TISAX
The Trusted Information Security Assessment Exchange, an automotive industry standard for information security assessments. TISAX provides a mutual recognition framework so that suppliers only need to be assessed once to satisfy multiple OEM requirements.
Why it matters
The automotive supply chain is deeply interconnected, and OEMs like BMW, Volkswagen, and Mercedes require their suppliers to demonstrate information security maturity. Before TISAX, every OEM ran its own assessment, creating redundant effort across the supply chain. TISAX standardizes the process through the VDA ISA catalog (based on ISO 27001 with automotive-specific extensions) and allows results to be shared via a central exchange. For suppliers, TISAX certification is increasingly non-negotiable for maintaining automotive contracts.
In practice
TISAX assessment covers information security, prototype protection, and data protection based on the VDA ISA questionnaire. Organizations self-assess, then undergo an audit by an accredited provider (like TUV or Dekra). Results are published on the ENX portal at defined assessment levels. In vucavoid, TISAX can be implemented as a blueprint that materializes VDA ISA requirements into a working baseline, with controls mapped to each catalog item and evidence collection integrated into the workflow.