In the automotive industry, technical data, designs and information about prototypes are worth as much as the product itself. Vehicle manufacturers therefore expect their suppliers to demonstrate a documented level of information protection. The standard that organizes this expected confidentiality and makes it comparable across the entire supply chain is TISAX. Below we explain from a practical perspective what this certificate is, what requirements it places on partners, and why it is becoming harder to join the group of automotive suppliers without it.
TISAX Certificate - What Is It? Key Information
The TISAX® certificate (Trusted Information Security Assessment Exchange) is a mechanism for the assessment and mutual exchange of information security audit results in the automotive industry. The standard was developed by the German Association of the Automotive Industry (VDA), and the system is managed by the ENX Association, an independent organization that oversees the quality of assessments.
Before TISAX existed, every car manufacturer verified suppliers using its own questionnaires and procedures. This meant that a company working with several customers went through several separate, duplicated audits. The VDA (Verband der Automobilindustrie) put an end to this chaos by creating a uniform catalog of requirements, VDA-ISA, a common language in which the entire industry describes and assesses information security in automotive. Two complementary layers of the standard were built on this foundation.
➤ We also recommend the article: Electroplating in the Automotive Industry: 5 Amazing Applications
The VDA-ISA Catalog - The Foundation of Security Requirements
The VDA Information Security Assessment (ISA) is a catalog of information security requirements based on the recognized ISO/IEC 27001 standard, created and regularly updated by the VDA Information Security Committee. It defines the questions the audited company must answer. Since April 1, 2024, ISA version 6.0, announced by the VDA, has been in force. It extended the assessment with a new area, "availability," alongside the existing area of data confidentiality. The catalog is also a reference point for compliance with the EU NIS 2 Directive.
ENX Association - How Does the Exchange of TISAX Results Work?
While the VDA is responsible for the content of the requirements, the ENX Association acts as the operator of the entire system: it approves audit providers, monitors their quality and manages the platform for exchanging results between participants. The greatest benefit of this model is purely practical: the result of a single TISAX audit is valid for 3 years and recognized by all participants in the system. As a result, one audit is enough for many customers at once, with no need to repeat the same assessment at the request of each subsequent business partner.
TISAX Requirements - What Does the Audit Cover?
The requirements are not a uniform list. A TISAX audit is divided into Assessment Levels, selected according to the sensitivity of the data being processed, and into thematic areas checked at the company. It is this division that determines how deep the verification goes and how rigorously the OEM's (original equipment manufacturer's) requirements are enforced on the supplier.
TISAX Assessment Levels: AL1, AL2 and AL3
The system provides for three assessment levels, differing in the form of verification and intended use:
| Level | Form of assessment | Typical use |
| AL1 | Self-assessment | Low-sensitivity data, internal verification |
| AL2 | Remote / on-site audit by an independent, approved auditor | Standard required by most OEMs |
| AL3 | In-depth on-site audit, extended verification of evidence | Particularly sensitive data (defense secrets, classified information) |
In automotive projects, AL2 is in practice the default threshold: it gives the customer independent confirmation rather than just the supplier's declaration.
Assessment Areas - What Does the Auditor Check in Practice?
The ISA catalog covers several thematic blocks. During the audit, the following are verified, among others:
- security of IT systems and networks (access control, protection against malware),
- physical security of facilities and production areas,
- protection of personal data in accordance with applicable regulations,
- security management at the company's own suppliers and subcontractors,
- business continuity and incident response,
- protection of prototypes and design data entrusted by the customer.
This last point is key from the perspective of enforcing OEM requirements on the supplier: most manufacturers' expectations concentrate precisely on the protection of prototypes and design documentation.
TISAX in the Automotive Supply Chain - OEM, Tier 1 and Tier 2
TISAX does not operate in a vacuum: its strength comes from consistent application across the entire supply chain. Vehicle manufacturers such as BMW Group, Mercedes-Benz, Volkswagen Group or Stellantis require certification from their direct suppliers, that is, the Tier 1 level. These in turn pass this obligation on contractually to their own sub-suppliers at the Tier 2 level, ensuring consistent information protection at every link. In this way, Tier 1 and Tier 2 certification creates a closed chain of trust.
The consequences of not having a current certificate are severe and measurable in business terms. A company without a valid TISAX result may be excluded from requests for quotation already at the qualification stage, and in extreme cases it loses an ongoing partnership. For companies providing industrial cooperation for the automotive industry, the certificate has stopped being a differentiator and has become a condition for entering a tender.
What Does the Path to TISAX Certification Look Like, Step by Step?
The path to obtaining a TISAX audit result follows a fixed sequence:
- Registration of the company in the ENX portal and obtaining a unique Participant ID identifying the participant.
- Ordering the assessment from one of the approved audit providers; their current list is available in the ENX portal.
- Conducting the audit according to the ISA catalog; for level AL2, verification involving an auditor, including an on-site assessment, is mandatory.
- Publishing the results on the TISAX Exchange portal. Importantly, the results are not publicly available, and only designated partners have access to them.
- Sharing the Scope ID or Assessment ID with selected business partners, who can then verify the supplier's status.
It is worth planning the schedule realistically: from preparing the organization to closing the assessment, the entire cycle in larger facilities can take several months, especially when the audit covers multiple locations and processes.
Strumet with a TISAX Certificate - What Does It Mean for Your Project?
For an engineer or purchasing manager, having a supplier with a valid TISAX certificate translates into concrete, measurable benefits. Working with a partner that has passed the audit eliminates the need to carry out your own costly information security verification at that supplier. It also confirms that the supplier meets the information requirements set by OEMs, and genuinely shortens the qualification process in projects where TISAX is a mandatory condition.
Strumet holds a TISAX certificate. This matters wherever we are entrusted with design documentation or sensitive data, for example in the production of certified airbag containers or dedicated pallets for automotive parts, where the shape and specification of the packaging derive directly from the customer's design data.
If you are planning a project that requires a TISAX-compliant supplier, check the scope of our industrial cooperation for automotive and contact our team - we will help match the solution to your OEM's requirements.
FAQ - Most Frequently Asked Questions About the TISAX® Certificate
Is the TISAX certificate mandatory for all automotive suppliers?
Formally it is not a legal requirement but a contractual one. In practice, however, most OEMs and Tier 1 suppliers make cooperation conditional on holding a valid certificate, so for companies processing industry data it becomes a de facto condition of entry.
Does a Tier 2 supplier also have to hold a TISAX certificate?
Very often, yes. Tier 1 suppliers usually pass the certification requirement on contractually to their sub-suppliers in order to maintain a consistent level of information protection throughout the supply chain.
How long is a TISAX certificate valid and when does it need to be renewed?
A TISAX assessment result is valid for 3 years. To maintain continuity of status with business partners, it is worth starting the re-audit process well before this deadline.
How long does a TISAX audit take and what does the process look like?
The audit itself usually takes from one to several days, depending on the scope and the number of locations. The entire process, from preparing the organization through the assessment to the publication of results, can stretch over several months in larger companies.
How does TISAX differ from ISO 27001?
The ISA requirements catalog is based on the ISO/IEC 27001 standard but extends it with expectations specific to the automotive industry, including the protection of prototypes. The key difference is the mechanism of mutual recognition of results between participants, which the ISO standard itself does not provide.
