TISAX® Assessment & Audit Readiness
Scope + assessment objective selection aligned to the VDA ISA catalog (Information Security, Prototype Protection, Data Protection)
AL2 / AL3 readiness: close control gaps and build evidence that stands up to plausibility checks or full verification
ENX Portal exchange-ready results: structured sharing strategy so buyers get exactly what they need (no oversharing)
What NIS2 is (and what it changes)
The NIS2 Directive (Directive (EU) 2022/2555) establishes a unified cybersecurity baseline for 18 critical sectors across the EU and replaces the original NIS framework.
NIS2’s core shift: cybersecurity becomes a governance and enforcement program, not an IT initiative. It introduces clearer scope, stronger risk-management obligations, mandatory incident reporting timelines, and direct accountability for management bodies.
Who TISAX applies to
TISAX is primarily relevant for suppliers and service providers in the automotive value chain who handle:
- Sensitive and confidential information (product development, design, manufacturing data)
- Prototype parts/vehicles/test vehicles/events requiring strict protective measures
- Availability/resilience expectations (where disruption risk impacts production flows)
- Personal data within automotive programs (where Data Protection objectives apply alongside Information Security)
What “TISAX-ready” means in practice
Objectives + catalogues selected correctly (scope alignment)
TISAX readiness starts with picking the right assessment objectives, which determine which ISA criteria catalogues apply:
Information Security
Prototype Protection
Data Protection
Assessment levels you can pass (AL2 vs AL3)
TISAX differentiates assessment levels (AL) which set how deep the audit provider must verify your controls:
AL2: plausibility check supported by evidence + interview (often remote)
AL3: comprehensive verification including on-site activities/observations (or approved remote equivalents)
Evidence built for how auditors and buyers evaluate
You need repeatable proof not just statements:
- Control design + implementation proof
- Operating evidence (tickets, access reviews, change records, incident handling)
- Traceability across locations in scope
Exchange-ready sharing (ENX Portal strategy)
TISAX results are shared via the ENX exchange mechanism, and you control how much a partner can see through defined sharing levels (A–E).
Renewal planning (avoid coverage gaps)
TISAX labels are generally valid for three years, and ENX recommends starting renewal at least one year before expiry to avoid gaps during active supplier relationships.
How Elevate Consult supports TISAX readiness
TISAX Readiness Assessment (Scope → Objectives → Roadmap)
- Confirm your scope (locations, service boundaries) and select the right objectives
- Map gaps to VDA-ISA requirements and build an execution roadmap
Evidence-led control remediation (built for AL2/AL3)
- Close gaps across ISMS governance, asset/access controls, supplier risk, incident readiness, and resilience
- Build evidence capture workflows that stand up to plausibility checks or verification
Prototype protection and confidentiality readiness
- Strengthen physical + operational controls for prototype handling (where applicable)
ENX exchange preparation (buyer-facing)
- Sharing strategy that meets buyer requirements without exposing unnecessary detail
- Packaging results for enterprise due diligence and fast onboarding
What you get (deliverables)
- TISAX Scope & Objectives Pack (locations, boundaries, objective selection rationale)
- VDA-ISA Requirements Matrix + Gap Assessment (owners, evidence, remediation plan)
- Evidence Library Blueprint (what to collect, cadence, traceability model)
- AL2/AL3 Audit Readiness Runbook (interviews, evidence review, on-site readiness where required)
- ENX Portal Sharing Strategy (partner-ready packaging and permissions approach)
Engagement options
- TISAX Readiness Sprint (2–4 weeks): scope + objectives + gap assessment + roadmap
- Implementation Support (co-sourced): remediation + evidence operations
- Continuous Oversight: ongoing evidence cadence, renewal planning, and buyer due diligence support
Why Elevate Consult for TISAX
Procurement-ready proof: We build evidence buyers can validate quickly, so supplier onboarding doesn’t stall
AL2/AL3 execution focus: We prepare you for the assessment method that applies to your objectives—plausibility check or full verification.
Multi-location, scope-driven delivery: We structure scope and evidence so results are consistent across sites and shareable through ENX.
Prototype + confidentiality readiness: We align controls to the real risk drivers in automotive programs (confidential development data and prototype handling).
FAQ
1) What is TISAX?
It’s the EU’s risk-based regulation for AI systems and general-purpose AI models, setting obligations based on risk level (prohibited, high-risk, transparency obligations, minimal risk).
6) How long are TISAX labels valid?
TISAX labels are generally valid for three years, after which you must run the process again to renew.
2) Who governs TISAX and where are results shared?
ENX governs the exchange mechanism, and results are managed and shared via the ENX Portal with partner-controlled permissions.
7) What are temporary TISAX labels?
If you have minor nonconformities and complete the relevant corrective action plan assessment, you may receive temporary labels that can be valid up to nine months and cannot be renewed.
3) What is the VDA-ISA catalog?
The VDA-ISA is the automotive industry’s information security assessment catalog developed with industry experts and used as the foundation for TISAX assessments.
8) What happens if we don’t close nonconformities in time?
ENX notes you have up to nine months after the closing meeting of the initial assessment to resolve nonconformities; otherwise labels are not issued and you may need a new initial assessment.
4) What catalogues/modules exist in ISA for TISAX?
ISA includes three criteria catalogues: Information Security, Prototype Protection, and Data Protection. Your selected assessment objectives determine which catalogues apply.
9) How does sharing work—what does a buyer see?
TISAX sharing levels map to the main report sections (A–E). You choose how much detail a partner can access; ENX recommends “A + Labels” for most partners.
5) What are assessment levels (AL2 vs AL3)?
AL2 is a plausibility check supported by evidence and interviews; AL3 is comprehensive verification including on-site observations (or approved remote alternatives).
10) Does TISAX replace ISO/IEC 27001?
TISAX uses an ISA catalogue based on key aspects of ISO/IEC 27001, but it is tailored to automotive supply chain needs (including prototype protection and exchange mechanics).