TISAX Assessment Readiness — Automotive Information Security (VDA ISA)
TISAX is the information security assessment that European carmakers — especially German OEMs — require from suppliers handling their prototypes, designs or data. Results are shared through the ENX platform, so one assessment can satisfy many customers.
With manufacturing taking the largest share of European ransomware claims, OEMs are tightening supplier requirements. Mutex Systems helps suppliers scope the right assessment level, close gaps against the VDA ISA and pass first time.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- ENX Association (based on the VDA ISA catalogue)
- Current Version
- VDA Information Security Assessment (ISA) catalogue, current version 6
- Who It's For
- Automotive suppliers, engineering and design firms, and IT providers working with European OEMs.
Core Domains
A Practical Compliance Path
- 01
Scope
Identify required assessment objectives and level from your OEM contracts.
- 02
Self-assessment
Complete the VDA ISA and rate maturity per control.
- 03
Remediate
Close gaps, often reusing ISO 27001 controls.
- 04
Assessment
Support during the audit by an ENX-accredited provider.
Reuse ISO 27001, close the automotive gaps
TISAX overlaps heavily with ISO 27001; we focus effort on the automotive-specific requirements such as prototype protection.
- VDA ISA self-assessment support
- Prototype protection controls
- ISO 27001 reuse
TISAX evidence mapped to ISO 27001
grComply maps VDA ISA requirements to ISO 27001 so shared evidence is collected once, and tracks maturity ratings per control.
- VDA ISA requirements as controls
- Maturity ratings per control
- Cross-mapping to ISO 27001
- Evidence for assessor review
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About TISAX
What is TISAX?
An assessment and exchange mechanism for information security in the automotive industry, based on the VDA ISA catalogue and run through the ENX Association.
Is TISAX a certification?
Not formally. It results in a TISAX label shared with OEMs through the ENX platform, valid for three years.
What are TISAX assessment levels?
AL1 is a self-assessment, AL2 is a plausibility check by an auditor, and AL3 is a thorough on-site assessment, used for higher protection needs such as prototypes.
Ready to Start Your TISAX Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.