Consulting on TISAX®

Q: What maturity level do we need to achieve?

The VDA ISA maturity model comprises six levels from 0 to 5. The target level for a successful assessment is Level 3, “established”: The process is defined, documented, and actively implemented. Levels 4 and 5 are not required for TISAX®; those who aim for them are investing more than necessary.

Q: What is the difference between protection requirement and assessment level?

The protection requirement – normal, high, or very high – describes how sensitive the information is. The assessment level describes the depth of the audit: AL1 self-assessment, AL2 plausibility check (usually remote), AL3 on-site audit. The assessment level is derived from the protection requirement, and the result is the label.

Q: How long is a TISAX® label valid?

Three years. After that, a reassessment is required. An ISMS that is actively implemented in day-to-day operations – rather than just for the audit – makes the reassessment significantly easier; therefore, it’s worth ensuring from the very beginning that the system is suitable for everyday use.

Q: Who sees our audit results?

Only those you authorize. The results are stored on the ENX platform, and you decide individually for each business partner whether and to what level of detail you share them. There is no automatic publication; sharing with the entire TISAX® community is an optional feature that must be explicitly selected.

Q: Do we need ISO 27001 first and then TISAX®?

Not necessarily. The VDA-ISA catalog is based on ISO/IEC 27001, so an existing ISMS is a good starting point. Those who do not yet have one can establish it as part of their TISAX® preparation. Two separate projects are rarely necessary.

Your gateway to the automotive industry

Without the TISAX® label, collaboration with many OEMs and suppliers is not possible: The Trusted Information Security Assessment Exchange (TISAX®) is now a key standard for information security in the automotive industry.

A successful TISAX® assessment demonstrates that you reliably protect your partners’ sensitive information, prototypes, and data – thereby fulfilling a key requirement for both new and existing business relationships.

TISAX^® is a registered trademark of the ENX Association. The mention of the TISAX^® trademark does not imply any statement by the trademark owner regarding the suitability of the services advertised here. The exclusive responsibility for the content of the website and the services presented here lies with abat.

Why TISAX® is critical for your company

The questionnaire for the VDA Information Security Assessment (VDA ISA) is based on ISO 27001 and supplements it with specific requirements for the automotive industry, such as prototype protection, data protection, and third-party management.
A TISAX® label offers you:

Access to OEMs and supplier networks
Compliance with mandatory security requirements (e.g., AL2 or AL3)
Reduction of duplicate audits through standardized data exchange
Greater trust among customers and partners
Structured and auditable security processes

Many manufacturers today require TISAX® labels with a high or very high security requirement as a minimum prerequisite for collaboration.

We operate an integrated and certified management system in accordance with ISO 9001, ISO 27001, and TISAX®. Our TISAX® audit results can be viewed on the ENX platform under Participant ID PZX0VF.

Our TISAX® Consulting: Targeted Support for a Successful Assessment

We efficiently guide you through the entire TISAX® process – from requirements analysis to a successful assessment:

Clarification of the required audit objectives
Conducting and optimizing your VDA ISA self-assessment
Evaluation and development of the required maturity levels (Levels 1–5)
Implementation of missing measures using proven methodology
Establishment of a tailor-made ISMS (if not already in place)
Preparation for and support during the TISAX® assessment

Throughout this process, we consistently prioritize practicality over unnecessary complexity.

Key Focus Areas in the TISAX® Context

We provide targeted support in the following critical areas:

Access (physical and logical)
Data backup and patch management
Risk analyses and control of countermeasures
Security awareness and employee training
Prototype protection and handling of confidential information
Service Provider and Outsourcing Management

Optional: External Information Security Officer for TISAX®

An effective ISMS is the foundation for a permanently valid TISAX® label. If internal resources are lacking, we assume the role of the Information Security Officer:

Operation and further development of your ISMS
Management of measures and maturity level development
Preparation for re-assessments

Why abat?

With abat, you benefit from in-depth industry expertise and certified methodology:

Certified TISAX® VDA ISA Lead Implementers
Extensive experience in the automotive industry since 1998
In-depth understanding of OEM requirements and supply chains
Our own certified management systems (ISO 9001, ISO 27001, TISAX®)

We know what really matters in a TISAX® assessment – and how you can pass it efficiently.

The Path to the TISAX® Label

We’ll prepare you thoroughly for the assessment and guide you through the entire process. The audit is conducted by an audit service provider accredited by the ENX Association.
Your results will be published on the ENX platform and can be shared specifically with your business partners.

Get started now

Gain a competitive edge by accessing existing and new customers – while efficiently and systematically meeting TISAX® requirements.

FAQs

What is TISAX®?

TISAX® is the audit and exchange procedure for information security in the automotive industry, operated by the ENX Association. It is based on the VDA ISA questionnaire, which builds on ISO/IEC 27001 and is supplemented by industry-specific requirements such as prototype protection. The result is a label, not a certificate.

What maturity level do we need to achieve?

What is the difference between protection requirement and assessment level?

How long is a TISAX® label valid?

Who sees our audit results?

Do we need ISO 27001 first and then TISAX®?

Our customers in the area protect

Saskia

ISMS Consultant
Bremen

For me, abat is: fun, exciting projects - great customers and colleagues packed into a respectful and trusting atmosphere with plenty of room for continuous development!