TISAX Assessment Scope: Sites, Teams and Information Flows
Across the automotive industry, original equipment manufacturers need assurance that sensitive information is protected wherever their suppliers handle it. A well-defined TISAX assessment scope establishes which locations, operations and supporting resources will be assessed.
An incomplete boundary can leave important dependencies unexamined and delay customer acceptance. The starting point is documented operational boundaries, agreed across information security, IT, facilities and business teams.
Start with the customer requirement, then trace the activities and information flows that support it.
What a TISAX assessment scope covers
TISAX, the Trusted Information Security Assessment Exchange, is an assessment and exchange mechanism operated by the ENX Association. It uses the VDA Information Security Assessment, as set out in the VDA ISA catalog.
The ENX TISAX portal explains how participants assess their security arrangements and share results with authorised partners in the automotive industry. This exchange supports supply chain security. TISAX produces assessment results and labels, rather than certification.
Assessment boundaries and business boundaries
Your assessment scope identifies the processes, procedures, resources and registered locations relevant to customer security requirements and selected objectives. It doesn't automatically cover your organisation's entire business or every site worldwide.
However, a narrower business boundary must still account for the resources needed to protect information within it. Selecting one automotive operation doesn't justify ignoring shared security controls.
Supporting functions belong in the analysis
Engineering and manufacturing may handle customer information directly. HR, procurement, facilities and central IT can affect its protection through recruitment, supplier management, access permissions and physical security.
Record how these functions support the assessed operations. Their organisational position alone doesn't determine whether their activities are relevant.
Standard scope and custom scope: choose deliberately
ENX provides three scope types: Standard scope, Custom extended scope and Full custom scope. The Standard scope has a predefined description that participants cannot change.
For organisations seeking recognised results for automotive customers, begin by checking whether this predefined option meets their requirements. Its fixed description supports a consistent understanding of the activities assessed at registered locations.
Custom scopes require separate consideration. They aren't simply predefined scopes with inconvenient processes removed.
The TISAX Participant Handbook sets out the available scope types and registration requirements. Before selecting either custom variant, confirm its implications with ENX and your prospective audit provider, including label eligibility, result sharing and customer acceptance.
Obtain agreement before registration. A technically detailed scope can still fail its commercial purpose if the customer doesn't accept the resulting assurance.
Keep the registered scope description separate from your supporting documentation. You can explain internal boundaries, systems and responsibilities without changing the registered description.
Identify the sites and teams involved
Register locations against actual operations
Build your location inventory around where relevant work takes place. Review engineering offices, manufacturing facilities, warehouses, prototype storage areas and supporting locations.
For each location, document its address, activities, information handled and responsible manager. Identify shared premises, landlord-controlled facilities and access arrangements that affect security.
Assess remote working within the relevant operational controls. Don't assume each home address must become a registered location, or that remote activity falls outside assessment.
Establish ownership across departments
Name the people responsible for access management, incident response, supplier security, employee lifecycle controls and facilities protection. Record both central ownership and local implementation.
AKRUP's work with R & H Automotive involved senior management, IT, HR and operational teams. The 12-month engagement supported achievement of AL3 labels across two UK locations. That project demonstrates the cross-functional preparation involved, rather than a standard timescale for every organisation.
Where several sites use a common information security management system, discuss the assessment approach with your provider. ENX's Simplified Group Assessment guidance describes an option for eligible group arrangements. Shared policies alone don't establish eligibility or remove the need to identify participating locations.
Map dependencies and information flows
An organisational chart shows reporting lines. Your scope documentation must also show how information moves and which services protect it.
Trace the information lifecycle
Follow customer information through receipt, use, storage, transfer, archiving and disposal. Include design files, manufacturing instructions, personal data and prototype-related information where relevant.
For each flow, record the information owner, classification, sending and receiving locations, systems used and permitted recipients. Document transfer controls and retention requirements.
Physical movements matter too. Prototype parts, printed drawings and storage media can cross boundaries without appearing in a network diagram.
Make shared services visible
Review central identity services, email, backups, remote support, cloud hosting and outsourced IT. Identify which internal teams or suppliers administer them and what access they hold.
A service dependency doesn't automatically bring an external provider's entire business into your assessment. Its relevance must still be addressed through appropriate controls, responsibilities and evidence.
An excluded location can still provide an essential service to an assessed site. Document the dependency and its controls rather than treating exclusion as proof of irrelevance.
Confirm with your audit provider whether a supporting internal location needs registration or another form of assessment coverage.
Select assessment objectives and levels
Assessment objectives describe the protection needs you must demonstrate. Assessment levels describe the depth of verification. They’re related, but they aren’t interchangeable.
Match objectives to customer requirements
The VDA ISA catalog describes 12 objectives, including information protection and specialist automotive requirements. Confirm the required objectives with your customer before registration.
