TISAX Access Control: A Guide for Automotive Suppliers

Automotive suppliers need to protect engineering data across the automotive supply chain whilst keeping production, development, and customer collaboration moving. Permission governance requires clear, accountable ownership, least privilege, and evidence that permissions stay appropriate and change promptly throughout each user's employment or contract.

Your organisation must demonstrate who can access sensitive information, why they need it, and how permissions change when responsibilities end. Start with the assessment scope, then build permission-management processes that work across your engineering systems, factory operations, and shared services.

Key Takeaways

• TISAX is an automotive information security assessment and information-exchange scheme operated by the ENX Association. It uses the VDA ISA and isn't an ISO-style certification standard.

• Assessment level reflects the protection need and determines how controls are examined. AL2 uses a provider-led plausibility review, while AL3 includes comprehensive verification and on-site examination.

• Effective access control depends on clear ownership, least privilege, role-based permissions, consistent joiner-mover-leaver processes, and oversight of privileged accounts.

• Keep evidence that links access requests and approvals to implementation, reviews, and completed removals. Maintain these records for the systems and locations in scope.

Understand the TISAX framework

TISAX means Trusted Information Security Assessment Exchange. The VDA, the German Association of the Automotive Industry, developed it for the automotive industry. The ENX Association operates it.

Assessments use the VDA Information Security Assessment questionnaire, known as VDA ISA. Its objectives address information security, confidentiality, availability, prototype protection and data protection. OEMs and supply-chain partners commonly pass requirements to suppliers handling sensitive information, based on their protection needs.

Our guide to automotive information security explains the wider framework and its role in sharing assessment results.

TISAX is often called TISAX certification, but it's an assessment and information-exchange scheme, not an ISO-style certification standard. ISO 27001 provides an information security management system, or ISMS, that can support preparation. It doesn't automatically produce a TISAX label.

Understanding TISAX requirements beyond ISO 27001 helps you reuse existing controls whilst addressing automotive-specific objectives and site-level evidence.

How assessment levels affect access evidence

The assessment level determines the depth of assurance. It isn't a measure of business size or an alternative maturity score.

The ENX TISAX Participant Handbook describes the relationship between protection needs and assessment levels.

Assessment level	Protection need	Assessment approach
AL1	Normal	Self-assessment.
AL2	High	Provider-led plausibility review, supported by evidence and expert interviews.
AL3	Very high	Comprehensive verification, including on-site examination of implementation.

The practical difference is how extensively the assessor examines your controls. AL2 access evidence must support a credible self-assessment. AL3 requires more extensive implementation checks, including relevant systems, facilities, and personnel. It includes on-site examination, sometimes described as an on-site audit, but that phrase isn't a separate formal requirement.

The BSI TISAX Client Guide describes these assessment methods, including evidence review, interviews, and on-site inspection.

Prototype Protection for parts and vehicles commonly requires AL3. Information Security and Data Protection may follow AL2 or AL3, depending on the selected objective. A successful assessment can result in a TISAX label for the objectives in scope.

Build your evidence plan around the customer's requested objective, registered scope, and protection needs. Maturity describes how consistently a control operates; the assessment level determines how that implementation is examined.

Where TISAX access control fits the ISA catalogue

VDA ISA 6 control 4.2.1 addresses assigning and managing access rights so that only authorised users access information and IT services. Practical implementation connects identity records, business responsibilities, approval decisions, and technical permissions.

For automotive suppliers, access management extends beyond office applications. Include engineering repositories, product lifecycle management systems, manufacturing applications, customer portals, remote maintenance connections, and outsourced administration.

Physical access also matters where sensitive information or prototypes are present. Badge permissions and visitor arrangements should reflect the same business need as system access.

Identify an owner for each application, information set, and restricted area. That owner should approve access requirements and review whether permissions remain appropriate. IT implements the decision; business ownership prevents administrators becoming the default authority for every permission.

Assign permissions through least privilege and roles

Build roles around actual responsibilities

Role-based access control groups permissions around defined responsibilities. Separate design engineering, quality assurance, production support, purchasing, and administration where their information needs differ.

Define what each role can view, change, export, approve, or administer. Membership of an engineering department shouldn't automatically grant access to every customer project.

Customer confidentiality and prototype sensitivity may require project-specific restrictions alongside standard roles. Document these restrictions so that access decisions remain consistent when teams change.

Review role definitions with system owners before deployment. Broad legacy groups often contain permissions that no longer reflect current working practices.

Approve exceptions with clear boundaries

Least privilege means granting the minimum access needed for an authorised task. Where standard roles don't cover a legitimate requirement, record the additional permission, justification, approving owner, and expiry or review date.

Temporary engineering support, emergency administration, and supplier maintenance should have defined boundaries. Limit access to the relevant system or project rather than granting unrestricted network access.

Separate request, approval, and implementation responsibilities where practical. Smaller suppliers can use documented oversight when full separation isn't feasible, with the associated risk recorded.

Manage joiners, movers, and leavers consistently

Provision approved access before work begins

HR or the contract owner should trigger account creation through a documented process. Include the person's identity, manager, start date, role, required systems, and contract end date where applicable.

Provision approved permissions before work begins, with activation aligned to the authorised start date. Record who approved and implemented access.

Apply your authentication standard to the accounts created. Unique user identities support accountability; multi-factor authentication is particularly relevant to remote and privileged access.

Automation can strengthen consistency, but TISAX doesn't prescribe one identity platform. A controlled manual process can work when responsibilities, timings, and evidence are maintained.

