TISAX Readiness Consulting

If your automotive customer has asked you for a TISAX assessment, we run the preparation process together with you.

TISAX is an information security assessment mechanism based on the VDA ISA catalogue and operated by the ENX Association. You are assessed once, and the result is shared with your customers via the ENX portal.

The most expensive mistake: the wrong scope

Starting preparation with the wrong label or the wrong assessment level can mean redoing the project from scratch.

The label defines the scope of the assessment: areas such as information security, prototype protection and data protection correspond to different labels.

The assessment level defines the depth of verification.

Which ones you need is communicated by your customer. The first step of the project is confirming this information in writing.

If you hold ISO 27001

Preparation becomes noticeably easier, but the work does not end there. ISO 27001 is a generic information security management system standard; TISAX is specific to the automotive sector and includes additional areas such as prototype protection.

TISAX also uses a maturity-level-based assessment: it is not enough for a control to exist — the maturity it has reached is what gets scored.

Project steps

  1. Analysis of the customer request; confirmation of label and level
  2. Definition of the assessment scope and locations
  3. Handling of the ENX registration process
  4. Completion of the self-assessment
  5. Gap analysis and improvement plan
  6. Closing the gaps: policies, processes, technical and physical controls
  7. Meeting prototype protection requirements
  8. Preparation of the evidence file
  9. Readiness audit before the assessment

Deliverables

  • Scope and label decision document
  • Self-assessment result and maturity scoring
  • Gap analysis and action plan
  • Updated policy and procedure set
  • Evidence file
  • Readiness audit report

When is this service needed?

Your customer asked for it and you do not know the process. This is the most common scenario. Registration, label selection, choosing an assessment provider and the timeline all look complex the first time around.

You are unsure about the label and level. Starting with the wrong scope can mean redoing the preparation — the most expensive mistake in the whole process.

You hold ISO 27001 but are far from TISAX. Your existing system is a good foundation, but the maturity-based assessment and areas such as prototype protection require dedicated work.

Your prototype protection area has never been set up. Physical access control, imaging restrictions and visitor management around R&D, samples and testing are undefined in most organizations.

Your timeline is tight. If your customer expects a result by a specific date, preparation has to run in parallel.

Who is TISAX consulting for?

  • Suppliers receiving TISAX requests from automotive customers
  • Organizations providing R&D, design or software services
  • Companies working with prototypes, samples or test vehicles
  • ISO 27001 certified organizations not yet ready for automotive-specific requirements
  • Organizations establishing their information security function for the first time
  • Companies bringing multiple locations into the assessment scope

How We Work

On site and remote: steps that require field work take place at your facility, while document and analysis work is carried out remotely.

Together with your team: the work is done with you, not on your behalf. The goal is not to finish a project but to leave you with a system you can sustain.

Transparent planning: a step-by-step plan with owners and dates is shared at the start, and progress is reported regularly.

Important note

TISAX assessments can only be performed by providers authorized by ENX. We do not perform assessments; we get you ready for one.

Frequently Asked Questions About TISAX Readiness Consulting

Do you perform the TISAX assessment?

No. TISAX assessments can only be performed by providers authorized by ENX. We provide readiness consulting.

Which label and level do we need?

Your customer specifies them. The first step of the project is confirming this in writing; starting with the wrong scope is the most expensive mistake.

We hold ISO 27001 — how much shorter does the process get?

Noticeably shorter, but it does not disappear. TISAX includes automotive-specific areas and a maturity-level-based assessment; your existing system needs to be adapted to that framework.

What does prototype protection cover?

The protection of vehicles, components and data in the development phase: physical access control, transport, imaging restrictions, test drives and visitor management, among other areas.

How long does preparation take?

It depends on your current maturity, the label and the level. A clear timeline is shared after the self-assessment and gap analysis.