TISAX Physical Security Controls for Automotive Sites

TISAX site controls protect automotive information, equipment and prototypes against unauthorised access, observation, loss and damage. What your organisation needs to demonstrate depends on the VDA ISA requirements, assessment objectives and agreed scope.

For suppliers in the automotive industry, preparation requires facilities, security, IT and operational teams to work together. Start with customer or OEM requirements, then connect each applicable control to a responsible owner and evidence of day-to-day operation.

Key takeaways

• Physical controls must reflect the locations, activities and information within your assessment scope.

• ISO 27001 provides useful foundations, but doesn't automatically produce a TISAX label.

• Access records, visitor logs, maintenance records and prototype-handling evidence demonstrate implementation.

• A generic checklist cannot guarantee an assessment result.

What TISAX assesses

TISAX stands for Trusted Information Security Assessment Exchange. Introduced in 2017 by the German automotive association VDA, it's administered by the ENX Association.

Although customers often request "TISAX certification", the scheme provides assessment results and labels rather than an ISO-style certificate. Organisations can share results with authorised partners, which can reduce repeated customer assessments.

Assessments use the VDA Information Security Assessment catalogue, known as VDA ISA. It draws on ISO 27001 and ISO 27002 and covers Information Security, Prototype Protection and Data Protection. Where personal data is involved, GDPR duties apply alongside the relevant VDA ISA objectives and don't replace them.

Physical security sits within information security alongside access management, cryptography and supplier relationships. Prototype objectives introduce additional protection needs.

An established information security management system, or ISMS, supports preparation. However, our guidance on TISAX requirements beyond ISO 27001 explains why automotive objectives and site-specific evidence still need separate attention.

Define the site boundary before registration

Customer requirements within the automotive industry inform the assessment objectives. Your organisation must then define which locations, processes and supporting resources belong within the scope.

Trace where customer information is received, used, stored and transferred. Relevant dependencies may include offices, production areas, development facilities, data centres, contractors and shared building services.

A landlord-controlled entrance doesn't remove your responsibility for protecting the assessed operation. Document how shared reception, loading bays and maintenance access affect security.

The formal process has three stages:

1. Register your organisation and assessment scope through the participant portal.

2. Complete the assessment with an ENX-approved audit provider and address findings.

3. Exchange results with authorised partners through the portal.

The TISAX Participant Handbook explains the scope and assessment process. Our TISAX preparation guidance also supports the initial planning work.

Understand assessment levels and maturity

AL1, AL2 and AL3 assess different depths

AL1 is a self-assessment without independent verification. It doesn't produce a TISAX label.

AL2 involves an approved provider checking the plausibility of the self-assessment through evidence review and an expert interview.

AL3 provides comprehensive verification, including an on-site audit. Assessors examine records, interview responsible employees and inspect how controls operate.

The required assessment level follows the assessment objectives and customer expectations. Organisations shouldn't select AL2 simply because it appears easier, or assume every automotive engagement requires AL3.

Maturity measures how consistently controls operate

VDA ISA uses six maturity levels, starting at 0, incomplete, and reaching 5, optimising. Level 3, established, is the target for applicable controls.

Assessment level describes verification depth, while maturity level describes how consistently controls operate. An access policy alone doesn't demonstrate an established process. The organisation also needs defined responsibilities, consistent implementation and records that support its answers.

For example, badge approvals, periodic access reviews and prompt removal of leavers' access demonstrate more than a written commitment to restrict entry. Assessment readiness depends on both the control design and its operation.

TISAX physical security controls for offices and plants

Site safeguards protect information by controlling access to the places, equipment and materials that contain it. A risk assessment can help tailor measures to the site, assessment scope and risks. Check current requirements against official ENX and VDA materials.

Site access and visitor management

Define security zones and use access control to set permissions for each area. A public reception, engineering office and restricted development room shouldn't automatically share the same access permissions.

Assessors may examine visitor registration, identity checks, badge issue, escort arrangements and contractor access. They may also inspect doors, loading entrances, perimeter protection, monitored alarms or other monitoring where appropriate, and arrangements outside normal working hours.

Set out how staff report security incidents, who responds and when to escalate them. Prepare approved access lists, visitor records, access-review results and evidence that lost or withdrawn credentials are disabled. Include exception handling, such as an unattended reception or emergency maintenance visit.

Offices, server rooms and environmental protection

Protect confidential documents, removable media and unattended screens. Use secure storage for sensitive materials and equipment where the site's scope and risks require it. Clean-desk arrangements should match the information handled and the site's working practices.

Restrict server rooms and communications cabinets to authorised personnel. Document how cleaners, maintenance engineers and external technicians gain supervised or approved access, and how equipment and removable media are secured.

