Choosing a TISAX Assessment Provider: Questions to Ask

Choosing a TISAX assessment provider starts with ENX approval, the right assessment scope and a clear understanding of your customer's requirements. Automotive suppliers need an independent assessment that covers the information, locations and services their partners rely on.

A familiar name or low quotation doesn't establish whether the proposed assessment will meet those needs. The priority is a clearly scoped engagement, supported by relevant experience and transparent costs.

Start by separating the provider's assessment responsibilities from the preparation your organisation must complete.

Key takeaways

• Only an ENX-approved assessment provider can conduct the official TISAX assessment; a preparation consultant has a different role.

• Customer requirements and assessment objectives determine the appropriate scope and level, rather than budget alone.

• Compare quotations covering the same locations, objectives, assessment activities and follow-up arrangements.

• TISAX produces assessment results and labels, not certificates, and results are shared with authorised partners through ENX.

What should a TISAX assessment provider deliver?

An assessment against the VDA ISA

TISAX stands for Trusted Information Security Assessment Exchange and is a registered trademark owned by the ENX Association. Established by VDA and ENX in 2017, it provides a common assessment and results-sharing mechanism for automotive information security.

A process sometimes called a "TISAX audit" is an independent assessment against the VDA ISA. The assessment baseline is the VDA Information Security Assessment catalogue. It builds on ISO/IEC 27001 principles with automotive requirements covering information security, prototype protection, data protection and supplier relationships.

ENX approves providers and monitors assessment quality. It maintains the Assessment Criteria and Audit Requirements, known as ACAR, whilst its ISA working group maintains the assessment catalogue.

Independence from preparation support

Ask: "Are you conducting the official assessment, providing preparation support, or offering separate services through different teams?"

A consultant can identify gaps, help implement controls, review evidence and prepare employees. Only an approved provider can conduct the independent assessment supporting a label.

A TISAX certification isn't issued, as the process produces assessment results and labels, not certificates. Our preparation support and the external provider's assessment decision are separate responsibilities. Where related organisations offer both services, impartiality arrangements need to be explicit.

A promise of guaranteed approval is a warning sign. The outcome depends on demonstrated implementation against the applicable requirements.

Which locations, systems and dependencies are in scope?

Ask: "How will your proposal address our registered scope and shared services?"

Your organisation registers through the ENX portal and defines its assessment scope, including relevant locations, processes and protection needs. The ENX TISAX overview sets out this registration-led process.

The scope should reflect where automotive information is handled and the resources that protect it. This can include engineering sites, remote workers, central IT, cloud platforms, HR processes and outsourced services.

A narrow operational boundary doesn't remove supporting dependencies. Centrally managed identity systems and supplier access can affect information security across the supply chain and multiple locations.

Give each shortlisted provider the same scope information, customer requirements, relevant OEM-specific objectives and deadline. Include data types, prototype activities, organisational size and existing security arrangements. This makes quotations comparable and reduces later changes to assessment effort.

Does the proposed assessment level meet the requirement?

Ask: "What assessment activities are included for our required level?"

Assessment levels describe the depth of review. They aren't the same as VDA ISA maturity levels, which describe how consistently individual controls operate.

The three levels involve different assessment approaches.

Level	Assessment approach	Label outcome
AL1	Internal self-assessment without substantive external verification	No TISAX label
AL2	Plausibility review of the self-assessment, evidence and expert interviews, generally conducted remotely	Can support a TISAX label
AL3	Detailed evidence review, interviews and on-site inspection	Can support a TISAX label

AL2 isn't simply a cheaper substitute for AL3. The appropriate level follows the required objectives and protection needs.

AL3 normally requires more coordination around site access, staff availability and physical controls. AL2 still requires credible evidence and employees who can explain implementation.

An ISO 27001 certificate provides useful supporting assurance, but it doesn't automatically satisfy the customer's TISAX requirement. Our guidance on TISAX requirements beyond ISO 27001 explains the additional automotive expectations.

How should you shortlist a TISAX assessment provider?

Start with approval and delivery coverage

Check that the audit provider has current ENX approval. The ENX provider directory is the authoritative starting point for an approved-provider shortlist.

Provider examples include BSI, DNV, Bureau Veritas, EY, KPMG, SGS, TÜV NORD, Deloitte, TÜV SÜD, DEKRA, DQS, PwC and TÜV Rheinland. This isn't an exhaustive list or a ranking.

Ask: "Which legal entity will contract with us, and which team will perform the assessment?" Also ask: "What qualifications and relevant experience do the proposed assessors have?" Check provider approval and assessor competence separately.

Local sales coverage doesn't establish that local auditors are available. Contracting arrangements, delivery locations and travel assumptions therefore deserve separate attention.

Assess experience relevant to your operations

Ask: "What experience does the proposed team have with comparable environments?"