Remove obsolete access when circumstances change

Role changes require a review of existing permissions, not simply the addition of new access. Remove permissions associated with the previous responsibility unless continued access has explicit approval.

For leavers, disable access at the authorised departure time. Immediate termination or suspected misuse requires an immediate response.

Cover customer portals, VPN accounts, cloud services, badges, tokens, and third-party applications. Don't assume disabling the central directory account removes every route.

Retain completion records and unresolved exceptions. Where departing personnel know shared credentials, rotate them and assess any affected service accounts.

Review permissions and control privileged access

Use risk-based access reviews

Set review frequencies according to information sensitivity, account privilege, and operational exposure. Quarterly reviews for sensitive engineering access and monthly reviews for privileged accounts are possible schedules, not universal TISAX requirements.

Give reviewers actual permissions, group memberships, account status, and business responsibilities. A list of names alone rarely provides enough information for a meaningful decision.

Record whether access is retained, changed, or removed. Track rejected permissions through to technical removal rather than treating reviewer approval as the end of the process.

Trigger additional reviews after reorganisations, project closure, supplier changes, and significant security incidents.

Maintain oversight of powerful accounts

Keep administrative identities separate from routine user accounts where practical. Define permitted activities, approval responsibilities, authentication requirements, and monitoring arrangements.

Inventory privileged and service accounts. Record their owners, purposes, systems, and relevant restrictions. Unowned accounts are difficult to review and difficult to defend during assessment.

For external maintenance, control when access is available and which assets it reaches. Time-limited approval, restricted connections, and activity logging can support appropriate oversight.

  A completed access review doesn't prove that permissions were corrected. Retain evidence linking each removal decision to the resulting system change.  

Build an audit-ready access evidence pack

Connect policy to operational records

A policy establishes responsibilities. Assessment evidence must show how those responsibilities operate.

Prepare your access policy, role matrix, account inventory, approval records, joiner-mover-leaver tickets, completed reviews, and privileged-access records. Include exceptions and the actions taken to resolve them.

Link these records to the relevant systems and locations within scope. An assessor should be able to follow a permission request through approval, implementation, review, and removal.

Protect the evidence pack itself. Account exports and access logs can expose personal information, system details, and customer relationships. Restrict access to support data protection, and retain records according to documented requirements.

Demonstrate activity and completed changes

Select real records that demonstrate ordinary operations and higher-risk situations. Useful samples include a recent joiner, a project transfer, a contractor departure, and a privileged-access request.

For each sample, retain relevant dates, approvals, permission changes, and completion evidence. Account-disablement timestamps are stronger evidence of timely removal than an offboarding form without technical confirmation.

Collect appropriate authentication, administrative-change, and remote-access logs. Document what is recorded, how logs are protected, and how exceptions are investigated.

AL2 evidence should support the plausibility review. For AL3, system owners and operational teams should also be ready to explain and demonstrate implementation.

Prepare for assessment and maintain the controls

A structured preparation plan links permission management to the TISAX assessment process managed by the ENX Association.

1. Define the customer-required objectives, locations, systems, processes, and supporting suppliers. Include shared services that administer accounts or host sensitive information.

2. Register the participant and assessment scope through the ENX portal. Select an approved TISAX audit provider for the required assessment.

3. Complete the VDA ISA self-assessment and preliminary readiness review. Map access controls to evidence, identify gaps, and assign remediation owners.

4. Complete the assessment phase. Provide records and interviews appropriate to the assessment level, with on-site examination where applicable.

5. Review the assessment report and implement corrective actions. Retain closure evidence for any required follow-up assessment.

6. Complete final reporting and make assessment results available through the ENX TISAX portal under your chosen sharing permissions.

Where temporary labels apply, they expire nine months after the initial assessment's closing meeting. Corrective-action planning must allow time for remediation and any follow-up assessment.

The ENX TISAX portal states that a TISAX label is valid for three years. Each TISAX label relates to assessment objectives within a defined scope that includes relevant locations.

Preparation time depends on existing governance, system complexity, and evidence quality. In our automotive logistics case study, we supported a 12-month implementation that achieved AL3 labels across two UK locations.

An established ISMS can reduce duplicate work. Uncontrolled legacy permissions, outsourced administration, and incomplete departure records increase remediation effort. Maintain reviews and lifecycle controls throughout the assessment cycle.

Frequently Asked Questions

What is TISAX?

TISAX means Trusted Information Security Assessment Exchange. The ENX Association operates the scheme, which uses the VDA ISA to assess information security and related objectives for the automotive industry.

How do AL2 and AL3 differ?

AL2 uses a provider-led plausibility review supported by evidence and expert interviews. AL3 includes more extensive verification of implementation, including on-site examination.

What access-control evidence should a supplier prepare?

Prepare policies, role matrices, account inventories, approval records, joiner-mover-leaver records, access reviews, and privileged-access records. Keep evidence that shows permissions were implemented, reviewed, and removed when required.

How often should permissions be reviewed?

Set review frequencies according to information sensitivity, account privilege, and operational exposure. The article gives quarterly reviews for sensitive engineering access and monthly reviews for privileged accounts as possible schedules, not universal TISAX requirements.

Make access control a sustainable business process

Sustainable permission governance depends on clear ownership and reliable execution. Approved roles, timely account changes, risk-based reviews, and traceable evidence protect sensitive automotive information throughout the assessment cycle.

Start with permissions that create the greatest exposure. Resolve unnecessary access and build records that demonstrate the changes.

If you would like to find out more information or require any of our services please Contact Us. Complete our contact form to discuss your assessment scope and access-management priorities.