Coral EsecureNew Jersey, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
TISAX
TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's shared assessment and exchange mechanism for supplier information security, run by the ENX Association on behalf of the German Association of the Automotive Industry (VDA).
Suppliers are assessed against the VDA Information Security Assessment (ISA) catalog; ISA version 6 has applied to assessments commissioned since April 1, 2024. Results are not published as certificates but as labels on the ENX portal that the supplier shares with the OEMs and partners that require them.
Labels currently cover confidentiality (Confidential, Strictly Confidential), availability (High Availability, Very High Availability), prototype protection and data protection objectives.
The assessment level depends on the protection need: AL1 is a self-assessment, AL2 is a remote plausibility check of the self-assessment by an audit provider, and AL3 is an on-site assessment with interviews and inspection.
To pass, the supplier must reach maturity level 3 across the requirements, meaning the ISMS is documented and demonstrably operated: an information security policy set, risk management, asset classification, access control, supplier security, incident management, business continuity, and for prototype and data protection objectives, the corresponding specialized policies.
Labels are valid for three years.
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedISA policy set v2by name, on record
Assessment Level Readywith AllyMatter
Label It the Modern WayEvery ISA policy, acknowledged before the assessment
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every name on record
Who read which version, and when
03
Hand the audit provider the trail
From $29/mo, 20 editors, unlimited staff (published)
Who has to comply
Contractual. Suppliers, service providers and development partners whose automotive customers (mainly German OEMs and tier-one suppliers, increasingly others worldwide) require TISAX labels before sharing information with a high protection need. The customer specifies the assessment objectives and level.
What the assessor asks to see
ENX participant and scope registration; completed ISA self-assessment with maturity ratings; information security policy and ISMS documentation; risk assessment and treatment; asset inventory and classification; access control and identity management records; supplier and partner security agreements; incident management records; business continuity and backup evidence; for prototype protection, physical security and handling procedures; for data protection, GDPR processing documentation; on-site inspection at AL3.
Where the requirement sits: VDA ISA controls (information security, prototype protection, data protection) at maturity levels 0-5
Assessment levels and labels
AL1: self-assessment only, no label of practical value to most customers. AL2: audit provider reviews the self-assessment and evidence remotely. AL3: full on-site assessment.
With ISA 6 the former Info High and Info Very High labels were split into confidentiality labels (Confidential, Strictly Confidential) and availability labels (High Availability, Very High Availability); holders of the old labels were assigned the new confidentiality labels automatically. Prototype protection and data protection objectives carry their own labels.
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps, including the ones TISAX turns on. Build the whole library in one place, across every department, and prove who has read what.
Start here
Written Information Security Plan: who needs it, what goes in it, how often it is reviewed and who signs it off. Run exactly that in AllyMatter, alongside every other policy your company keeps.
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
The written policies this standard turns on live here, with every version and every acknowledgment on the record.
Who helps with TISAX
Yes. Information security consultancies, especially in Germany and Central Europe, offer ISA gap assessments, ISMS documentation, self-assessment preparation and audit accompaniment. Engagements typically run three to nine months before the audit.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
IllumenSeattle, Washington
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Neutral PartnersOrlando, Florida
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Atlant SecurityUSA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
VISTA InfoSecMumbai, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
IsecurionBengaluru, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, HIPAA, PCI DSS and more.
- Standards
- Pricing
- Not published
Blackmores (UK) LtdHitchin, Hertfordshire, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 9001, GDPR, ISO 14001, ISO 45001 and more.
- Standards
- Pricing
- Not published
Streamline ISO ConsultantsBrisbane, QLD, Australia
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, SOC 2, ISO 9001, ISO 14001, ISO 45001 and more.
- Standards
- Pricing
- Not published
My ISO ConsultantsCrestline, CA, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, SOC 2, ISO 9001, HIPAA, CMMC and more.
- Standards
- Pricing
- Not published
BHP International L.l.c-fzDubai, United Arab Emirates
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, ISO 9001, PCI DSS and more.
