TISAX Prototype Protection for Development Teams

TISAX prototype protection requires automotive development teams to safeguard confidential parts, vehicles and related information throughout their work. Effective TISAX preparation combines operating controls with evidence that those controls work at the locations being assessed.

A secure workshop alone isn't enough if photographs, transport arrangements or outsourced testing expose the same prototype. Start by defining what needs protection, then use prototype management to track it from receipt through development, testing and final disposition.

Key Takeaways

• TISAX prototype protection covers customer-classified parts, vehicles, activities and related information within the defined assessment scope.

• Controls need to protect assets and information during storage, engineering work, transport, testing and final return or disposal. Keep records that show who held each asset and what happened to it.

• ISA2027 applies to assessments ordered from 1 January 2027. The audit order date determines which catalogue applies.

• Assessment levels determine the depth of assurance. Prototype protection for parts and vehicles commonly requires AL3, and a TISAX label depends on the assessment result and its defined scope.

What TISAX prototype protection covers

Under TISAX, customer classifications and OEMs' requirements determine which customer-supplied prototype parts and components, vehicles and activities need protection. The work performed defines the relevant TISAX scope for Prototype Protection.

Identify protected assets and activities

Protected assets can pass through engineering, manufacturing, logistics and external testing before returning to the customer. Each handover creates a responsibility that needs clear ownership.

Record the customer's classification, handling restrictions and authorised recipients when an asset arrives. Include restrictions on photography, disclosure and movement between locations.

The VDA's information security guidance places these requirements within the wider Information Security Assessment (ISA) framework.

Define the actual operating scope

The operating scope should reflect where protected assets and information are handled. Include workshops, storage areas, test facilities and relevant supporting services.

A team handling CAD files has different exposure from a logistics operation transporting covered vehicles. Both need appropriate information security, but their physical protection requirements differ.

Document external dependencies, including carriers, test laboratories and contractors. Assessment coverage must account for relevant activities without assuming every office needs identical controls.

Secure storage, access and engineering work

Protect secure areas and physical assets

Use designated areas with access limited to authorised personnel. Protection should address visibility as well as entry: an access-controlled workshop can still expose prototypes through windows or open loading doors.

Define visitor approval, escorting and photography arrangements. Staff should know how to challenge an unfamiliar person and report a suspected disclosure.

Retain access approvals, visitor records and evidence of periodic access reviews. Where alarms or surveillance form part of the protection arrangements, assign responsibility for testing and responding to alerts.

Apply equivalent discipline to engineering information

CAD models, build photographs, diagnostic exports and test results can disclose the same protected features as the physical asset. Apply the applicable TISAX cybersecurity controls for need-to-know access, approved storage and controlled sharing.

Review access when engineers change projects or leave. Temporary access for contractors should expire when the authorised work ends.

Our guidance on TISAX requirements beyond ISO 27001 explains why an established management system still needs automotive-specific implementation evidence.

The development team should also control approved photography devices and the transfer of images into project repositories.

Protect prototypes during transport and testing

Maintain control during handovers

Transport procedures should apply relevant TISAX protection requirements at each handover. They should define who authorises dispatch, which carrier may handle the asset and who accepts delivery. Record the asset identifier, destination, responsible parties and handover times.

Choose packaging, covers and loading arrangements that match the customer's confidentiality requirements. Consider exposure during loading, vehicle breakdowns, overnight stops and temporary storage.

Communicate relevant restrictions across the supply chain, including to carriers, laboratories and contractors doing the work. Instructions need to reach the people performing the work, rather than remaining in a procurement file.

Plan road tests and external demonstrations

Road tests with customer-supplied vehicles need handling arrangements suited to public exposure. Plan routes, parking, driver authorisation, photography restrictions and incident escalation.

Camouflage or vehicle covers should follow customer instructions. They don't replace decisions about where a vehicle may stop or who can access it.

For demonstrations and events, define access boundaries, permitted recording and secure overnight storage. Retain the approved test or event plan and records of exceptions. These show how protection was maintained away from the development site.

ISA2027: dates and lifecycle changes

Understand which catalogue applies

VDA published ISA2027 on 1 July 2026. It becomes the assessment basis for TISAX assessments ordered from 1 January 2027. The order date, not the assessor's visit date, determines the catalogue.

As of October 2026, assessments ordered during 2026 use VDA ISA 6.0.3. This is the applicable catalogue for TISAX assessments placed in that year. ENX's ISA catalogue guidance explains the move to year-based editions.

Future catalogues are planned annually. Annual publication doesn't create an annual reassessment requirement, and existing labels retain their stated validity.

Strengthen traceability through final disposition

ISA2027 reorganises Prototype Protection from five control groups into two domains: Organisational Requirements and Physical and Environmental Security.

The ENX ISA2027 announcement describes the substantial revision. It puts more emphasis on traceability, lifecycle tracking, and the disposal, recycling or return of protected prototypes, parts and tools.

Good prototype management links each asset to its custodian, location and lifecycle status. Record transfers, temporary loans and final disposition.

For scrapped parts or tools, retain authorisation and evidence that the agreed treatment took place. Prevent recognisable components from entering an uncontrolled waste or resale route. Keep the record open until there is evidence of the asset's final treatment.

