TISAX Assessment Results: Sharing Through the ENX Portal
TISAX assessment results are shared through the ENX Portal using permissions controlled by the assessed organisation. Access depends on the recipient, registered scope and selected sharing level, rather than an unrestricted public certificate.
For suppliers in the automotive supply chain, completing the assessment is only part of meeting a customer's requirement. The result must cover the right operations and labels, and the correct partner must receive access.
Start by understanding what the result demonstrates and how controlled sharing works.
Key takeaways
TISAX results apply to defined assessment scopes and objectives, not automatically to every site or business activity.
Selective sharing requires the recipient's Participant ID and a deliberate choice of sharing level.
You can withdraw publication and revoke recipient-specific sharing during the result's validity period, but you can't edit a sharing permission once granted.
What TISAX assessment results demonstrate
TISAX means Trusted Information Security Assessment Exchange. The VDA, Verband der Automobilindustrie, established it in 2017 as an assessment framework based on the VDA Information Security Assessment, or VDA ISA. TISAX also provides a controlled process for sharing assessment results.
The ENX Association governs TISAX. Its membership includes automotive manufacturers, suppliers and four national automotive associations.
Results, reports and labels
An assessment report records the provider's findings against the selected requirements. A TISAX label indicates that the corresponding assessment objective has been achieved within the registered scope.
The outcome is an assessment result and associated labels, rather than an ISO-style certificate. Completing an assessment doesn't automatically establish a successful outcome. Non-conformities may require corrective actions and follow-up before final labels are issued.
Validity and limitations
TISAX labels are generally valid for up to three years. The expiry date matters alongside the labels, locations and scope description.
As the ENX frequently asked questions explain, participation follows a defined assessment process. A result covering one registered scope doesn't automatically extend to newly acquired sites, additional services or unrelated operations.
The three steps to obtain and exchange a result
Registration
Your organisation registers through the ENX Portal, accepts the TISAX Participation General Terms and Conditions and registers its scope. Registration is subject to ENX participation fees.
The Participant ID identifies the participating organisation. The Scope ID identifies a particular registered scope. These identifiers have different purposes and aren't interchangeable.
Assessment
An ENX-authorised TISAX audit provider assesses the selected objectives using the applicable VDA ISA questionnaire. Provider charges are separate from ENX participation fees.
Preparation includes a self-assessment and evidence of implemented controls. AL2 involves an external plausibility assessment, whilst AL3 includes more extensive examination and on-site inspection. AL1 self-assessment doesn't produce a TISAX label.
Findings may lead to a corrective action plan and follow-up. Our guidance on managing TISAX corrective actions explains how to organise remediation evidence.
Exchange
The provider submits the result to the portal. The assessed organisation then controls its release through publication or selective sharing.
Assessment completion alone doesn't make the result visible to customers. Submission, applicable fee payment and the relevant publication or sharing permission are separate conditions.
Choose the right assessment scope and objectives
Standard and custom scopes
TISAX offers standard and custom scope types. ENX encourages the standard scope because many automotive partners accept only results based on it.
The standard scope covers processes and resources at registered locations that are subject to automotive partner security requirements. These include data centres, development and production sites, work equipment, employees, contractors and IT infrastructure.
Supporting services matter too. Shared IT administration, cloud hosting and outsourced security services can affect the assessed operation. Our guidance on TISAX assessment scope boundaries explains these dependencies.
A custom scope changes the standard definition. That flexibility can limit customer acceptance, so a narrower boundary doesn't necessarily produce a commercially useful result.
Objectives determine the required labels
At least one of the assessment objectives is required, and each corresponds to a TISAX label.
Earlier guidance describes eight objectives: high and very high information protection needs, four prototype-related objectives and two GDPR data-processor objectives. ISA 6 introduced more differentiated confidentiality and availability labels, so the older eight-objective description doesn't cover all current choices.
Objectives can have dependencies. Protection of prototype parts and components also requires information with high protection needs.
The selected objectives must match the labels required for the relevant customer activity. A general information security result doesn't automatically establish prototype protection.
Understand the VDA ISA evidence behind the result
VDA ISA is largely based on ISO/IEC 27001 and ISO/IEC 27002. An existing information security management system provides useful evidence, but an ISO 27001 certificate doesn't replace a required TISAX assessment.
Where NIS2 applies, its cyber-risk duties may inform governance evidence, but they don't replace a customer-required TISAX assessment result.
The criteria catalogue is organised across three areas: information security, prototype protection and data protection. Earlier ISA editions used the familiar breakdown of 41, 22 and four questions respectively. These counts are edition-specific, rather than a permanent specification for future questionnaires.
