TISAX

Nothing changed in the last 90 days. Sign in to read further back.

1. 2027-01-01 in 53 days ISA2027 applies to all TISAX assessments ordered from this date; the final month to open an initial assessment under ISA 6 is March 2027
2. 2026-10-01 ISA2027.1 is released: a German version and a purely editorial update of the English ISA2027, with the substantive requirements unchanged
3. 2026-07-01 The VDA publishes VDA ISA2027, the next catalogue, with an annual release cycle from now on
4. 2024-04-01 ISA 6 becomes effective for TISAX assessments ordered from this date
5. 2016-06-28 The first TISAX participants register

1. 2023-10-16
   ISA 6 Major versionCurrent

   Major revision of the ISA catalogue, effective for TISAX assessments ordered from 1 April 2024. source

   More

   • More focus on IT and OT availability of production suppliers.
   • English became the leading language.
   • The data protection catalogue was completely revised.
   • New references to ISO/IEC 27001:2022 and NIST Cybersecurity Framework 1.1.
2. —
   ISA 2.1 Major version

   The catalogue version TISAX started with in 2016, then heavily based on ISO/IEC 27001. source

Companies in the automotive supply chain that handle partners' sensitive information, when a partner requires a TISAX label.

Who takes part

Companies use the ISA internally and for assessments of suppliers and service providers that are part of the automotive supply chain. source

What it protects

Design data, production information, customer information, prototypes and intellectual property. source

Why it is required

Some participants made it a mandatory requirement for many of their suppliers to prove that their ISMS meets a defined set of requirements. source

Which label

The partner names the TISAX label it requires, and the supplier selects the matching assessment objective. source

Contracts

A participant usually signs two contracts: the TISAX Participant General Terms and Conditions with ENX Association, and a contract with an audit provider. source

Catalogue in use

ISA 6 is the current version, effective for TISAX assessments ordered from 1 April 2024. Assessments ordered in 2027 use ISA2027; the final date to open an initial assessment under ISA 6 is March 2027. source source

Next catalogue

ISA2027 strengthens supplier and supply chain requirements: for very high protection needs, suppliers must show a TISAX label, an equivalent third-party assessment or a supplier audit. Prototype protection was consolidated from five control groups into two domains, with new requirements on traceability and on disposal or return of protected parts. Mappings were updated to NIST CSF 2.0, ISO/IEC 27001:2022 and ISA/IEC 62443, and references to ISO/IEC 27001:2013 were removed. source

A self-assessment against the ISA, then an assessment by an ENX-approved audit provider. The resulting TISAX labels are valid for up to three years.

Process

Registration of the participant and its assessment scope, choice of an audit provider, the assessment, then exchange of the results with partners. source

Assessment

Starts with a self-assessment based on the ISA, followed by an external audit that ranges from document reviews to on-site inspections depending on protection needs. source

Audit providers

ENX Association approves audit providers and monitors the quality of implementation and the assessment results. source

Assessment levels

Higher assessment levels include lower ones: an assessment at level 3 fulfils all requests for level 2. source

Validity

TISAX labels are valid for at most three years, counted from the closing meeting of the initial assessment. source

Annual ISA releases

The annual catalogue cycle does not change label validity or increase reassessment frequency. source

Result format

Results are shared through the ENX Portal with chosen partners and are not public; ENX issues no wall certificate. source source

Enforced through business relationships: partners demand labels, and a participant that does not fix non-conformities in time gets none.

Partner demand

Partners set TISAX labels as a requirement for their suppliers and name the label they need. source source

Non-conformities

Non-conformities must be resolved within nine months of the initial assessment's closing meeting; otherwise no TISAX labels are issued, and the participant can start a new initial assessment. source

1. Standard VDA ISA2027.1 catalogue, English (Excel)
2. Guidance ISA 6 to ISA2027 redline (Excel)
3. Guidance TISAX Participant Handbook
4. Guidance 10 Years of TISAX – VDA ISA2027 Released (ENX, 1 July 2026)
5. FAQ TISAX FAQs

1. ISO 27001

   ISO/IEC 27001 is an international, certifiable ISMS standard; TISAX is an automotive assessment against the VDA ISA, with results shared only through the ENX Portal.

2. IEC 62443

   IEC 62443 covers industrial control system security; the ISA2027 catalogue maps its requirements to ISA/IEC 62443.

3. NIS2

   NIS2 is EU law with duties and fines; TISAX is an industry assessment that partners require by contract.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 14 September 2026. Subscribe to TISAX (RSS)