TISAX (Trusted Information Security Assessment Exchange)
TISAX (Trusted Information Security Assessment Exchange) is the automotive industry’s assessment and exchange scheme for information security. It assesses how a company handles confidential information: design data, production information, prototypes, customer data. The ENX Association runs TISAX. The first participants registered in 2016.
How does a TISAX assessment work?
The process has three steps. First the company registers and defines the assessment scope: sites, processes and protection needs. Then an approved audit provider runs the assessment. It starts with a self-assessment against the ISA catalogue, followed by the external audit. Finally the company shares the result with its partners via the ENX portal.
How thorough the audit is depends on the protection needs. TISAX has three assessment levels. Level 1 is a plain self-assessment. Level 2 checks plausibility, with interviews usually held by video conference. Level 3 is a thorough check that includes an on-site inspection.
The outcome is a set of labels for individual assessment objectives, for example “Confidential”, “Strictly confidential” or “Proto parts”. They are valid for three years.
The VDA ISA catalogue
Every assessment is based on the ISA requirements catalogue (Information Security Assessment). The ENX Working Group ISA maintains it, and the VDA publishes it as VDA ISA. The first versions were closely based on ISO/IEC 27001. Today ENX regards the catalogue as an industry standard in its own right that stays aligned with ISO/IEC 27001.
From 1 January 2027, newly ordered assessments use ISA2027. From this version on, a new catalogue appears every year, with the year in its name. Where protection needs are high, ISA2027 asks for more evidence that a company’s own suppliers are secure. It also revises the references to other standards, including ISO/IEC 27001:2022, NIST CSF 2.0 and IEC 62443.
TISAX is not vehicle cybersecurity
TISAX and ISO/SAE 21434 are both about security, and both are aimed at suppliers. But they assess different things. TISAX assesses a company’s information security management system. ISO/SAE 21434 and UNECE R155 concern the cybersecurity of the vehicle and its components. Their central analysis is the Threat Analysis and Risk Assessment (TARA).
A TISAX label says nothing about whether an ECU is protected against attacks. And a good TARA says nothing about how securely a plant handles prototypes. So when a request comes in, first clarify which of the two questions it means.
Our Cyber Security page shows how the frameworks of vehicle cybersecurity fit together.