CISO guide to TISAX: assessment level, ISA2027 and timeline

A carmaker requires a TISAX label. How does the CISO explain to management what it is?

Strictly speaking, TISAX is not a certification. It is an assessment and exchange mechanism run by the ENX Association: the VDA ISA questionnaire is set by the German Association of the Automotive Industry (VDA), the assessment is performed by an ENX-approved audit provider, and what you obtain is an assessment label shared on the ENX platform, not an ISO certificate.

• TISAX is a commercial requirement of carmakers, not a legal obligation.
• A label is valid for up to three years from the closing meeting, with no surveillance audits in between; at expiry a full reassessment is required.
• What the market calls "TISAX certification" is this label.

Should we prepare under ISA 6.0.3 or ISA2027, and which changes affect the CISO?

The commissioning date decides, not the assessment date: assessments commissioned by 31 December 2026 can still be completed under ISA 6.0.3; those commissioned from 1 January 2027 all use ISA2027. Existing labels keep their validity and need no early reassessment.

Main ISA2027 changes:

• The information security module keeps 46 controls, 44 of them revised
• New crisis management requirement (1.6.3); the policy obligation becomes mandatory (1.1.1); remote work is rewritten as concrete mandatory requirements (2.1.4)
• Supplier verification obligations tightened (former 1.2.4 moved to 6.1.3)
• Prototype protection reduced from 22 to 20 controls, with only two labels: Basic (AL2) and Facilities (AL3)

We already have ISO 27001. Do we still need TISAX separately, and what evidence can be shared?

Yes, separately. ISO 27001 is a cross-industry security management standard; TISAX adds prototype protection and data protection modules beyond security controls and shares results via the ENX platform so that each carmaker does not assess you again. Holding another certificate does not replace the TISAX assessment.

What can be shared is the existing system: the gap diagnosis first lists which ISO 27001 evidence can be reused and what is missing, mapping each gap to the applicable requirement, existing evidence and responsible unit. Companies holding ISO 27001 can shorten preparation.

How long does TISAX take, and how does the CISO fit it into the annual plan and budget?

The service page lists a preparation period of usually 7–12 months or more, shorter with ISO 27001; if the scope includes prototype protection and the assessment is commissioned after 2027 begins, allow time to restructure documents for ISA2027. ENX states it cannot estimate the overall timeline; the process has three steps: registration, assessment, exchange.

What cannot be compressed: the quality of the self-assessment decides whether the first assessment passes, nonconformities close only after corrective action and follow-up assessment, and audit provider scheduling is outside your control.

Budget drivers include the assessment objective, sites and headcount, customer requirements and target assessment date, applicable prototype or data protection scope, and how complete existing evidence is; ENX registration, the formal assessment and audit provider fees are separate.

How does TISAX relate to supplier management and the ESG evaluation?

TISAX is itself a carmaker's security requirement on suppliers, and ISA2027 tightens supplier verification obligations. The CISO can keep requirements on upstream suppliers consistent with commitments to carmakers and write them into supplier evaluation items and contract clauses.

For listed companies, ESG evaluation indicator S-15 asks whether the company discloses a supplier management policy requiring suppliers to follow rules on cybersecurity or privacy protection and explains its implementation. The ESG evaluation covers listed companies; companies that are not public companies are not covered and can use it voluntarily.

A carmaker requires TISAX. Does the CISO also need ISO/SAE 21434 or the EU CRA?

• ISO/SAE 21434: usually yes, if the company develops or supplies cybersecurity-relevant automotive E/E systems, components or software. TISAX assesses information security at company sites; 21434 governs the product cybersecurity engineering process; one cannot replace the other. UN R155, which 21434 supports, is a whole-vehicle type-approval requirement borne by carmakers, who usually pass requirements to component makers by contract; the actual requirement follows the carmaker's request for quotation and contract.
• EU CRA: vehicles type-approved under Regulation (EU) 2019/2144 and their dedicated systems and components are outside the CRA; but automotive digital products sold separately, such as aftermarket devices, diagnostic tools, fleet management hardware and charging equipment, remain in scope.

How does Winners Consulting help a CISO with TISAX?

Winners Consulting's approach (test us with the questions above too):

• VP- and director-level consultants lead in person; nothing is outsourced
• We confirm scope, objective, level and applicable version, remediate in four phases, and share organisation-level documents with ISO/SAE 21434
• Winners is a consultant, not an issuing body, and does not guarantee a label
• Named client: Yi Fong Metal Industrial Co., Ltd., TISAX assessment consulting (VDA ISA 6.0; assessed by SGS Taiwan, TISAX label obtained)

TISAX assessment consulting, Yi Fong case, How long TISAX takes. Apply for a free mechanism diagnosis