Experience in the automotive industry can help assessors understand the different needs of prototype engineering, software suppliers and other operations. An engineering business handling prototypes has different operational evidence from a software supplier or marketing agency.

Language also matters. Employees responsible for physical security, HR or operations must be able to explain their controls accurately.

Request a named contact, the proposed assessment language, a reporting cadence, an escalation route and arrangements for replacement assessors. Clear responsibility supports consistent communication when evidence questions or findings arise.

What should the quotation include?

Separate assessment fees from preparation costs

Ask: "Which activities are included, and what can generate additional charges?"

A comparable quotation should identify the initial assessment, site visits, travel, reporting, corrective-action-plan review and follow-up assessment arrangements. Scope changes and rescheduling terms also affect the final cost.

There is no universal TISAX assessment tariff. Budget separately for ENX participation and scope fees, the provider's assessment, internal staff time and any preparation support.

For a concrete preparation cost, our TISAX consultancy packages and pricing list a Gap Analysis/Internal Audit service at £3,500. This is preparation support, not the fee for an official external assessment.

Keep those categories separate when comparing proposals.

Distinguish auditor effort from elapsed time

Ask: "What auditor effort is planned, and what assumptions underpin the schedule?"

The TISAX Participant Handbook gives indicative effort of 3.5 to 4 auditor person-days for AL2 and 5 to 6 for AL3 for an average small, single-location organisation.

These are effort estimates, not guaranteed completion times or prices.

The handbook also describes self-assessment preparation as typically taking one to three months, with six months not unusual. Existing controls, evidence gaps and available staff affect preparation.

A useful schedule separates readiness work, the provider's assessment dates, corrective actions and follow-up. A short assessment booking doesn't mean your organisation can obtain a final result within the same period.

What evidence and technical testing will the assessor expect?

Ask: "How will you evaluate whether our controls work in practice?"

Policies establish expectations. Records demonstrate implementation. Relevant evidence includes access reviews, leaver records, supplier assessments, incident handling, backup restoration tests and security training. These records support TISAX compliance, meaning ongoing alignment with applicable VDA ISA requirements, rather than a separate certificate or guaranteed status.

Our TISAX evidence checklist supports preparation across these operational areas.

Where personal data is in scope, ask how applicable GDPR obligations appear in documented controls. A TISAX assessment doesn't replace a GDPR review.

Technical assurance should follow risk and scope. VDA ISA doesn't impose a universal penetration-testing requirement, but assessors expect credible evidence that technical controls are effective. Penetration testing can support that evidence where relevant; it doesn't replace patch management, secure configuration or corrective action.

  A successful penetration test cannot establish that access removal, supplier oversight or incident reporting works consistently.  

The assessment plan should also identify the people required for interviews. IT cannot answer for every control. Operations, HR, procurement, account teams and senior management may all need to contribute.

How are findings resolved and results shared?

Ask: "How will evidence be transferred, who can access it, where will it be stored, and how long will it be retained? When will it be deleted? How will findings, follow-up requests and result publication be managed?"

A provider should explain how findings are classified, communicated and reassessed. Each corrective action needs an owner, target date, root-cause analysis and evidence of completion.

Correcting one instance may leave a wider weakness unresolved. Removing a former employee's access addresses the immediate exposure; improving the leaver process addresses recurrence.

The assessment process allows up to nine months to resolve non-conformities. Treat that as an outer limit, rather than the planned duration of remediation.

Following the relevant assessment and closure activities, results are made available through the ENX exchange. It can support mutual recognition among participating partners when scope and objectives align, but acceptance isn't automatic for every customer. Your organisation controls sharing permissions with authorised partners.

TISAX results aren't intended for general public disclosure. A website statement or downloadable badge doesn't replace the controlled result-sharing process.

A single result can support several customer relationships where the scope and objectives meet their requirements. The provider's assessment decision remains independent of those commercial relationships.

Frequently asked questions

How long does a TISAX label remain valid?

A regular TISAX label is valid for three years. Renewal requires a new assessment, rather than an administrative extension.

Material changes to locations, systems, ownership or customer activities can affect the assessed scope before expiry. Maintaining controls and reviewing operational changes remain ongoing responsibilities.

Which ISA version applies around the 2027 transition?

Assessments ordered during 2026 use ISA6. The ENX ISA2027 announcement states that assessments ordered from 1 January 2027 use ISA2027.

ISA now follows an annual update approach, with the order year determining the applicable version from 2027. March 2027 is the final month to open an initial assessment under ISA6. Existing labels retain their validity.

Choose a provider against a clear requirement

A suitable TISAX assessment provider combines current ENX approval, relevant operational experience and a transparent assessment proposal. Clear scope, realistic scheduling and working evidence give your organisation a stronger basis for the independent review.

Keep preparation and assessment responsibilities distinct. That protects impartiality and makes ownership of the work clear.

If you would like to find out more information or require any of our services please Contact Us and complete the contact form.