Prepare for TISAX. Protect Automotive Information.
Automotive manufacturers and their suppliers exchange confidential designs, prototype data, production information, and personal data every day. To manage this risk consistently across the supply chain, many OEMs expect their partners to demonstrate information security through a TISAX assessment.
ConsultHive provides TISAX consulting and assessment readiness support to help suppliers and service providers understand requirements, define their assessment scope, close information security gaps, and prepare for assessment by an ENX-approved audit provider.
Our consulting approach is based on the VDA Information Security Assessment (ISA) catalogue, which is built on ISO/IEC 27001 and ISO/IEC 27002 with additional automotive-specific requirements.
Whether your organization has received a TISAX request from a customer, is renewing an existing label, or wants to extend its scope to new sites or protection objectives, ConsultHive helps establish a structured and practical path to assessment.
Request a TISAX Consultation
Get a TISAX Readiness Quote
What Is TISAX?
TISAX stands for Trusted Information Security Assessment Exchange. It is an information security assessment and exchange mechanism for the automotive industry, maintained by the ENX Association.
TISAX is based on the VDA ISA catalogue, developed by the German Association of the Automotive Industry (VDA). The catalogue contains requirements for information security, prototype protection, and data protection, and it is used to assess organizations in the automotive supply chain.
Assessments are carried out by audit providers approved by the ENX Association. After a successful assessment, the organization receives a TISAX label and can share its assessment results with chosen business partners through the ENX online platform.
The purpose of TISAX is to avoid repeated and inconsistent supplier security audits by allowing assessment results to be shared and mutually recognized among TISAX participants.
TISAX is a registered trademark of the ENX Association.
Understanding TISAX Scope, Labels, and Assessment Levels
The effort required for TISAX depends on the scope, the protection objectives needed, and the assessment level requested by the customer.
Assessment Scope
The scope is defined during registration on the ENX portal and identifies the legal entity, the location or locations, and the processes to be assessed. Each site in scope is assessed separately, and the scope should reflect what the customer actually requires.
TISAX Assessment Labels
The assessment labels determine which requirements of the ISA catalogue are assessed. Under ISA 6.0, the labels include Confidential, Strictly Confidential, High Availability, and Very High Availability, along with optional modules such as Prototype Protection and Data Protection where required by the customer.
The label names and structure may change between catalogue editions, so the applicable labels should be confirmed with your customer and the ENX Association before the scope is registered.
Assessment Levels
| Assessment Level | General Meaning |
| Assessment Level 1 (AL 1) | Self-assessment. It does not result in a TISAX label on the ENX platform |
| Assessment Level 2 (AL 2) | Documentation review with plausibility checks and a remote interview, performed by an audit provider |
| Assessment Level 3 (AL 3) | Documentation review with an on-site assessment and a more detailed evaluation by the audit provider |
The assessment level required is generally specified by the customer or OEM and depends on the protection needs of the information being handled.
TISAX and the VDA ISA Catalogue: Current Version
TISAX assessments are carried out against the VDA ISA catalogue that is valid on the date the assessment is ordered. ISA 6.0 introduced a revised label structure and a stronger focus on operational technology (OT) in production environments, with references to IEC 62443.
The VDA has published a new catalogue edition named ISA2027, which applies to TISAX assessments ordered from 1 January 2027, and has indicated that future catalogues will be published annually under year-based names. Labels that are already valid are not affected until the organization’s next assessment.
Because catalogue versions, label names, and transition dates are updated by the ENX Association and the VDA, organizations should confirm the applicable catalogue before starting their assessment. ConsultHive aligns its readiness work with the catalogue that applies to your assessment date.
Our TISAX Consulting Services
ConsultHive provides structured consulting support for organizations preparing for TISAX assessment, renewal, or scope extension.
1. TISAX Requirement Review and Scoping
Review customer requests and determine the likely protection objectives, labels, assessment level, and assessment scope. Support the registration information needed for the ENX portal.
Early scoping helps avoid assessing unnecessary sites or missing requirements stated by the customer.
2. VDA ISA Gap Assessment
Evaluate existing information security practices, policies, and controls against the applicable ISA requirements, and identify gaps, maturity levels, and priority actions.
The gap assessment helps the organization understand the effort required before engaging an audit provider.
3. Information Security Management System Implementation
Support the development or improvement of ISMS processes such as risk management, asset management, access control, supplier management, incident management, business continuity, and awareness.
Organizations that already hold ISO/IEC 27001 can often reuse evidence, although TISAX has additional requirements and is not replaced by an ISO/IEC 27001 certificate.
