TISAX

This is intended for standard security requirements. The auditee can carry out the assessment as a self-assessment.

Assessment Level 2 is aimed at suppliers and service providers with high security requirements. A prerequisite for this is the submission of a complete self-assessment. The audit provider then carries out the following steps:

• Kick-off meeting
• Completeness and plausibility check of the self-assessment and corresponding evidence
• Telephone interview with those responsible for the Information Security Management System (ISMS) based on the plausibility check, or an on-site audit where third parties are involved and/or prototype protection is required

Level 3 assessment involves very high security requirements. An audit provider (TISAX® AP) must also be involved here, and a complete self-assessment must be submitted. The subsequent audit steps are similar to those for Level 2 assessment, except that key aspects are examined during an on-site audit.

• Opening meeting
• Checking the completeness and plausibility of the self-assessment and supporting evidence
• Assessment of the effectiveness and maturity of the ISMS through an on-site audit with the parties involved (on-site expert interviews, inspection of relevant areas and premises) 

TISAX® stands for Trusted Information Security Assessment Exchange and describes an assessment and exchange process for information security in the automotive industry.

Only audit service providers approved by ENX for this purpose (TISAX® AP) are permitted to carry out TISAX® assessments. TÜV NORD CERT is ENX’s contractual partner for this purpose.

Developed by the German Association of the Automotive Industry (VDA), TISAX® is managed by the ENX Association, which monitors the quality of the assessments and their results.

The scope and duration of the TISAX® audit are primarily determined by the agreed audit objectives, the maturity and complexity of the ISMS, and the number of sites to be audited.

A fixed period of nine months is available from the closing meeting (concluding meeting of the initial assessment) until the completion of the entire assessment process (including verification of the successful implementation of any necessary corrective measures). If this deadline cannot be met, the process must be restarted from the beginning. After three years (the validity period of the TISAX® label), the process must be repeated.

All suppliers and service providers to car manufacturers and their suppliers who process sensitive information belonging to those organisations should have an interest in participating in TISAX®. On the one hand, this enables them to meet their customers’ requirements. On the other hand, it means they avoid having to undergo the same audits repeatedly at the hands of their customers. This is because clients regularly require their suppliers to provide evidence that they meet information security requirements.

To receive a quote for a TISAX® audit, interested parties must first register on the ENX portal and provide the relevant information. Please contact us if you would like us to assist you with the quote request process.

Companies can gain access to the TISAX® portal, which facilitates the exchange of assessment data, by registering as a participant. This is a prerequisite for commissioning an assessment from an assessment provider (TISAX® AP) such as TÜV NORD.

ENX has compiled detailed information on TISAX® in a participant handbook available on its website.