TISAX ISA v6

Why does it matter?

TISAX replaces separate customer audits with one assessment that automotive manufacturers and suppliers accept from each other. A supplier that handles a manufacturer's design data, prototypes or personal data is typically asked for a TISAX label, and the label is requested by assessment objective, such as Confidential or Strictly confidential. A company without the right label can be unable to renew an existing supply relationship or win a new one, so the assessment sets the timeline for onboarding.

Key benefits include:

• Assess once, share with many

One assessment can be shared with any number of TISAX participants through the ENX portal, which reduces repeated customer audits.

• Depth that matches the data

Assessment levels AL 2 and AL 3 set how closely the audit provider verifies the self-assessment, based on the protection needs of the information handled.

• A shared maturity scale

Every control is rated on maturity levels 0 to 5, and the ISA sets a target maturity level of 3 for each question.

• Control over disclosure

The assessed company chooses whether and how far to share the report, from assessment-related information with labels up to the assessment summary.

• A published path to the next catalog

ISA2027 and the annual release cycle are announced in advance, so scopes and plans can be timed against the March 2027 cutoff for ISA 6.

How does it work?

Register the company as a TISAX participant and register at least one assessment scope with its locations, scope type and assessment objectives. ENX then sends the registry excerpt and a list of audit providers, and the participant requests bids and orders the assessment. The scope decides which part of the company must meet the partner's requirement, so it should cover every location that handles the partner's information.

The assessment starts with a self-assessment on the ISA catalog and is followed by the audit provider's check. At AL 2 the provider performs a plausibility check of the self-assessment, with evidence and an interview. At AL 3 the provider verifies everything, including on-site activities. Minor non-conformities lead to temporary labels, which expire nine months after the closing meeting of the initial assessment and cannot be renewed; a follow-up assessment confirms the corrective actions.

The audit provider uploads the first two sections of the TISAX report to the ENX portal, where only the assessed participant can see them. The participant then shares the result with chosen participants through their participant IDs, or publishes it to all participants at a selected sharing level. The result is valid for three years.

Key Elements

• Information Security tab

Seven chapters: IS policies and organization, human resources, physical security, identity and access management, IT and cyber security, supplier relationships, and compliance.

• Prototype Protection tab

Controls 8.1 to 8.5 for protecting prototype parts, prototype vehicles, test vehicles and prototypes at events.

• Data Protection tab

Controls 9.1 to 9.8, answered yes or no, for processing on behalf of a customer under Article 28 of the GDPR.

• Maturity levels

Incomplete (0), Performed (1), Managed (2), Established (3), Predictable (4) and Optimizing (5), with a target of 3 per question.

• Protection needs

Normal, high and very high. Controls are written as must and should requirements, with additional requirements when protection needs are high or very high.

• Assessment objectives and labels

Ten current objectives: Confidential, Strictly confidential, High availability, Very high availability, Proto parts, Proto vehicles, Test vehicles, Proto events, Data and Special data.

• Assessment levels

AL 2 for Confidential, High availability, Test vehicles, Proto events and Data; AL 3 for Strictly confidential, Very high availability, Proto parts, Proto vehicles and Special data.

What does it cover?

TISAX applies to companies in the automotive supply chain that handle information of business partners: manufacturers, suppliers, service providers, software developers and engineering partners. Participation is requested by a partner rather than imposed by a regulator. The assessment scope names the locations, processes and assessment objectives covered, and an assessment result satisfies a partner only if the scope covers every part of the company that handles that partner's information. ISA 6 also added operational technology to the scope of IT systems.

What are its objectives?

TISAX and the ISA exist to give the industry a common way to demonstrate information security.

Provide a common security baseline for the automotive supply chain.

Apply consistent assessment criteria, so that results are comparable across audit providers.

Use a harmonized approach across the supply chain, with requirements cascading to suppliers.

Reduce audit effort through mutual recognition of assessment results.

Let an organization demonstrate information security once and share the result with multiple business partners.

Framework in Context

The early ISA versions were closely based on ISO/IEC 27001, and ENX describes ISA 5 and later as an independent industry standard that stays aligned with it. ISA 6 added references to ISO/IEC 27001:2022, ISA/IEC 62443-2 and the NIST Cybersecurity Framework, new controls for software approval, managing security events, handling crisis situations, IT service continuity planning and backup and recovery, and removed compatibility with ISA 4. The ISA is licensed under Creative Commons Attribution-NoDerivatives 4.0 with special terms for derivatives, and the participant handbook (version 2.8) describes the process. TISAX results are assessment labels in a report, not certificates.

Common Framework Mappings

Organizations map the ISA controls to the frameworks below so that the same evidence serves the audit provider, customers and other assessments.

Mapped frameworks include:

CIS Controls v8.1

ISO 27001:2022

ISO 27002:2022

ISO 27701

ISO/SAE 21434

NIST CSF 2.0

NIST 800-53 Rev.5

UNECE R155