The objectives cover these protection needs:
Protection area | Objective names |
|---|---|
Information security | Info high; Info very high |
Confidentiality | Confidential; Strictly confidential |
Availability | High availability; Very high availability |
Prototype protection | Proto parts; Proto vehicles; Test vehicles; Proto events |
Data protection | Data; Special data |
Choose assessment objectives that reflect customer requirements and the operations in scope. Confirm whether they involve high protection needs or very high protection needs. A supplier handling prototype parts has different assessment needs from one providing an information-based service.
Understand AL1, AL2 and AL3
AL1 is principally a self-assessment, without review of its content or further evidence. It doesn’t provide the independently verified assurance associated with AL2 or AL3.
AL2 includes a plausibility check and interviews, generally through web conferences. The participant can request an on-site inspection.
AL3 involves comprehensive verification, including detailed evidence checks, in-person interviews and on-site inspection.
An assessment is conducted at least at the highest assessment level selected for the scope’s objectives. A control’s maturity level is separate from AL1 to AL3, which describe verification depth. Don’t choose a lower level solely to reduce preparation effort.
Create a defensible scope record
Keep a controlled scope pack alongside your ENX registration. It should allow management, implementation teams and assessors to understand the same boundary.
Prepare it in this order:
Record the customer requirement, selected objectives, scope type and locations, with named approval owners.
Describe relevant activities, information assets, systems and departments, including shared services and outsourced responsibilities.
Map information flows and boundary crossings, then document exclusions with their rationale and supporting controls.
Link each relevant control to its owner, applicable locations and evidence, and approve the pack before assessment preparation proceeds.
Give the document a version number, approval date and review owner. Keep registration details consistent with the operational description.
A useful exclusion explains why an activity sits outside the assessed boundary and how any connection is controlled. "Different department" is insufficient where that department administers systems used by assessed operations.
AKRUP's TISAX consultancy and assessment support can help teams confirm locations, objectives and dependencies before committing to an assessment plan.
Prepare and register against the agreed boundary
Complete a VDA ISA self assessment against the actual scope. This is a compliance assessment of selected VDA ISA requirements within the agreed scope, not a certification or proof of compliance with every law. Describe implemented controls, reference evidence and assess maturity based on operating practice, rather than policy wording alone.
An existing ISO/IEC 27001 (ISO 27001) information security management system provides useful foundations. However, its certified boundary may differ from the TISAX assessment scope. ISO 27001 consultancy can help align governance and evidence without assuming the frameworks are interchangeable.
Data protection objectives don't establish complete GDPR compliance. For UK operations, review UK GDPR and Data Protection Act 2018 obligations separately, alongside other applicable laws.
Registration involves creating an ENX portal account, registering as a participant and registering the scope. Provide the scope type, contact, objectives, locations and billing information.
Then select an ENX-accepted audit provider and complete the formal assessment process. Customers may call this a “TISAX audit”, but assessment is the formal terminology. Results can subsequently be exchanged with authorised partners.
Arrange evidence and interviews by location and control owner. Give the provider visibility of shared services early, rather than introducing them during the assessment.
Maintain the boundary and manage corrective actions
TISAX labels are generally valid for three years. ENX's frequently asked questions provide guidance on participation and the assessment process. If a customer requests a future TISAX audit, remember that ENX formally describes the process as an assessment.
Review scope implications when sites move, services change, organisations merge or new customer activities begin. Discuss material changes with your provider and ENX where appropriate, and don't assume existing results cover newly added operations.
For non-conformities, record the affected control, location, root cause, corrective action, owner and completion evidence. Distinguish a local failure from a weakness in a centrally managed process.
ENX allows up to nine months to resolve non-conformities within the assessment process. Plan corrective work promptly and obtain your assessment provider's confirmation that the evidence supports closure.
Key takeaways
Define assessed operations and locations without assuming the entire business must be included.
Document supporting teams, outsourced services and information flows across the boundary.
Confirm scope type, objectives and customer acceptance before registration.
Maintain consistent evidence and review the boundary when operations change.
Frequently asked questions
Does every site need assessment?
Every site isn't automatically included. Register locations relevant to the chosen scope and objectives. Review supporting locations separately, because central IT, storage or administrative activities may affect assessed operations. Confirm their required treatment with your audit provider.
How does scope affect assessment costs?
The number of locations, objectives, verification level and shared-service arrangements affect assessment effort. Provide consistent scope information when requesting quotations. Compare preparation support and external assessment costs separately, and clarify assumptions about travel, interviews and corrective-action reviews.
Build assurance around the agreed scope
A reliable scope connects customer requirements with the locations, teams and services that protect their information. Clear boundaries and visible dependencies give your organisation a stronger basis for preparation and ongoing control.
Agree the scope record before registration, then keep it aligned with operational changes.
If you would like to find out more information or require any of our services please Contact Us and complete the contact form.
Comments