TISAX®

The TISAX certification process:

TISAX certification is a standardized process that helps companies meet information security requirements within the automotive industry. It involves going through clearly defined steps to ensure that sensitive data is protected and the security requirements of partners and customers are met.

The individual phases of the certification process are explained in more detail below, from preparation to successfully obtaining the TISAX label.

• Define the scope of application

  The first step is to define the scope of the certification, which includes the following.

  • Identifying the sites, processes and systems to be covered.
  • Clarifying the required security levels based on the sensitivity of the data exchanged with business partners.
  • Aligning the scope with the TISAX assessment objectives (e.g. information security, data protection or protection of prototypes).

• Preparation for the exam

  This includes preparing your organization for the TISAX audit by:

  • Conducting a gap analysis in relation to TISAX requirements to identify areas for improvement.
  • Implementing an ISMS that is compliant with ISO/IEC 27001 and includes TISAX-specific controls.
  • Document all policies, procedures and processes related to information security.

• Choose an accredited audit provider

  TISAX assessments are carried out by certified audit providers approved by the ENX Association. Choose a provider that meets your requirements:

  • Compare providers based on cost, experience and expertise.
  • Make sure the provider is accredited for TISAX assessments.

• Registration on the ENX TISAX platform

  Before the audit can begin, you must register on the ENX TISAX platform:

  • Submit your company data.
  • Define the scope and objectives of the audit.
  • Pay the registration fee.
    You will receive a unique identifier (TISAX ID) for tracking and reporting.

• Carry out the self-assessment

  Conduct a self-assessment to evaluate your readiness:

  • Use the TISAX self-assessment questionnaire provided by ENX.
  • Determine to what extent the requirements are met and in which areas there is still need for action.
  • Take corrective action if necessary.

• Implementation of the audit

  The selected audit provider carries out an independent assessment in two stages:

  • Documentation review: the audit team reviews your ISMS documentation to ensure that it complies with TISAX requirements.
  • On-site audit: The auditors visit your premises to check the implementation of the ISMS, interview employees and inspect technical facilities.

• Addressing non-conformities

  If the auditors find non-conformities:

  • Develop a corrective action plan.
  • Correct the problems within the specified time frame.
  • Provide evidence of compliance to the auditors.

• TISAX label received

  After successfully passing the audit:

  • The audit provider sends the results to the ENX Association.
  • If you meet the requirements, you will receive a TISAX seal of approval indicating the level of security achieved (e.g. confidentiality, high protection, etc.).
  • The seal of approval is valid for three years and is reviewed at regular intervals.