4. Prototype Protection Readiness
Where prototype protection is in scope, review physical and environmental security, handling of prototype vehicles, parts and components, trial operation, and the requirements around events and photography.
5. Data Protection Module Readiness
Where applicable, review how the organization handles personal data in line with the data protection requirements of the ISA catalogue.
6. Production and OT Security Review
Review security arrangements for production networks, industrial control systems, and manufacturing IT, where high availability or related requirements apply, with reference to applicable ISA and IEC 62443-based expectations.
7. Evidence Preparation and Pre-Assessment Review
Organize policies, records, and implementation evidence against ISA controls, and conduct an internal mock review to prepare for the audit provider’s interviews and checks.
8. Audit Provider Coordination and Post-Assessment Support
Support coordination with the selected audit provider, help interpret findings, and prepare corrective action plans for any non-conformities, as well as renewal planning.
Key Benefits of TISAX
A TISAX assessment helps suppliers demonstrate their information security posture in a form that automotive customers recognize and accept.
• Meet customer requirements: Respond to OEM and Tier-1 requests for a TISAX label.
• Reduce repeated audits: Share one set of assessment results with multiple participating partners.
• Strengthen information security: Identify and address gaps in policies, controls, and supplier management.
• Protect confidential information: Improve the handling of designs, prototype data, and production information.
• Build customer confidence: Show that security practices have been reviewed by an approved audit provider.
• Support business opportunities: Remain eligible to work with automotive partners that require TISAX.
• Improve preparation for renewal: Maintain evidence and controls that support the next assessment cycle.
TISAX results are exchanged only when the assessed organization gives explicit authorization.
Our TISAX Readiness and Assessment Process
Step 1: Initial Consultation and Customer Requirement Review
Understand your business, customers, locations, the information shared with automotive partners, and the TISAX requirement stated by the customer.
Step 2: Scope Definition and ENX Registration Support
Define the legal entity, sites, processes, labels, and assessment level, and support the information needed for registration on the ENX portal and generation of the scope.
Step 3: Gap Assessment against the VDA ISA Catalogue
Evaluate current controls, documentation, and practices against the applicable ISA requirements, and prepare a prioritized remediation plan.
Step 4: Control Implementation and Documentation
Support the implementation of policies, procedures, technical and organizational controls, and records that address identified gaps.
Step 5: Internal Review and Evidence Readiness
Review implementation evidence, conduct internal checks, and prepare employees and process owners for the audit provider’s interviews and site assessment.
Step 6: Assessment by an ENX-Approved Audit Provider
The organization engages an ENX-approved audit provider, which conducts the assessment at the agreed level and issues the assessment result. ConsultHive supports preparation and coordination but does not perform or influence the assessment result.
Step 7: Findings Closure and Result Exchange
Address any findings through corrective actions, confirm the final result, and, where authorized, share it with partners through the ENX platform.
The timeline depends on the scope, the maturity of existing security controls, the number of sites, and the audit provider’s availability.
What Is Included in TISAX Consulting Deliverables?
Depending on the agreed scope, the deliverables may include:
• Customer requirement summary and recommended assessment scope.
• Information on labels and assessment level relevant to the customer.
• VDA ISA gap assessment report with maturity observations.
• Prioritized remediation plan and responsibilities.
• Information security policies, procedures, and templates.
• Risk assessment and asset inventory support.
• Prototype protection and data protection readiness observations, where in scope.
• Evidence mapping against ISA controls.
• Internal mock assessment findings and recommendations.
• Support materials for the audit provider’s review.
These deliverables support assessment readiness. They are not a TISAX label or assessment result, which can only be issued through the ENX process.
TISAX Standards and Reference Frameworks
TISAX is based on the VDA ISA catalogue and relates to several recognized information security standards.
| Standard / Framework | Relevance to TISAX |
| VDA ISA Catalogue | Requirements catalogue used for TISAX assessments |
| ENX TISAX Participation Documents | Rules for registration, assessment, labels, and result exchange |
| TISAX ACAR (Audit Criteria and Requirements) | Requirements for audit providers and the assessment process |
| ISO/IEC 27001 | Information security management system requirements; the ISA catalogue is built on it |
| ISO/IEC 27002 | Information security control guidance |
| IEC 62443 | Industrial automation and control system security, referenced for OT-related requirements |
A valid ISO/IEC 27001 certificate does not replace a TISAX assessment, although a well-implemented ISMS can reduce the effort required.
TISAX Requirements and Relevance in India
India has a growing automotive component, engineering, and IT services industry serving global OEMs and Tier-1 suppliers, many of which are TISAX participants.
