Governance, Risk & Compliance

TISAX Readiness Consulting for Automotive Suppliers

Prepare for your TISAX assessment with a clear scope, controls that match the VDA ISA catalogue and evidence your audit provider can verify.

Discuss your TISAX scope

Illustrative scene with the ALPHASEC team · An ISMS lead and control owner reviewing the SoA and supporting evidence — The organisation selects a material risk and the control intended to treat it.

ISMS Implementation
Internal Audit
Certification Readiness

TISAX explained

What is TISAX?

TISAX (Trusted Information Security Assessment Exchange) is the information security assessment and exchange mechanism used across the automotive industry. It is governed by the ENX Association and based on the VDA Information Security Assessment (VDA ISA) catalogue. Vehicle manufacturers and Tier 1 suppliers often ask suppliers, engineering partners and service providers for a TISAX label before sharing confidential data or prototypes.

Assessment objectives and levels

Information security: for information with high or very high protection needs.
Prototype protection: for prototype parts, components and vehicles, including test vehicles and events.
Data protection: where personal data is processed on behalf of a customer.
Assessment levels: AL1 is a self-assessment, AL2 is a plausibility check by an audit provider and AL3 is a comprehensive assessment, usually on site. Your customer decides which objectives and level are required.
Results: labels are shared with your customers through the ENX portal and are generally valid for three years.

How ALPHASEC helps

Scope and objectives: confirm customer requirements, sites, assessment objectives and the expected level.
VDA ISA gap assessment: compare current controls, documents and records with the ISA catalogue and your self-assessment.
Prototype protection: physical security, access control, photography rules, NDAs and handling of prototype data.
Supplier and IT controls: third-party access, identity and access management, logging, backup and secure data exchange.
Evidence and mock assessment: evidence pack, interviews with process owners and a readiness review before the audit provider arrives.
After the assessment: corrective action plans for any findings within the deadlines set by the audit provider.

TISAX and ISO 27001

The VDA ISA catalogue is built on ISO/IEC 27001 and ISO/IEC 27002, so an existing ISMS covers much of the ground. TISAX adds automotive requirements such as prototype protection and connections with third parties, and an ISO 27001 certificate does not replace a TISAX label. See our ISO/IEC 27001 consulting if you also need an ISMS.

Who carries out the assessment

TISAX assessments are performed only by audit providers approved by ENX. ALPHASEC prepares your organisation, controls and evidence; we are not a TISAX audit provider and do not issue labels.

Frequently asked questions

Who needs TISAX?

Suppliers and service providers in the automotive supply chain whose customers require it, for example parts manufacturers, engineering and design firms, IT and logistics providers that handle confidential customer data or prototypes.

Which assessment level do we need?

Your customer specifies it. Information with high protection needs usually requires AL2, while very high protection needs and prototype protection usually require AL3.

Can we use our ISO 27001 system for TISAX?

Yes. Many ISO 27001 processes and records can be reused, but you still need to cover the VDA ISA requirements that go beyond ISO 27001, such as prototype protection.

How long does TISAX preparation take?

It depends on the number of sites, the assessment objectives and how mature your current controls are. We confirm a realistic plan after the gap assessment.

Does ALPHASEC issue TISAX labels?

No. Labels are issued through ENX after an assessment by an ENX-approved audit provider. We help you prepare and close gaps.

LET’S UNDERSTAND YOUR NEEDS