TISAX Information Classification for Automotive Suppliers

TISAX information classification establishes how sensitive information about your automotive work is and which safeguards it needs. Your customer's requirements, assessment objectives and protection needs then determine the appropriate assessment level.

For suppliers, the practical challenge is linking classification decisions to everyday controls and reliable assessment evidence across customer and supplier relationships in the automotive supply chain. A confidential label alone won't demonstrate that engineering files, prototype records or customer data are protected.

Start with the information your organisation handles, then build a clear route through ownership, handling rules and assessment preparation.

Key takeaways

• Classification levels describe information sensitivity; TISAX assessment levels describe assessment depth.

• AL1 is a self-assessment without a label. AL2 and AL3 involve external assessment and can produce labels.

• Every relevant location must be covered by the assessment scope.

• Information owners need documented classification decisions, supported by handling rules and operating records.

Define classification before labelling

ISO 27001 Annex A 5.12 addresses classification according to confidentiality, integrity, availability and relevant stakeholder requirements. Your risk assessment should consider the consequences of disclosure, alteration and unavailability, alongside legal obligations and business needs.

ISO/IEC 27002 control guidance supports implementation. Classification establishes protection needs before Annex A 5.13 labelling communicates them through document markings, metadata or system indicators.

Use a manageable classification scheme

For smaller suppliers, Public, Internal and Confidential provide a practical starting point. Public information is approved for release. Internal information supports business operations. Confidential information requires restricted access because disclosure could harm your organisation or its customers.

However, one Confidential category may conceal important differences. Record whether confidential assets need high or very high protection. A customer may also require a separate Strictly Confidential classification.

Give information owners clear responsibility

Information owners should classify assets and approve changes. IT implements controls, but shouldn't decide business sensitivity without the owner's input.

Your data asset register should record the information owner, classification, protection needs and location of each asset. Include systems, cloud storage, physical records, recipients and applicable retention obligations, including GDPR requirements for relevant personal data.

Review classifications at least annually and after significant changes, such as a new customer contract, project release or storage platform.

Map TISAX information classification to assessment levels

TISAX is administered by the ENX Association on behalf of the VDA. ENX approves audit providers and monitors assessment quality. The VDA ISA catalog, formally the VDA Information Security Assessment catalogue, defines the requirements assessed across the three levels.

The TISAX Participant Handbook explains the assessment routes. Use the mapping below as a planning aid, not a prescribed equivalence. Align internal classifications with applicable TISAX requirements and customer obligations rather than assuming one universal scheme.

Organisations define their scope in the ENX Portal, and the resulting scope ID identifies that assessment scope.

Information and protection needs	Assessment route	Outcome
Public or routine Internal information, without a customer requirement for external assurance	AL1 (AL 1) self-assessment for internal purposes	No TISAX label
Confidential information requiring high protection	AL2 (AL 2) remote audit with document review, evidence interviews and a plausibility check	Label possible after successful assessment
Strictly confidential information requiring very high protection	AL3 (AL 3) comprehensive evidence review, interviews and on-site audit	Label possible after successful assessment

A Public classification doesn't override a customer's assessment requirement. Availability, prototype protection and data protection objectives may also determine the route.

Only AL2 and AL3 can produce externally validated labels. ENX's TISAX overview states that labels are valid for three years.

Labels apply to the assessed scope and locations. Every office, factory or development location involved in the relevant work must be covered appropriately. Multiple locations can sit within one assessment scope; they don't necessarily require separate assessment programmes.

Identify information requiring AL3

AL3 applies when the selected objective requires the higher-assurance route, including information with a very high need for protection. An organisation's size doesn't determine this requirement.

Assess the consequences of disclosure

Strictly confidential or secret customer information can require AL3. Relevant automotive material includes unreleased vehicle designs, sensitive crash-test results and flow-simulation data where disclosure would cause severe harm.

The decision depends on the actual information, contractual obligations and assessment objective. An ordinary test report doesn't automatically carry the same protection needs as confidential development results.

Prototype parts and vehicles can introduce additional physical-security requirements. Our guidance on automotive-specific TISAX requirements explains these distinctions.

Treat AI assets according to their sensitivity

AI systems may require AL3 where model files, training data, source code or development results need very high protection. Using AI doesn't automatically trigger AL3.

Assess what the system contains, who can access it and what compromise would mean for the customer. ISO 42001 addresses AI management-system governance, but doesn't replace TISAX assessment objectives or information-security controls.

Implement class-specific handling rules

A classification scheme becomes useful when staff understand what changes between classes. Define controls across the information lifecycle, including receipt, storage, use, sharing, backup and disposal.

