TISAX Supplier Security: A Practical Assurance Programme

Automotive industry suppliers are increasingly expected to show how they protect customer information, engineering data and prototypes. A proportionate TISAX programme combines recognised assessment results with risk-based supplier management.

For procurement and security teams, the challenge is choosing the right assurance for each relationship. Different services, locations and information types carry different information security and operational risks.

Start with the customer requirement, then build a repeatable process that connects assessment evidence with operational risk.

What TISAX demonstrates about supplier security

An automotive assessment and exchange scheme

The scheme's full name is Trusted Information Security Assessment Exchange. The German Association of the Automotive Industry developed it, and the ENX Association manages it.

Assessments use the VDA Information Security Assessment (VDA ISA) catalogue, a common information security assessment framework. Its controls draw on ISO 27001 principles and cover automotive information, operational dependencies and customer expectations.

The ENX TISAX scheme provides a standardised way to assess security and share results with authorised partners. This can reduce repeated customer assessments when their scope and objectives meet customer requirements. TISAX provides assessment results and labels, not conventional certification.

Customer requirements determine participation

TISAX isn't a general legal requirement. Some organisations use "TISAX compliance" as shorthand, but customer and contract needs determine whether suppliers need an assessment. OEMs and Tier 1 suppliers often make suitable results a contractual or procurement condition.

An engineering consultancy, logistics provider or managed IT service may need a label to secure particular work. The TISAX requirements, including objectives, locations and scope, vary by customer relationship.

Procurement should record the required objectives, locations and deadline. An existing label may support qualification, but it doesn't guarantee a contract award or cover activities outside its assessed scope.

Choose the right scope and assessment level

The scope should follow the service and its information flows. Include locations and supporting functions that store, administer, process or protect information covered by the customer requirement, including relevant data protection activities.

A shared service desk or outsourced hosting provider can affect security even when it doesn't perform automotive engineering.

The three assessment levels describe the depth of the assessment:

Level	Assessment approach	Assurance implication
AL1	Supplier self-assessment only	No independent verification or shareable TISAX label
AL2	Assessor plausibility checks, evidence review and interviews	Usually remote or partly virtual
AL3	Comprehensive assessment, including on-site examination by an ENX-approved provider	Detailed examination of implemented controls

The customer-requested objective and the supplier's activities determine the suitable assessment level, not supplier size.

The VDA ISA has a separate maturity scale from 0 to 5. These are maturity ratings, not six levels of assessment. A maturity score of 3 isn't the same as AL3.

Prototype Protection is a distinct assessment objective. Handling prototype parts or vehicles may require AL3, depending on current scheme rules and the customer's request. Suppliers handling highly sensitive OEM information should check the applicable objective and assurance requirements rather than assume AL2 is sufficient.

Controls must match the work. CAD-file access requires restrictions on accounts, sharing and storage. Prototype vehicle transport may require protected loading, controlled photography, secure parking and disposal arrangements, depending on the agreed requirements.

The TISAX Participant Handbook defines the authoritative scope, objective and assessment rules.

Build repeatable TISAX supplier security reviews

Classify suppliers before requesting evidence

A proportionate process starts with the relationship, not a standard questionnaire sent to all suppliers. Assess information sensitivity, system access, prototype exposure and the operational effect of service failure.

Suppliers with privileged access to OEMs' engineering systems need closer scrutiny than providers of goods without confidential information or network access. Production dependencies also matter: an outage can be material without a data breach.

Procurement should collect the service description and contractual requirements. Information security should set proportionate evidence requirements, and the business owner should accept residual risk.

Record these decisions in a supplier register so the same reasoning applies during onboarding, renewal and service changes.

Review coverage rather than collecting logos

Request evidence that matches the supplier's risk category. Where TISAX is required, check the participant identity, assessed scope, relevant locations and validity. Verify shared results through the ENX portal.

Where a label isn't required, proportionate evidence may include ISO 27001 certification, contractual controls and targeted evidence of implementation. Our guidance on ISO certifications for supplier assessments explains how certification supports due diligence.

Document any coverage gaps and decide whether to accept, remediate or restrict them.

  A valid label for one assessed location doesn't automatically cover another site delivering the service.  

Complete the registration-to-label process

TISAX preparation should produce working information security controls and evidence, not policies alone. The security lead should coordinate a consistent sequence:

1. The customer defines the required objectives and scope. The supplier's security lead registers the participant and assessment scope with ENX.

2. The ISMS owner maps existing controls to VDA ISA and completes the self-assessment with implementation descriptions and supporting records.

3. The security lead appoints an ENX-approved assessment provider and coordinates the required assessment, including interviews and site examination where applicable.

4. The corrective-action owner addresses findings and completes follow-up assessments. Management approves result-sharing with the relevant customers.

