TISAX Review and Advisory

Lost Contract with Tier 1 - Supplier Story

Polish electronic components manufacturer lost a €5M contract with German Tier 1 supplier. Reason? No TISAX certificate. Competitor from Czech Republic with certificate won, despite having 8% higher price.

Without TISAX certificate:

• Exclusion from OEM tenders (BMW, VW, Daimler, Audi)
• Loss of contracts with Tier 1 suppliers working with automotive
• Need to undergo multiple audits from different customers
• No access to confidential technical and design data

From Gap Analysis to Label on ENX Portal

We don’t leave you with a list of requirements to fulfill. We guide through the entire process from current state assessment to obtaining Label in ENX system, which opens doors to the entire automotive industry.

What you get:

• Compliance assessment with ISA Catalog (Information Security Assessment)
• Required Assessment Level determination (AL1, AL2, AL3)
• Implementation plan for missing security controls
• Policy and procedure documentation compliant with VDA-ISA
• Evidence preparation for auditor
• Support during certification audit by accredited audit provider
• Assistance in obtaining TISAX Label in ENX portal

Key TISAX Implementation Areas

TISAX certification preparation requires a systematic approach across the three main assessment areas defined in the ISA Catalog (Information Security Assessment).

Information Security — covers 41 controls based on ISO 27001, extended with automotive-specific requirements. We implement information classification policies aligned with OEM confidentiality levels (e.g., “Streng vertraulich” for German manufacturers), access controls for design data, encrypted communication with supply chain partners, and mobile device and removable media management.

Prototype Protection — a critical area for suppliers handling test vehicles, pre-production components, or CAD data. We implement physical protection zones (cameras, access control, photography policies), prototype labeling and tracking procedures, and transport controls for sensitive components. This area requires both technical and physical security measures that go well beyond standard IT security.

Data Protection — we ensure GDPR compliance within the TISAX context, covering processing of employee and test driver data, data processing agreements with subcontractors, and data retention and deletion procedures. TISAX requires demonstrable GDPR compliance as a precondition for Label issuance.

For each area we build the complete documentation set required by the auditor: policies, operational procedures, registers, and implementation evidence. We also prepare your team for auditor interviews through mock audit sessions that simulate the actual Assessment process, identifying weak points before the formal audit begins.

Who Is It For?

This service is for you if:

• You supply components, software or services to automotive industry
• Your customer requires TISAX certificate as collaboration condition
• You want to open new markets in automotive supply chain
• You need to prove secure management of OEM data and intellectual property
• You need one certificate accepted by multiple manufacturers

What is TISAX?

Trusted Information Security Assessment Exchange

TISAX is a common information security assessment mechanism in automotive industry, managed by ENX Association (European Network Exchange).

Assessment Levels:

Level	For Whom	Scope
AL1	Basic protection	Self-assessment
AL2	Standard protection	3rd party audit
AL3	High protection	Extended audit + tests

Assessment Areas:

• Information Security (ISO 27001 + automotive specifics)
• Prototype Protection
• Data Protection (GDPR compliance)

Related Glossary Terms

Learn more about key concepts related to this service:

• Bot
• ICS
• Information Security Architecture
• OT (Operational Technology)
• SOC
• SSE
• SSO (Single Sign-On)
• Tor