VDA ISA uses six maturity levels:
Incomplete means the process is absent or inadequate. Performed means it operates; Managed adds planning and control. Established means a defined, implemented process. Predictable adds measurement, whilst Optimizing addresses systematic improvement.
Level 3, Established, is the baseline target for applicable control questions. Applicability and objective-specific requirements still determine the evidence needed.
A maturity level describes control implementation; TISAX assessment levels describe the depth of assessment. A maturity score of three doesn't mean an AL3 assessment has taken place.
Policies alone aren't sufficient evidence. Operating records, interviews and implementation evidence demonstrate whether controls work within the assessed scope.
How to share TISAX assessment results through ENX
The TISAX Participant Handbook describes the official portal procedure. Selective sharing attaches a permission to a particular assessment scope and recipient.
Use the following sequence:
Sign in and open MY TISAX, then SCOPES AND ASSESSMENTS. Locate the relevant scope and check that its status is Active.
Open Scope Information, select EXCHANGE, then open SHARING and choose Share.
Enter or select the recipient's Participant ID. Check that it identifies the intended participating organisation, rather than relying only on a familiar trading name.
Select the sharing level and choose Next. The level determines how much assessment information the recipient can access.
Read the permanence notices, select both confirmation checkboxes and choose Submit.
The recipient's Participant ID identifies the organisation receiving access. It isn't an individual employee's login or the recipient's Scope ID.
The selected sharing level controls whether the recipient can access labels, summary information or more detailed assessment information. Sharing a label doesn't automatically provide access to the full report or unrestricted information.
A recipient-specific sharing permission is a lasting disclosure decision. Approve the recipient, scope and information depth before submitting it.
Publication, permissions and partner verification
Publication and selective sharing have different audiences
Publication makes information available to TISAX participants at the selected publication level. Selective sharing grants a named participant access at the selected level, which may include more detail than publication.
Neither option makes results publicly searchable on the open internet. The ENX assessment results service operates within the TISAX participant portal.
ENX states that publication and sharing permissions cannot be revoked during the assessment's validity period. Treat a submitted permission as fixed, not as an editable access grant. This rule applies to portal permissions, not copies a recipient may already have downloaded.
How the receiving partner assesses the result
The recipient signs in through its own participant account and accesses the results released to it.
Its review should match the assessed participant, Scope ID, registered locations, required labels and expiry date against the supplier requirement. The accessible detail depends on the permission granted.
A PDF or screenshot can provide supporting information, but it doesn't establish current portal access. There is no unrestricted public TISAX certification register that replaces controlled sharing.
ISA versions and transition dates
The applicable questionnaire depends on the assessment's timing. The following milestones distinguish ordering dates from assessment commencement.
ISA version | Published transition position |
|---|---|
ISA 5 | Assessments ordered before 1 April 2024 can still use version 5. |
ISA 6.0.3 | ENX lists ISA 6 for assessments starting after 1 April 2024. |
ISA2027 | Applies to assessments ordered from 1 January 2027. |
ENX also gives March 2027 as the final window to open an initial assessment under ISA 6, without specifying a day.
The published wording needs careful interpretation: the January ordering threshold and March opening cutoff are different milestones. The March statement doesn't establish general permission to place new ISA 6 orders during 2027.
The ENX downloads area contains questionnaires, change logs, the Participant Handbook and participation terms. It also includes the Simplified Group Assessment addendum for organisations with many locations and a centralised, highly developed ISMS.
Annual questionnaire releases don't shorten existing labels' validity.
Frequently asked questions
Is TISAX mandatory?
TISAX isn't a general legal requirement for every automotive supplier. It becomes a business requirement when an OEM or another customer requires the relevant assessment result for its supply chain.
Can ISO 27001 replace a TISAX result?
An ISO 27001 certificate demonstrates conformity with an international management system standard. TISAX adds automotive-specific objectives and controlled release of results. Our explanation of TISAX requirements beyond ISO 27001 covers the distinction.
Can a partner download a universal results template?
A template can't establish an organisation's assessed status. The meaningful evidence is the actual scope-specific result and associated labels made available through ENX, at the authorised sharing level.
Make result sharing a controlled business decision
A useful TISAX result combines the required labels, an accurate scope and valid assessment status. Sharing then gives the intended partner access to the appropriate level of information.
Treat permission approval as part of your compliance process. ENX sharing decisions remain effective for the assessment's validity period.
If you would like to find out more information or require any of our services please Contact Us and complete our contact form.
Comments