TISAX
Map VDA ISA criteria, scope the relevant assessment level and connect prototype-data controls with owners and evidence. The next OEM assessment reuses the approved work as far as the scope allows.
One control, several standards
Standards overlap far more than they differ. A control entered once is mapped to every framework whose requirement it answers, so the second audit inherits the evidence from the first.
One control
Supplier & third-party due diligence
From control to policy
A control is not a line in a register. It belongs to a management system, and it is carried by the policies and procedures your people actually read, so it flows through both.
One control
Supplier & third-party due diligence
Management systems
Policies and procedures
01
KaitoSec ships with the complete VDA ISA (Information Security Assessment) catalog structured as assignable criteria. Every criterion, including the additional requirements for high and very high protection needs, is linked to implementation guidance, so your team knows what is required and which evidence to collect.
02
TISAX defines three assessment levels: AL1 as self-assessment, AL2 with remote audit, AL3 with on-site audit for prototype data. KaitoSec helps determine which level your OEM customers require and limits the implementation work to that level, so no effort goes into a level nobody requires.
03
The ENX Association portal is where TISAX results are registered and shared with OEM customers. KaitoSec prepares your evidence package in the format ENX-accredited audit providers expect and tracks submission status through the assessment.
01
For each ISA criterion, KaitoSec tracks the current maturity level against the target maturity of 3 that the TISAX methodology sets for all criteria. Ahead of the assessment date you see which criteria are furthest from target.
02
TISAX AL3 includes specific requirements for handling prototype data and development secrets. KaitoSec provides dedicated control sets for physical security, need-to-know access and securing R&D environments.
03
Once your TISAX label is active on the ENX portal, KaitoSec keeps track of which OEM customers you have shared results with and which scope each release covers. You stay in control of who sees what.
TISAX (Trusted Information Security Assessment Exchange) is an automotive industry information security assessment standard based on the VDA ISA catalog. It is required by most major German OEMs and is increasingly demanded by Tier 1 suppliers. Any company in the automotive supply chain that handles sensitive OEM data, prototype information, or critical development assets is likely to need a TISAX label.
TISAX is specifically designed for the automotive supply chain and focuses on protection of vehicle data, prototype data, and supplier relationships. ISO 27001 is a general ISMS standard applicable to any sector. TISAX builds on ISO 27001 concepts but has sector-specific requirements. Results are shared exclusively through the ENX portal; there is no public certificate as with ISO 27001. See the TISAX glossary entry for the assessment-level structure and ENX portal role.
Assessment level depends on the sensitivity of the data you handle for OEM customers. AL1 covers normal information protection and is self-assessment only. AL2 is required for high protection needs and involves remote audit by an ENX-accredited audit provider. AL3 covers very high protection needs, such as prototype data, and requires on-site audit. Your OEM customer will specify the required level in the contract.
TISAX labels are valid for three years from the date of the assessment. KaitoSec tracks your label expiry and sends reminders well in advance, so reassessment preparation starts early enough and no gap opens in your supplier qualification.
Yes. KaitoSec maintains a cross-mapping between VDA ISA criteria and ISO 27001:2022 Annex A controls. If your organisation pursues a TISAX label and an ISO 27001 certificate, evidence and implementations are reused across both frameworks. That saves duplicate work.