Environmental controls should address relevant risks, including fire, water ingress, power interruption and unsuitable operating conditions. Maintenance reports, alarm tests and inspection records help demonstrate that protection remains operational.

Apply additional controls to prototype work

Prototype protection requires attention to what outsiders can see, photograph, access or remove. Applicable measures depend on the prototype activity and selected assessment objectives.

Secure rooms and control photography

Restrict prototype rooms to authorised people with a business need. Consider sightlines through windows, open workshop doors and neighbouring premises.

Camera bans need practical enforcement. Define how staff, visitors and contractors handle phones, cameras and other recording devices. Record authorised photography and control where approved images are stored.

Opaque coverings and screened work areas can reduce exposure. Their use must fit the activity, including movement between secure rooms and loading areas.

Protect transport and external handling

Prototype parts and vehicles remain exposed during collection, transport, temporary storage and delivery.

Define packaging or covering requirements, approved carriers, authorised recipients and handover responsibilities. Delivery records and documented exceptions provide evidence that the process works.

Include external workshops, test facilities and disposal contractors where they support the assessed activity. A secure development room doesn't resolve weaknesses elsewhere in the handling process.

Prepare evidence for the site walkthrough

Map each item of evidence to the information security controls it supports. Organise records by location and control owner in the ISMS.

Staff should be able to explain each process and retrieve records without relying on one compliance specialist.

The examples below link physical controls with implementation evidence.

Control area	Examples of evidence
Restricted access	Approved access lists, review records and revoked-badge records
Visitor management	Visitor logs, escort rules and contractor instructions
Security equipment	Alarm tests, maintenance reports and fault-resolution records
Confidential disposal	Collection records, destruction certificates and supplier reviews
Prototype handling	Photography approvals, transport instructions and handover records
Asset and media protection	Asset inventories, issue-and-return records and media storage records
Monitoring	Monitoring records, alarm-test results and follow-up actions
Incident response	Incident logs, investigation records and corrective actions

Select evidence examples according to the assessment scope and site risks. This is not a universal checklist or a guarantee of an assessment result.

The strongest evidence demonstrates consistent operation, including how faults and exceptions were resolved. Our TISAX assessment evidence checklist covers wider governance and operational records.

Common weaknesses include starting too late, assigning the programme entirely to IT, copying policies that don't match the site, and collecting evidence retrospectively. Weak supplier oversight can also leave gaps in guarding, maintenance, disposal and transport.

  A door-access system provides limited assurance if nobody reviews permissions or removes access when people leave.  

Use an internal walkthrough as a practical readiness check, rather than assuming every scope requires a formal internal audit. Follow the routes taken by employees, visitors, deliveries and contractors, then record weaknesses, owners and corrective actions.

Allow time for assessment and corrective actions

Preparation time depends on existing maturity, site numbers, objectives and available resources.

An on-site assessment can include document review, management interviews, technical inspection and physical walkthroughs. Prototype areas are examined where relevant to the scope.

Findings may require corrective actions and follow-up assessment. For minor non-conformities, temporary labels expire nine months after the initial assessment closing meeting and cannot be renewed.

The ENX TISAX overview states that labels are generally valid for three years. Maintain controls throughout that period and plan reassessment before expiry.

Separate ENX fees from assessment costs

The term certification costs is useful for budgeting, although TISAX provides assessment results and labels rather than an ISO-style certificate. Participation fees and assessment-provider charges are separate; the scheme calculates its fees by location, while providers price assessment work independently.

Budget separately for internal staff time, implementation support and physical improvements. Door controls, protected storage, alarm repairs or changes to loading arrangements may require procurement and installation time as well as funding.

Frequently asked questions

Can ISO 27001 certification replace a TISAX assessment?

No. ISO 27001 certification demonstrates an assessed ISMS within its certified scope. "TISAX certification" is a common expression, but the scheme provides assessment results and labels, not an ISO-style certificate. TISAX applies VDA ISA requirements and automotive assessment objectives, with results exchanged through ENX. Existing controls can support preparation, but they don't automatically establish a label.

Does every supplier need prototype protection?

No. The requirement depends on customer expectations, assessment objectives and the work performed. Receiving, developing, storing, testing or transporting prototype materials can create additional protection needs. Standard production activities don't automatically require the same controls.

Does installing CCTV satisfy physical security requirements?

No single measure establishes compliance. CCTV may support detection or investigation, but it doesn't replace access management, visitor supervision, secure storage or environmental protection. Its suitability depends on the site's risks and applicable requirements.

Build assurance around working site controls

TISAX preparation starts with a defined scope and controls that match actual operations. Assign ownership and maintain working evidence that shows how those controls support information security and protect customer information.

Keep the scope aligned with changes to sites, suppliers and prototype activities.

If you would like to find out more information or require any of our services please Contact Us and complete the contact form.