Automotive supply chain
The clause arrived, and with it a new vocabulary: scope, assessment objective, VDA ISA, audit provider. DM11 turns that request into a plan with owners and deadlines, and takes your company to the assessment with the outcome already predictable.
DM11 prepares your company for the assessment. The assessment itself, and the labels, come from an audit provider contracted by the ENX Association. That separation is a requirement of the scheme itself.
Who runs the preparation
Where it starts
TISAX is not law and not regulation. It is a requirement the OEM or Tier 1 writes into the contract, with a deadline they set. That is why the first conversation is not about information security: it is about understanding exactly what was asked, because the ask determines the size of everything that follows.
The ENX Association governs TISAX and contracts the audit providers. The criteria catalogue, VDA ISA, is published by the German automotive industry association. ENX members include Audi, BMW, Bosch, Ford, Magna, Mercedes-Benz, Renault, Valeo and Volkswagen.
When your company receives engineering drawings, data on a part still in development or personal data from a customer, their risk now lives on your network. TISAX is how the supply chain verifies that once, instead of every OEM auditing every supplier.
You publish the result once and release it to the partners you choose. The cycle of answering a different security questionnaire for every customer ends, each with its own spreadsheet and its own deadline. The X in the name is exactly that: exchange.
What it actually is
The official participant handbook answers the question directly: there is no certificate to hang on your wall. TISAX is an assessment and exchange mechanism. You are assessed against the VDA ISA catalogue, you receive labels, and you share them on the ENX platform with whoever you authorise. Anyone who treats it as a certification usually gets the rest wrong too.
The result is labels published on the ENX platform, not a certificate. A supplier promising to “certify your company in TISAX” is describing something the scheme does not have.
The assessment uses the VDA ISA catalogue, covering information security, prototype protection and data protection. Each control is scored for maturity from 0 to 5, not simply pass or fail.
The version in force when you order the assessment is the one that applies. VDA ISA 6.0.3 governs assessments ordered until 31/12/2026. From 01/01/2027, VDA ISA2027 applies, published in July 2026, strengthening supply chain security requirements and restructuring prototype protection.
Labels are valid for three years from the closing meeting of the initial assessment. Unlike ISO 27001, there is no annual surveillance audit during that period. Renewal repeats the process, and the official recommendation is to start a year before expiry.
The assessment covers locations, not the legal entity. Three plants may mean three locations in the same scope, and every location in a scope must carry the same assessment objectives. Getting this wrong at registration costs you later: extending scope afterwards is not a simple adjustment.
If the result is minor non-conformity you receive temporary labels while you work through the corrective action plan. There is no permanent failure, and nobody has to see the result of an earlier attempt. What does exist is a deadline: corrective actions are capped at nine months.
Translation
Within TISAX what you order is the assessment objective, and the objective determines the level. If your customer's request does not name the objective, that is the first question to put to them, before any budgeting.
| What they ask for | What it means | What it demands of you |
|---|---|---|
| “We need you to have TISAX” | Incomplete request. The assessment objective is missing. | Go back to your customer and get the objective in writing. Without it any budget is guesswork and the registration may be wrong. |
| Confidential | High protection need, in the confidentiality dimension. Level AL 2. | A self-assessment that stands up on its own, plausibility check and interview, usually by web conference. |
| Strictly confidential | Very high protection need. Level AL 3. | An assessor on your site, thorough examination of evidence, planned and unplanned interviews, observation of your processes. |
| High availability | High protection need in the availability dimension. Level AL 2. | Business continuity with evidence of testing, not just a written plan. |
| Proto parts, Proto vehicles | Protection of prototype parts, components or vehicles. Level AL 3. | Segregated areas, physical access control with logging, camera and phone rules, specific media handling. |
| Test vehicles, Proto events | Test vehicles and prototypes at events or shootings. Level AL 2. | Handling, transport and coverage rules, with accountability defined per event. |
| Data | Data protection, derived from GDPR Article 28 on processors. Level AL 2. | Processing records, impact assessment, transfer rules and handling of data subject requests. Directly connected to what privacy law already requires of you. |
| Special data | Special categories of personal data. Level AL 3. | Everything above, with on-site verification and reinforced controls. |
The Info high and Info very high objectives stopped being selectable in April 2024. If your customer's request still uses those names, confirm with them: it usually means Confidential or Strictly confidential, and the difference changes the assessment level.
Levels
The level is not your choice. It follows from the assessment objective your customer requires.
Internal use
The assessor only confirms that a self-assessment exists, without examining its content. The part that surprises people: AL 1 produces no TISAX label. It serves internal purposes or a specific partner, outside the exchange mechanism.
Most suppliers
A plausibility check of your self-assessment, supported by evidence review and an interview with whoever owns information security, usually by web conference. Internal effort here is high: your self-assessment has to stand on its own, with evidence behind every score.
Prototypes and very high protection
The assessor comes to your locations. They examine documents and evidence, run planned interviews with process owners and unplanned ones with the people who execute, observe local conditions and watch the processes actually run. This is the level where the gap between the written process and the practised process shows.
If you already have ISO 27001
Having ISO 27001 helps considerably and does not exempt you from the TISAX assessment. The VDA ISA catalogue is aligned with the standard's good practice and carries cross references, so much of your documentation is reusable. What usually catches people out is not what already exists: it is what ISO does not ask for, and the scope logic, which works the other way around.
Self-assessment
Fourteen questions across the domains the VDA ISA catalogue covers. The full result appears on screen, with a score per domain and an honest read on the distance to an assessment. We do not ask for your email to show it.
Approved by management, with a review date. An old document with no owner usually counts as absent.
How we run it
Every phase ends with a deliverable, not a status report. You know what you get before you start.
Before any technical diagnosis, we translate what your customer required into assessment objective, level and locations. This decision drives the size of everything that follows, and it is the one most often rushed.
You get
We assess your current position control by control, in the catalogue version that will govern your assessment, using the maturity scoring the assessor will use. The output shows the real distance, not an impression.
You get
We turn the gaps into a plan with owners, deadlines and an execution order. Sequence matters: some controls depend on others, and running them out of order creates rework.
You get
We run execution alongside your team: policies, processes, physical and logical access control, supplier management and the documentation that supports each score. Your team learns to operate what was built.
You get
We simulate the assessment with the assessor's rigour, including interviews with process owners and with the people who execute. This is where the gap between the written process and the practised one appears, while there is still time to fix it.
You get
We support you during the assessment run by the audit provider and, if there are non-conformities, in building and executing the corrective action plan within the scheme's deadline.
You get
Stories
We anonymise our clients with the same confidentiality that will protect your company later. The names change, and the pattern of the problems repeats. Named references, where the client authorises them, we present in conversation.
A question you should be asking
The participant handbook is explicit: an audit provider may only conduct your assessment if they have had no previous consulting assignments with you. Whoever prepares you is barred from assessing you. This is not bureaucratic detail. It is what makes the result credible to the OEM that will rely on it.
Frequently asked
Answers anchored in the official participant handbook. Where no official figure exists, we say so.
No. The official participant handbook answers this directly: there is no certificate to be issued. TISAX is an assessment and exchange mechanism. You are assessed against the VDA ISA catalogue, you receive labels, and you share them on the ENX platform with the partners you authorise. A supplier promising a certificate is describing something the scheme does not have.
More questions? See DM11's full FAQ
A thirty minute conversation is usually enough to turn your customer's requirement into scope, level and an order of magnitude for effort. No obligation.