Support for ^TISAX® Certification

TISAX is intended for all suppliers and service providers in the automotive industry who handle confidential information on behalf of an automaker or supplier: design data, prototypes, production plans, end-customer personal data, and access to connected systems.

In practice, as soon as an OEM (Volkswagen, BMW, Mercedes, Stellantis, Renault, etc.) or a Tier 1 supplier requires TISAX compliance in its specifications, obtaining the certification becomes a prerequisite for continuing the business relationship.

TISAX is based on the framework of ISO 27001 (ISMS, risk analysis, policies, technical controls) and covers approximately 70% of its requirements. The remaining 30% are specific to the automotive industry: protection of prototypes (secure areas, management of test vehicles), classification of information according to the VDA scheme, and enhanced requirements regarding subcontractor management and the protection of personal data.

TISAX issues a label, not a certificate. This label is published on the ENX portal and shared directly with your automotive customers, without the need to submit an audit report.

The VDA ISA (Information Security Assessment) is the framework published by the VDA that provides the structure for the TISAX assessment. It contains nearly 200 requirements divided into eight chapters covering security policy, asset management, human resources, physical security, operations, communications, software development, and supplier relations.

Each requirement is rated on a maturity scale from 0 to 5. An ENX auditor expects an average target score of around 3, with certain requirements specific to prototypes rated at 4 or 5 depending on the target AL level.

The level depends on the sensitivity of the data provided by your client. In most cases, your automotive client specifies this in their specifications.

AL1 — Data with limited sensitivity, self-assessment without an external auditor.
AL2 — Data requiring a high level of protection, remote audit by an accredited ENX auditor. This is the most frequently requested level.
AL3 — Highly sensitive data (prototypes, strategic designs), comprehensive on-site audit with a physical inspection of the premises.

When your client does not specify a specific level, it is recommended that you anticipate potentially higher requirements. Our first step with you is precisely to confirm this level before we begin.

The scope may cover a specific site (a factory, an office) or multiple sites. Two criteria are non-negotiable.

First, the scope must fall within the scope of your ISMS. Your ISMS may be broader than the TISAX scope, but the reverse is not possible.

Second, the scope must cover all sites that handle your clients’ information or prototypes that require TISAX certification, in order to fully meet their contractual requirements.

An ill-defined scope is one of the main causes of delays or failure during the evaluation. That is why we devote a specific step to this right from the start of the project.

ENX (European Network Exchange) is the organization that manages and oversees the TISAX system. It has three main roles: providing the secure platform on which results are published and shared among companies; approving and monitoring accredited audit bodies; and ensuring the standardization and international recognition of assessments across the automotive industry.

Important note: ENX does not conduct audits. It oversees their regulation, quality, and recognition. The assessment is conducted by an ENX-accredited audit provider that is independent of your consultant.

Between 3 and 9 months, depending on where you start.

If you already have an ISO 27001 ISMS in place: 3 to 5 months for gap analysis, updating automotive-specific controls, and assessment. Starting from scratch: 6 to 9 months, including a 2- to 3-month maturation period during which your ISMS must generate actual operational evidence.

The FeelAgile method is designed to meet the deadlines set by your clients, thanks to bi-monthly milestone tracking and a roadmap aligned with your contract date.

The cost is broken down into three categories.

ENX Fees — Approximately €500 for portal registration fees.

Accredited ENX Auditor — Between €5,000 and €15,000 depending on the AL level and the scope of the audit. AL2 typically ranges from €8,000 to €10,000, while AL3 often exceeds €12,000.

FeelAgile Support — Costs vary depending on your initial readiness and scope. A provider with around 30 employees that is already ISO 27001-certified typically invests between €25,000 and €45,000. We provide a customized quote after the scoping phase.

No, it’s not mandatory. If your company works exclusively in the automotive industry and no other sector requires ISO 27001, it makes perfect sense to aim directly for TISAX.

If you already have an ISO 27001 ISMS in place, this serves as a major accelerator: approximately 70% of the VDA ISA requirements are already covered. If you are aiming to comply with both standards, we recommend developing an integrated ISMS that meets the requirements of both simultaneously, thereby avoiding any duplication of documentation and unnecessary additional costs.

The TISAX certification is valid for three years and does not require a mandatory interim surveillance audit, unlike ISO 27001.

Please note, however: during the reassessment after three years, the ENX auditor expects your ISMS to have remained active (annual management reviews, internal audits, incident management, policy updates). Without active maintenance, the reassessment will turn into a complete rebuild.

FeelAgile offers support to help you maintain your certification, ensuring you meet your next deadline without any disruptions or internal overload.