- Standards
- Pricing
- Not published
Eagle GroupTroy, Michigan, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, ISO 9001, CMMC, NIST 800-171 and more.
- Standards
- Pricing
- Not published
GQSSingapore
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, ISO 9001, HIPAA and more.
- Standards
- Pricing
- Not published
Quality Systems Enhancement (QSE), Inc.Roswell, Georgia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, ISO 9001, CMMC, ISO 14001 and more.
- Standards
- Pricing
- Not published
Quantras ConsultingBarcelona, Spain
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, ISO 9001, PCI DSS, ISO 14001 and more.
- Standards
- Pricing
- Not published
Veave Technologies Pvt. Ltd.Bangalore, Karnataka, India
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, ISO 9001, HIPAA and more.
- Standards
- Pricing
- Not published
BH ConsultingDublin 15, Ireland
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, PCI DSS, GDPR, NIST CSF, ISO 42001 and more.
- Standards
- Pricing
- Not published
AKRUPLondon, UK
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 9001, CMMC, GDPR, ISO 42001.
- Standards
- Pricing
- Not published
Radian Compliance, LlcPark Ridge, Illinois, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for TISAX, ISO 27001, SOC 2, ISO 9001, HIPAA and more.
- Standards
- Pricing
- Not published
Who assesses TISAX
An ENX-approved TISAX audit provider (approval decided by the TISAX Committee) using auditors qualified for the ISA. Only approved providers can perform AL2 and AL3 assessments that produce labels.
Accredited by ENX Association approves audit providers and monitors their quality; there is no national accreditation body in the chain, although many providers are also accredited certification bodies for ISO 27001.
Public register of assessors: portal.enx.com ↗
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
BSI Group Deutschland GmbHOn the public register
- What they do
- Assessor
- Which standards
- On the public register for TISAX.
- Standards
- Pricing
- Not published
Bureau Veritas ServicesOn the public register
- What they do
- Assessor
- Which standards
- On the public register for TISAX.
- Standards
- Pricing
- Not published
DEKRA Certification GmbHOn the public register
- What they do
- Assessor
- Which standards
- On the public register for TISAX.
- Standards
- Pricing
- Not published
DNV Business Assurance Zertifizierung GmbHOn the public register
- What they do
- Assessor
- Which standards
- On the public register for TISAX.
- Standards
- Pricing
- Not published
DQS GmbHOn the public register
- What they do
- Assessor
- Which standards
- On the public register for TISAX.
- Standards
- Pricing
- Not published
Tools for TISAX
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteGRC and compliance automation8 tools
Controls, evidence and audit workflows, with a policy module inside.
Strike GraphAI-native GRC and compliance automation platformPrice publishedCoplaCompliance automation platform with a CISO advisory teamNot publishedSecfixGermanyCompliance automation platformNot publishedISOvALondon, United KingdomISO management-system and legal compliance softwarePrice publishedDataGuardMunich, GermanySecurity and compliance platformQuote onlyKertosMunich, GermanyCompliance automation platformQuote onlyInstant 27001NetherlandsPre-built ISO 27001 ISMS content pack with companion apps, for Confluence, Notion and Microsoft 365Price publishedKopexaKiel, GermanyGRC and ISMS compliance platformPrice published
Policy management tools1 tool
Approve, distribute and acknowledge written policies.
Third-party risk and trust centers1 tool
Vendor assessments, security ratings, questionnaires and trust pages.
Related reading
- Transition to TISAX VDA ISA version 6An assessment body explains the ISA 6 label rename, the new availability label and how existing labels carry over.DNV
- What is TISAX? The complete guide to automotive information security assessmentsWalks through assessment levels, the ENX exchange model and what an auditor tests at each level.NRI Secure
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for TISAX
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of TISAX in AllyMatter
Approve the policies TISAX asks for, keep every version, and record a named acknowledgment from each person who has to read them.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff