Prepare for your TISAX assessment
What is TISAX?
TISAX — the Trusted Information Security Assessment Exchange — is how the automotive industry assesses and shares information security maturity across its supply chain. It is governed by the ENX Association and built on the VDA ISA (Information Security Assessment) catalogue created by the German automotive industry association. Rather than each OEM auditing each supplier, suppliers undergo a single assessment by an accredited audit provider and exchange the results with partners on the ENX portal.
Labels and assessment levels
A TISAX assessment is scoped by labels — information security, prototype protection (for organizations handling pre-series parts and vehicles), and data protection (aligned with GDPR) — and by assessment level (AL1, AL2, or AL3), which determines how rigorous the audit is. The OEM or customer requesting the assessment specifies the labels and level required. A successful assessment yields labels that are typically valid for three years.
How TISAX relates to ISO 27001
The VDA ISA catalogue is closely aligned with ISO/IEC 27001, so an organization with a mature ISMS already meets a large share of TISAX requirements. The main differences are the automotive-specific prototype-protection controls and the maturity-based scoring model.
How episki helps
episki implements the VDA ISA catalogue as living controls with maturity scoring, helps you scope the right level and labels, and cross-maps the catalogue to your ISO 27001 program — so preparing for a TISAX assessment reuses the security work you already do and produces a clean evidence package for your audit provider.
TISAX outcomes with episki
Why teams choose episki for TISAX
- Information security control catalogue
- Prototype protection where in scope
- Data protection module aligned to GDPR
- Assessment levels AL1, AL2, and AL3
- Information security, prototype, and data protection labels
- Maturity-based scoring per control
- Crosswalk to ISO 27001 Annex A
- Evidence shared with SOC 2 and NIST CSF
- One control set, multiple audiences
TISAX readiness inside episki
Plug episki into your stack and work directly from this checklist during the free trial.
- ✓ Scope and assessment-level determination
- ✓ VDA ISA information-security controls implemented
- ✓ Prototype protection controls (if in scope)
- ✓ Data protection module (if in scope)
- ✓ Maturity-level evidence per control
- ✓ Audit-provider evidence package and ENX exchange