ISA covers information classification, incident response, access control, physical protection and supplier management. Prototype protection and data protection requirements depend on the selected objectives. Address continuity and connected-production risks where they apply to the assessed operations.

Test implementation before the external assessment. Useful samples include a recent leaver's access removal, a supplier review, a backup restoration and a prototype visitor record. An internal audit can check these controls before the assessment.

Findings can include minor non-conformities that require a corrective-action plan, or major non-conformities that require remediation and follow-up. The corrective-action owner should track non-conformities through closure. Blackmores describes a two-week action-plan turnaround followed by several months of corrections, so build time for findings into the project schedule.

The formal outcome is an assessment result recorded as a TISAX label, rather than a conventional certificate. Labels are normally valid for three years.

Authorised partners can check shared results through the ENX portal. The ENX explanation of objectives and labels clarifies how requested objectives relate to the resulting labels.

Manage sub-suppliers and ongoing obligations

Translate requirements into contracts

A supplier remains responsible for managing information security risks introduced by outsourced activities. Requirements should reach subcontractors that handle protected information, provide system administration or move prototypes.

Contracts should define data protection requirements, permitted processing locations, access restrictions, confidentiality, incident notification, subcontracting approval and information return or deletion. Prototype work may also need transport, photography and secure-area requirements.

Flow down controls required by the outsourced service and customer agreement to relevant suppliers. Don't automatically demand the same label from every subcontractor.

Where a sub-supplier doesn't hold a required label, record the gap and any agreed restrictions. Procurement shouldn't waive a customer obligation through an undocumented exception.

Maintain assurance between assessments

A three-year TISAX label validity period doesn't remove the need for ongoing supplier oversight. Set review frequency according to risk, with additional reviews after incidents or material changes.

Relevant triggers include new locations, acquisitions, new subcontractors, expanded system access and changes to prototype handling. These can affect whether the existing scope remains suitable.

Track overdue corrective actions, unresolved scope gaps and approaching label expiry. Assign each issue a named owner and business decision.

Security teams should assess the issue, while procurement manages contractual consequences. Business owners should decide whether use can continue when residual risk exceeds the agreed threshold.

Budget for preparation and assessment maintenance

A realistic budget separates scheme participation, external assessment, internal implementation and specialist support.

Check ENX's current published charging information before budgeting. Its 2026 assessment-based fees list €405 per location per assessment scope.

Internal costs can be substantial. Allow for access improvements, physical protection, evidence gathering, staff training and supplier remediation. Our TISAX implementation packages provide defined options for preparation support.

Allow time for controls to operate

Blackmores estimates nine to twelve months for organisations starting from scratch, or six to eight months where ISO 27001 is already established. Treat these as planning estimates.

An established information security management system (ISMS) can reduce duplicated work. It doesn't guarantee readiness or close site-control and supplier-management gaps. Policies need operating records before an assessor can evaluate implementation.

Plan beyond the audit date

Set milestones for scope agreement, gap closure, internal audit, external assessment and corrective actions. Work backwards from the customer's required label date.

Our automotive logistics case study describes a twelve-month programme that achieved AL3 labels across two UK locations. It illustrates a complete implementation programme rather than a universal timetable.

Key takeaways for supplier assurance teams

• Set a risk-based scope around customer requirements, information sensitivity and service dependencies.

• Check each TISAX label against location coverage, validity, contractual obligations and implementation evidence.

• Name owners for suppliers, corrective actions and reviews triggered by change.

A repeatable programme gives procurement clear decisions and security teams usable evidence.

Frequently asked questions

Does ISO 27001 certification replace TISAX?

No. ISO 27001 certification can support preparation, but it doesn't replace an assessment, ENX registration or label. The term "TISAX certification" is informal; the scheme's formal outcome is an assessment label.

An existing information security management system (ISMS) can provide supporting controls. It doesn't establish the required objectives, complete ENX registration or create a label.

Our guidance on TISAX requirements beyond ISO 27001 explains the additional automotive evidence expectations.

Does every supplier need Prototype Protection?

No. The requirement depends on the work performed, the protected information and the customer-requested objectives.

Organisations receiving, storing, testing, photographing, transporting or disposing of prototypes need controls that match those activities. Suppliers handling standard production information may not need that objective.

A selected data protection objective doesn't establish compliance with every GDPR obligation. Applicable legal duties remain separate from the assessment outcome.

Build assurance around the actual supplier relationship

Effective TISAX supplier security combines appropriate assessment results with clear ownership and ongoing oversight. A proportionate TISAX programme connects customer obligations, supplier risk, scope coverage and corrective actions.

We help organisations turn these requirements into practical preparation and governance for suppliers.

If you would like to find out more information or require any of our services please Contact Us. Complete our contact form with your requirements.