessment exists but does not assess what it says. ENX states that AL1 results have a low trust level and are not used in TISAX, so AL1 produces no label.
• AL2: plausibility check.The audit provider checks the self-assessment for every location in scope for plausibility, looks at evidence, and interviews the person responsible for information security, usually by web conference. An on-site inspection happens only if you ask for one, for example to show evidence that cannot leave your premises. ENX describes a variant sometimes called “AL 2.5”, which replaces the plausibility check with a full remote assessment. It is formally graded as AL2 and is easier to upgrade to AL3 later.
• AL3: comprehensive verification. The auditor examines documents and evidence, interviews process owners, observes local conditions and how processes are carried out, and holds unplanned interviews with staff. The audit provider has to come on site. If that is temporarily impossible, a video-supported remote method can be used, but it is recorded as a minor non-conformity and must be followed by an on-site assessment later.

You do not pick the level freely. It follows from the assessment objectives, and an AL3 result automatically satisfies requests for AL2. ENX notes that choosing AL3 instead of AL2 is not uncommon, because the AL2 plausibility check can call for a more complete self-assessment and better internal documentation.

Assessment Objectives and Labels

At registration you select one or more assessment objectives. If you pass, you receive the matching TISAX labels. Version 2.8 of the handbook lists twelve objectives. The ten in current use are shown below with the level each requires. The two legacy objectives, “Info high” (AL2) and “Info very high” (AL3), could only be selected until 31 March 2024.

Some labels nest. “Strictly confidential” includes “Confidential”, “Very high availability” includes “High availability”, and “Special data” includes “Data”. Holders of the legacy “Info high” and “Info very high” labels also hold the matching confidentiality and availability labels, and passing “Proto vehicles” also earns the label for prototype parts and components. The split into separate confidentiality and availability labels came with ISA version 6, from 1 April 2024. It separates suppliers that hold a customer’s trade secrets from suppliers whose failure would stop a production line, because the two need different controls. The data-protection labels refer to GDPR Articles 28 and 9.

Validity, Temporary Labels and the ISA Version

TISAX labels are generally valid for three years from the end of the assessment process. That can be cut short by a significant change to the scope, such as moving to a new site or adding a location. There is no lighter renewal track: to keep a label, you register a new scope and are assessed again. If your overall result is “minor non-conform” and your corrective action plan is accepted, you receive temporary labels. They last up to nine months after the closing meeting of the initial assessment, depending on the longest implementation period in the plan. ENX does not issue a certificate. Labels are visible only in the ENX portal.

The catalogue itself is changing. ENX published VDA ISA2027 on 1 July 2026. It applies to assessments ordered from 1 January 2027, and assessments ordered before then can still use ISA 6. Future versions will be named after the year they take effect and published each summer. Existing labels stay valid for their full term, and labels will still be valid for up to three years. TÜV NORD’s summary of the changes lists updated references (ISO/IEC 27001:2022, NIST CSF 2.0 and IEC 62443), stronger supply-chain requirements for high and very high protection needs, and a restructured prototype-protection section.

The TISAX Process, Step by Step

ENX describes three steps: registration, assessment and exchange. In practice they break down into five stages:

1. Registration. Register online with ENX (a fee applies) and accept the TISAX participation terms. Define the assessment scope, select the assessment objectives and list the locations. Use the standard scope: ENX calls it the right choice for well over 99% of participants, and other participants only accept results based on it.
2. Preparation. Complete a self-assessment against the ISA for your objectives. The ISA rates each control question on a maturity scale from 0 to 5, and the handbook describes a target maturity level of 3 for every question.
3. Audit provider selection.Choose one of ENX’s approved TISAX audit providers and sign a separate contract with it.
4. Assessment.The initial assessment comes first. If there are non-conformities, you submit a corrective action plan for the provider to assess (no implementation period can exceed nine months), followed by a follow-up assessment. A “minor non-conform” result can bring temporary labels in the meantime.
5. Exchange. Publish the result to all participants, share it with specific partners using their TISAX Participant ID, or both. You decide how much of the report each partner sees, from basic scope information through summarised results and maturity levels to the detailed findings.

ENX does not forecast how long the process takes, saying there are too many factors to do so reliably. We do not either. The real answer depends on how mature your information security management system is when you start.