1. Establish the business boundary. Record the legal entity, locations, teams, systems and outsourced services that handle automotive information. Include shared IT administration and production-support systems where relevant. Document customer objectives and deadlines alongside this boundary.

2. Classify information with its owner. Assess disclosure, alteration and unavailability separately. Record customer markings and contractual restrictions. Keep the original classification when information enters your systems unless an authorised owner approves a change.

3. Define access and storage requirements. Apply role-based permissions through access control, using least privilege and appropriate authentication. State where each class can be stored and how encryption, backups and physical storage protect it. Include administrative access and remote working.

4. Control external sharing and physical handling. Specify approved transfer channels, recipient authorisation and supplier obligations. For prototype protection, address photography, visitors, transport and secure areas. Require approval for public release rather than relying on someone to remove a marking.

5. Set retention, review and disposal rules. Align retention with contractual and legal obligations. Define secure deletion and destruction methods. Preserve information subject to legal holds, and record who can approve disposal or reclassification.

TISAX training should use these rules in role-specific situations. Engineering, procurement, facilities and IT need guidance that reflects their responsibilities.

Prepare evidence that shows controls operate

A policy describes intended behaviour. Assessors also need records showing that the behaviour happens within your defined scope.

Connect requirements to operating records

Download the Excel-based ISA self-assessment from the ENX downloads centre. Map each applicable requirement to its owner, implementation description, evidence location, document version and review date.

For classification, prepare the approved scheme, asset register, owner decisions, handling procedures and review history. Support them with access approvals, permission reviews, transfer records, staff training and disposal evidence.

Our TISAX assessment evidence checklist covers the wider governance and operational records needed.

Separate maturity from assessment depth

The VDA ISA maturity level scale runs from 0 to 5. Level 0 indicates an incomplete process without structured implementation; level 5 describes optimisation and continuous improvement.

Maturity describes how consistently a control operates. AL2 or AL3 describes how thoroughly the assessor examines it. Neither an ISO 27001 maturity assessment nor a strong policy library proves that a TISAX label has been achieved.

Evaluate maturity against the applicable questions and objectives in your self-assessment. Test evidence samples before assessment, and track gaps through corrective actions with accountable owners.

  An access policy won't prove that confidential engineering files are restricted. Approval records, current permissions and completed access reviews provide that evidence.  

Plan costs, timing and catalogue changes

TISAX costs include ENX registration and participation fees, independent assessment-provider charges, and internal preparation work. These are separate budget items.

There isn't a universal AL2 price or fixed percentage uplift for AL3. Assessment effort depends on locations, objectives, complexity and evidence readiness. On-site work also introduces travel and coordination costs.

Build the delivery plan around gaps and dependencies. Funding access controls, supplier remediation or physical-security improvements may matter more than the assessment fee. Preparation takes longer when controls must first be implemented and generate usable records.

For assessments ordered during 2026, VDA ISA 6.0.3 applies. ENX's ISA2027 transition announcement establishes the new catalogue for assessments ordered from 1 January 2027. Use the order date when planning applicable requirements.

Maintain controls throughout the label's validity. TISAX doesn't use the standard annual surveillance-audit cycle associated with ISO management-system certification.

Frequently asked questions

Can ISO 27001 certification replace TISAX?

ISO 27001 certification doesn't replace a required TISAX assessment. It demonstrates conformity of an information security management system (ISMS), whilst TISAX assesses applicable automotive requirements and enables controlled sharing of assessment results. Customers may use the term "TISAX certification", but TISAX outcomes are assessment labels rather than conventional certification.

Existing ISO 27001 training, risk assessments and audit records can support preparation. ISO 27001 auditing evidence still needs mapping to the relevant VDA ISA requirements, scope and locations.

For manufacturers serving several markets, CMMC addresses separate US defence-contract obligations. These frameworks can share supporting controls, but their assessment outcomes aren't interchangeable.

What support helps a smaller supplier prepare?

A smaller supplier needs clear ownership, a realistic gap analysis and evidence coordination. A vCISO can provide senior security oversight where there isn't a full-time CISO.

TISAX consultancy can translate customer objectives into scope, controls and preparation priorities. TISAX auditing remains an independent assessment by an approved provider.

Our ISO 27001 consultancy and TISAX implementation support help organisations strengthen existing processes and address automotive-specific gaps. Internal owners remain responsible for classification decisions and day-to-day control operation.

Build classification into everyday security

Effective TISAX information classification connects business sensitivity to working controls. The strongest preparation starts with accountable information owners and follows each asset through its lifecycle.

Use that understanding to define the assessment scope, address protection needs and build evidence that reflects daily practice.

If you would like to find out more information or require any of our services please Contact Us and complete our contact form.