Key Facts
- Regulator
- ENX Association (governs TISAX and maintains the ISA catalogue); the ISA catalogue is published by the VDA (German Association of the Automotive Industry) as VDA ISA
- Latest version
- VDA ISA2027.1 (October 2026 editorial update of ISA2027; substantive requirements unchanged)
- Effective
- 1 October 2026
- Official text
- enx.com ↗
What is TISAX?
TISAX is a standardised approach to information security assessment in the automotive industry. The ENX Association governs it, and the assessment is built on the ISA catalogue published by the VDA. It applies to suppliers and service providers in the automotive supply chain, who are assessed once and recognised by many customers.
The current catalogue is VDA ISA2027, published in July 2026 and updated to ISA2027.1 in October 2026 with editorial changes only. It applies to assessments ordered from 1 January 2027. ISA 6, released in October 2023, applies until then. Catalogues are now named after the year they take effect and published each summer, so ISA2028 is due in summer 2027 for assessments ordered in 2028.
TISAX gives the industry one shared framework for assessments, and results are recognised across it. The catalogue is used inside companies and to assess suppliers and service providers further down the chain.
A separate supplier audit from every customer is the problem TISAX replaces.
Many people search for "TISAX certification". The publisher's own terms are assessment and label, explained under Key requirements.
Why it matters
A purchasing team at a vehicle manufacturer asks for your TISAX assessment result. Your ISO 27001 certificate is current, but it is not the thing they asked for.
That is the usual way in. According to the publisher, more than 5,000 active users from more than ten vehicle manufacturers and thousands of suppliers of all sizes use TISAX assessment results to evaluate the security posture of business partners and suppliers.
The pressure also runs down the chain. ISA2027 puts more emphasis on supply chain security. For very high protection needs, suppliers are expected to show assurance through a TISAX label, an equivalent third-party assessment or a supplier audit. A supplier can be asked for a label and be expected to ask for assurance from its own suppliers.
Who it applies to
TISAX applies to organisations in the automotive supply chain: suppliers and service providers, and the vehicle manufacturers that use assessment results to evaluate them. Thousands of suppliers of all sizes take part.
The obligation is contractual, not statutory: a customer in the automotive supply chain asks for your result and uses it to evaluate you. The publisher does not describe TISAX as a legal duty, and a firm with no automotive customers has little reason to pursue it.
Early ISA versions were heavily based on ISO/IEC 27001. The ISA is now an independent industry standard that stays aligned with ISO/IEC 27001 and other standards. Familiarity with ISO 27001 carries over, but an ISO 27001 certificate is not a TISAX label. For the management-system side, see the ISO 27001 vault. In ISO 27001 terms, a customer asking for your label is managing supplier risk under A.5.19 Information security in supplier relationships.
The UK position
No UK law or regulator names TISAX, and the publisher names no UK-specific arrangements. What it does say is that TISAX assessments are conducted worldwide by independent audit providers, so UK suppliers can be assessed.
A UK firm meets TISAX commercially, when a customer in the automotive supply chain asks for an assessment result. A UK firm with no automotive customers rarely meets it.
Key requirements
TISAX is built on the ISA catalogue and a four-step process:
- Registration. The organisation registers as a TISAX participant and defines its assessment scope: the locations, processes and protection needs to be assessed.
- Selection of an audit provider. It chooses an approved audit provider.
- Assessment. A self-assessment against the ISA catalogue comes first, then an external audit. The more protection the information needs, the deeper the audit goes, from document reviews to on-site checks.
- Exchange of results. The organisation shares its results with current and future partners.
The control text sits in the catalogue itself. This entry does not reproduce it.
Labels and results
- Labels. Results are issued as TISAX labels that reflect the assessment objective, such as information security, data protection or prototype protection.
- Validity. Labels are valid for three years.
- Sharing. Results are exchanged through the ENX Portal. They are not public, and participants choose who sees them.
An assessment result you can't share with the customer who asked for it hasn't done its job.
What ISA2027 changes
- Mappings to the NIST Cybersecurity Framework 2.0 and ISO/IEC 27001:2022 are updated, and mappings to ISA/IEC 62443 are clarified. References to ISO/IEC 27001:2013 are dropped.
- Prototype protection is restructured: five control groups become two domains, organisational requirements and physical and environmental security. New controls cover tracking protected vehicles and parts, and their disposal or return.
- Releases are now annual and named after the year they take effect.
The publisher's TISAX page is the starting point for the current catalogue and the assessment process.
Frequently asked questions
TISAX does not issue a certificate in the ISO sense, although buyers often call it TISAX certification. An approved audit provider assesses the organisation against the ISA catalogue, and the result is a TISAX label for each assessment objective, such as information security, data protection or prototype protection. The participant shares the label through the ENX Portal with the partners it chooses.
TISAX requirements come from the ISA catalogue, and the depth of the assessment depends on the protection needs in scope. The more protection needed, the closer the audit moves from document review to on-site checks. Under ISA2027, organisations with high protection needs must also put more weight on documenting, reviewing and monitoring their own suppliers' compliance. The control text is in the current catalogue itself.
ISO 27001 is an international management-system standard used in every sector. TISAX is an automotive-industry assessment against the VDA ISA catalogue, governed by ENX. The ISA stays aligned with ISO/IEC 27001 and maps to its 2022 edition, but TISAX adds objectives ISO 27001 does not have, such as prototype protection, and its results are shared only with partners the participant chooses.
No. ENX says the annual release cycle does not change TISAX label validity: existing labels stay valid for their full period, and new labels keep a validity of up to three years. Most firms will skip several ISA versions between regular reassessments. The yearly cycle lets the catalogue change in smaller steps that are easier to plan for.
The current TISAX catalogue is VDA ISA2027.1, the October 2026 editorial update of ISA2027; its substantive requirements did not change. ISA2027 applies to assessments ordered from 1 January 2027, and ISA 6 applies until then. The English version is authoritative for assessments, and a German version has been available since 1 October 2026.
Yes. TISAX assessments are conducted worldwide by independent audit providers, so a UK company registers and is assessed in the same way as any other participant, with its UK locations in the assessment scope. The publisher names no UK-specific arrangements. A UK supplier usually meets TISAX when a vehicle manufacturer or a larger supplier makes it a condition of the contract.