TISAX training is designed for organizations that have received a TISAX assessment request from their automotive customers and need to manage the preparation process.
TISAX (Trusted Information Security Assessment Exchange) is the mechanism that allows information security assessments in the automotive industry to be carried out with a common method and the results to be shared between participants. It is based on the ISA catalogue developed by the VDA and is operated by the ENX Association.
Why does it exist?
Before TISAX, every OEM assessed its suppliers with its own information security questionnaires. A supplier with five customers went through five separate assessments and answered similar questions five times.
TISAX removes this repetition: you are assessed once, the result is shared through the ENX portal, and your customers can view it.
Its relationship with ISO 27001
The two are frequently confused. The main differences are:
Scope and purpose. ISO 27001 is a general information security management system standard. TISAX is specific to the automotive industry and also covers sector-specific areas such as prototype protection and data protection.
The result. With ISO 27001 you receive a certificate. With TISAX you obtain not a certificate but an assessment result and a label shared on the ENX portal.
The method. TISAX uses a maturity-level-based assessment; the maturity reached for each control is scored.
If you have an ISO 27001 system, your TISAX preparation becomes markedly easier, but neither replaces the other.
Labels and levels
The scope of the assessment is set by the label your customer requests: areas such as information security, prototype protection and data protection correspond to different labels.
The assessment level determines the depth of verification: there are different levels ranging from self-assessment to an on-site audit. Your customer tells you which label and level are required.
Setting out with the wrong label or level is the most frequent and most expensive mistake. We recommend getting written confirmation from your customer before starting the preparation.
Who should attend?
- Information security managers and specialists
- IT managers
- Quality and compliance officers
- Data protection officers
- Teams responsible for prototype and sample management
- R&D and engineering managers
- Human resources and physical security officers
There are no prerequisites; knowledge of ISO 27001 makes participation easier.
Training Content
Fundamentals
- The purpose, structure and participants of TISAX
- The role of ENX and sharing through the portal
- Comparison with ISO 27001
- The process steps: registration, assessment, result sharing
The VDA ISA catalogue
- The catalogue structure and question groups
- The information security controls
- The prototype protection requirements
- The data protection questions
- The maturity level model and scoring
Scope and planning
- Determining the label and the assessment level
- Defining the assessment scope and the locations
- Timeline and resource planning
- Selecting the assessment provider
Preparation
- Conducting the self-assessment
- Gap analysis and the improvement plan
- Preparing the evidence file
- Frequently encountered gaps
Practical exercises
Participants carry out a self-assessment and maturity scoring exercise on their own organizations.
Learning Outcomes
- Planning the TISAX process end to end
- Interpreting the VDA ISA catalogue correctly
- Determining the right label and assessment level
- Performing a maturity level assessment
- Setting up a preparation plan and building the evidence file
Duration and Participation Options
Duration: 2 days in open-enrolment programmes. In in-house programmes, planned as 1–3 days depending on the scope and participant profile.
Participation type: Open enrolment or in-house.
Training method: In person (at your organization or in our training room), live online, on-demand recording.
Dates: Set according to demand.
Certificate of Attendance
Participants who complete the training receive a certificate of attendance. The certificate includes the participant’s name, training scope, date and duration. It can be used as evidence of competence in your competence records and in audits.
- ISO 27001 Training — information security management system
- IATF 16949 Training
- ISO 19011 Training — audit methodology
Beyond Training: Implementation Support
- Running the TISAX preparation project
- Self-assessment and gap analysis
- Prototype protection and physical security work
- Preparing the evidence file
- A readiness audit before the assessment
You can make use of our consulting services in every area where support is needed.
Frequently Asked Questions About TISAX Training
What is TISAX?
It is the mechanism that allows information security assessments in the automotive industry to be carried out with a common method and the results to be shared between participants. It is based on the VDA ISA catalogue and is operated by the ENX Association.
Do I receive a TISAX certificate?
No. With TISAX you obtain not a certificate but an assessment result and a label shared on the ENX portal. Your customers view the result through the portal.
We have an ISO 27001 certificate — do we still need TISAX?
If your customer requests it, yes. ISO 27001 is a general information security management system standard; TISAX is specific to the automotive industry and covers additional areas such as prototype protection. Your ISO 27001 system makes the preparation easier but does not replace it.
Which label and level do we need?
Your customer tells you. The label determines the scope of the assessment, the level the depth of verification. We recommend getting written confirmation from your customer before starting the preparation.
What is the most frequent mistake?
Setting out with the wrong label or assessment level. This mistake wastes both time and money and may require the assessment to be repeated.
What does prototype protection cover?
It concerns the protection of vehicles, components and data at the development stage: physical access control, transport, photography and imaging bans, test drives and visitor management, among other areas.
Do you carry out the assessment?
No. TISAX assessments can only be carried out by providers authorized by ENX. We offer preparation training and consulting support.
How long does TISAX training take?
Open-enrolment programmes take 2 days. In-house programmes are planned as 1-3 days depending on content density.