Prepare evidence that reflects daily operations

An assessor needs evidence of implementation, not just a procedure describing intended behaviour. Select records that demonstrate normal operations and explain any exceptions.

The following examples connect practical controls with evidence.

Control area	Useful evidence
Restricted prototype areas	Access permissions, visitor records and access-review results
Asset traceability	Register entries, movement histories and named custodians
Transport and testing	Approved plans, carrier instructions and handover records
Photography restrictions	Staff instructions, authorisations and controlled image storage
Return or disposal	Customer approval, transfer receipts or destruction records

These records support TISAX assessment preparation. They don't guarantee a successful result or replace the applicable ISA2027 requirements.

  An asset register showing only today's location cannot demonstrate who held a prototype during an earlier test or transfer.  

Run an internal audit of the ISMS using recent operational samples to check how information security controls work in practice. Trace a protected component through receipt, engineering use, external movement and final disposition where available.

Existing management-system records aligned with ISO/IEC 27001 can support preparation, but don't prove implementation on their own.

Record gaps, assign owners and test the corrective action. A revised policy doesn't prove that a failed handover process now works.

Select the appropriate assessment level

TISAX assessment levels describe the depth of assurance, not an organisation's size or a general security ranking. Check the applicable ISA2027 catalogue for current requirements.

• AL1 is a self-assessment without independent verification.

• AL2 involves an independent plausibility check, supported by evidence review and interviews.

• AL3 involves a detailed on-site assessment, including face-to-face interviews and examination of implementation.

High-protection information is associated with AL2; very-high-protection information requires AL3. Prototype protection for parts and vehicles commonly requires AL3, so site-level readiness matters.

Engineers, facilities staff, security personnel and logistics teams should be able to explain their responsibilities. Their answers should match the documented process and available records.

Don't confuse an assessment level with an ISA maturity score. Maturity concerns how consistently controls operate. The assessment level determines how the assessor examines them.

The selected level shapes the TISAX assessment route, but it doesn't guarantee a TISAX label. AL1 alone doesn't provide the independent assessment needed for a TISAX label.

Follow the registration and assessment route

Register the organisation and scope

Register the organisation through the ENX Portal, which is managed by the ENX Association. Accept the TISAX Participation General Terms and Conditions and manage the Participant ID and Scope ID there.

Use the ENX Portal to set relevant locations and assessment objectives, then appoint an ENX-approved assessment provider. Complete the applicable ISA2027 self-assessment with implementation descriptions and references to supporting evidence.

Our TISAX readiness reviews and training support scope definition, evidence preparation and identification of implementation gaps before the external assessment.

Address findings and control result-sharing

The provider reviews the self-assessment and examines information security across the defined scope using the applicable assurance route. Non-conformities can require a corrective action plan and follow-up examination before a final result is available.

Where a temporary label is issued, it expires nine months after the initial assessment's closing meeting. Remediation needs clear ownership and timely evidence.

The formal outcome is an assessment result, shared through a TISAX label. "TISAX certification" is common shorthand, but it isn't an ISO-style certificate.

According to the ENX overview, labels are valid for three years. Participants use the ENX Portal to control which authorised partners can access their results.

Use ISO 27001 as a foundation

TISAX builds on ISO/IEC 27001 principles through the VDA ISA catalogue. An established information security management system (ISMS) can provide governance, risk assessment, incident management and internal audit processes.

ISA2027 updates mappings to ISO/IEC 27001:2022 and NIST Cybersecurity Framework 2.0. These mappings support alignment, but an ISO/IEC 27001 certificate doesn't produce a TISAX label.

Data Protection is a separate assessment module. Development programmes involving personal data need appropriate privacy arrangements alongside prototype confidentiality, with applicable GDPR obligations addressed separately.

For UK organisations acting as processors, the ICO's processor-contract guidance explains relevant Article 28 contractual requirements under the UK GDPR.

Keep these responsibilities connected within the ISMS while retaining the evidence needed for each applicable assessment objective. Prototype confidentiality doesn't demonstrate that data protection obligations have been addressed.

Frequently Asked Questions

What does TISAX prototype protection cover?

It covers customer-supplied prototype parts, components, vehicles and activities identified by customer classifications and OEM requirements. The scope should include the locations and external services that handle the assets or related information.

What evidence should development teams prepare?

Useful evidence includes access permissions, visitor records, asset movement histories, carrier instructions, handover records and return or disposal records. These records should reflect normal operations and show how exceptions were handled.

When does ISA2027 apply to a TISAX assessment?

ISA2027 is the assessment basis for TISAX assessments ordered from 1 January 2027. The order date determines the applicable catalogue, not the assessor's visit date.

Does ISO/IEC 27001 certification provide a TISAX label?

No. An ISO/IEC 27001 management system can support TISAX preparation, but it doesn't prove implementation against the applicable ISA requirements or produce a TISAX label. The label follows the TISAX assessment result and applies within its assessed scope.

Build protection that remains effective after assessment

TISAX protection arrangements depend on consistent control of assets, information and handovers. A TISAX label provides assurance within its assessed scope; maintaining protection remains an ongoing operational responsibility.

For ISA2027 preparation, prioritise traceability gaps and evidence of final disposition. Use internal audit results to establish whether the revised arrangements work.

If you would like to find out more information or require any of our services, please Contact Us and complete our contact form.