TISAX vs ISO/IEC 27001 vs ISO/SAE 21434 and R155

Supplier questionnaires often mix these three up. They answer different questions.

TISAX and ISO/IEC 27001 overlap heavily. ENX explains that the ISA was created to adapt general information security management standards such as ISO/IEC 27001 to the automotive industry’s needs. The scoping rules differ, though. Under ISO/IEC 27001 you define the ISMS scope and the audit covers exactly that. Under TISAX the assessment scope is predefined: it must fall within your ISMS scope but can be smaller. TISAX also adds automotive-specific requirements, such as prototype protection, and its own exchange mechanism. An ISO/IEC 27001 certificate is a strong starting point, but it is not a TISAX label. If a partner asks for a label, you still need a TISAX assessment.

The difference from ISO/SAE 21434 and R155 is one of kind, not degree. TISAX asks whether the supplier, as an organisation, protects its customer’s information. ISO/SAE 21434 asks whether the product is engineered to be secure. R155 asks whether the vehicle manufacturer manages cyber risk across the vehicle type. A TISAX label says nothing about how well an ECU resists attack, and a cybersecurity case says nothing about who can open the shared design folder. Many suppliers need both, and some in Germany also fall under NIS2. Our post on NIS2 for automotive suppliers covers that legal layer.

Sharing Development Data with a Supplier or Engineering Partner

For an OEM or Tier-1, the practical question is what to require before handing over development data: specifications, CAD, firmware images, TARA documents, test benches or prototype hardware. TISAX gives you a vocabulary for that decision but does not make it for you.

• Classify first.The label follows the classification of the information. ENX’s guidance links “Confidential” to information classified as confidential and “Strictly confidential” to information classified as strictly confidential or secret, and refers to the VDA white paper on harmonising classification levels. Decide explicitly where security-relevant material, such as unreleased firmware, key-management designs and vulnerability findings, sits in your own scheme. That decision sets the label you ask for.
• Match the labels to what physically moves. Hardware prototypes at the partner’s site bring in the prototype-protection labels. Personal data processed on your behalf brings in “Data” or “Special data”. Information on its own needs the confidentiality labels.
• Check the location. Labels cover the locations in the assessed scope. Confirm that the site and team who will actually handle your data are inside that scope, and check the result in the ENX portal rather than relying on a logo or a PDF.
• Agree how the data will move.A label shows that the partner’s ISMS meets the ISA. It does not define how your project’s data is exchanged. Write access rights, transfer channels, retention and deletion into the contract or the NDA annex.
• Decide how to handle gaps.If a partner’s assessment is still in progress, temporary labels from a “minor non-conform” result may be enough for you. Whether anything short of a label is acceptable is for the data owner to decide under its own policy.

For our part, Agnile runs its operations under an ISO/IEC 27001:2022-certified information security management system (certificate No. 25110402), alongside ISO 9001:2015 (No. 25110401). Our security and trust page lists those certifications and our security posture. If your programme requires a TISAX label from every partner that handles the data, make that a scoping question for every engineering partner, including us, and check the answer in the ENX portal.

Take-Aways

TISAX is a contractual information-security assessment, governed by ENX and based on the VDA ISA. Its result is shared with partners, not issued as a certificate. The assessment objectives set the level: AL2 for confidential information, high availability, test vehicles, events and personal data; AL3 for strictly confidential information, very high availability, physical prototypes and special categories of personal data. Labels last up to three years, and from 2027 the catalogue is updated every year. TISAX is about how a company handles information, not how secure its products are. Keep it separate from ISO/SAE 21434 and R155 in your planning, and from NIS2 in your legal register. For how these instruments fit together, see the automotive cybersecurity regulations map. For the vehicle-approval side, see KBA type approval for cybersecurity.

Primary sources: ENX: TISAX, TISAX Participant Handbook (version 2.8), ENX: VDA ISA2027 released. Label names, levels and rules follow the handbook version cited and can change with later ISA releases. Confirm current requirements with ENX and your audit provider. TISAX® is a registered trademark of the ENX Association. This article is not legal or audit advice.

Agnile Technologies provides automotive penetration testing and ISO/SAE 21434 engineering support to OEMs and Tier-1 suppliers. Its own operations run under ISO/IEC 27001:2022 and ISO 9001:2015 certification.