TISAX is not a statutory requirement in India. It is typically required contractually by an OEM or Tier-1 customer as a condition for sharing sensitive data or for sourcing.
Indian suppliers should confirm the exact label, assessment level, and scope required by their customer and review the validity of any existing TISAX label. A TISAX label is generally valid for three years.
A TISAX assessment relates to information security and does not, by itself, address vehicle cybersecurity regulations such as UN R155. Organizations may also need separate automotive cybersecurity engineering and compliance programs.
Who Needs TISAX Consulting Services?
TISAX is relevant to organizations that handle information belonging to automotive customers or take part in automotive development and manufacturing.
Automotive Component Manufacturers: Tier-1, Tier-2, and Tier-3 suppliers receiving drawings, specifications, and production data from OEMs.
Engineering and Product Development Service Providers: Design, simulation, testing, and engineering service companies working on customer vehicle programs.
IT and Software Service Providers: Companies developing software, providing support, or hosting systems for automotive customers.
Prototype and Testing Facilities: Organizations handling prototype vehicles, parts, or test data.
Logistics and Support Service Providers: Providers with access to customer information, parts, or production-related systems.
Organizations Renewing or Extending TISAX Labels: Companies preparing for the next assessment cycle or adding sites or protection objectives.
Why Choose ConsultHive for TISAX Consulting?
Requirement-Driven Scoping
We start from your customer’s stated requirement and keep the scope, labels, and assessment level aligned with it.
Practical Gap Assessment
Our review focuses on how the organization actually operates and which ISA requirements need action, with realistic priorities.
Evidence-Focused Preparation
We help organize policies, records, and implementation evidence so that audit provider reviews are efficient.
Independence of the Assessment
We support readiness while respecting that the assessment result is determined solely by the ENX-approved audit provider.
Integration with ISO/IEC 27001 and Other Programs
Where your organization already follows ISO/IEC 27001 or similar frameworks, we help reuse existing controls and evidence and extend them to TISAX requirements.
Frequently Asked Questions About TISAX
1. What is TISAX?
TISAX is an assessment and exchange mechanism for information security in the automotive industry. Organizations are assessed against the VDA ISA catalogue by an ENX-approved audit provider and can share their results with partners through the ENX platform.
2. Is TISAX mandatory?
TISAX is not required by law in India or generally by regulation. It is usually a contractual requirement from automotive customers. Organizations should check what their customer requires.
3. What is the difference between TISAX and ISO/IEC 27001?
ISO/IEC 27001 is an international standard for an information security management system, with certification issued by certification bodies. TISAX is an automotive-specific assessment based on the VDA ISA catalogue, which builds on ISO/IEC 27001 and ISO/IEC 27002 with additional requirements. One does not replace the other.
4. Which TISAX assessment level do I need?
The level depends on the protection needs of the information involved and is usually specified by the customer. Assessment Level 2 and Assessment Level 3 are performed by audit providers, while Assessment Level 1 is a self-assessment.
5. What are TISAX labels?
Labels describe the protection objectives and modules covered by the assessment, such as confidentiality, availability, prototype protection, and data protection. The current label structure should be confirmed against the catalogue applicable to your assessment.
6. How long is a TISAX label valid?
TISAX labels are generally valid for three years from the assessment, after which a new assessment is needed to maintain the label.
7. What is the current ISA catalogue version?
Assessments ordered up to the end of 2026 use ISA 6.0, while ISA2027 applies to assessments ordered from 1 January 2027. Organizations should confirm the applicable version and transition rules with the ENX Association or their audit provider.
8. Can ConsultHive issue a TISAX label?
No. TISAX labels are issued through the ENX platform following an assessment by an ENX-approved audit provider. ConsultHive provides consulting and readiness support only.
9. How long does TISAX preparation take?
The duration depends on scope, number of sites, existing information security maturity, and audit provider availability. The timeline is defined after reviewing the scope and gap assessment.
10. How much does TISAX consulting cost in India?
The cost depends on the number of sites, labels, assessment level, existing controls, and the extent of implementation support required. Audit provider fees and ENX fees are separate. Contact ConsultHive with your business details to receive a quotation.
Get Professional TISAX Consulting and Readiness Support
Prepare for your TISAX assessment and strengthen information security with ConsultHive.
Whether your organization is responding to a customer request or planning its next renewal, our consulting approach helps define the scope, close gaps, and prepare evidence for assessment.
CTA: Request a TISAX Consultation
Contact ConsultHive
+91 63828 84764
contact@theconsulthive.com
Get a TISAX Quote