TISAX Certification for Suppliers: What the Mittelstand Needs to Know

What Is TISAX Certification and Who Needs It?

TISAX (Trusted Information Security Assessment Exchange) is the common assessment and exchange standard for information security in the automotive industry. Developed by the German Association of the Automotive Industry (VDA) and operated by the ENX Association, the procedure is based on the standardized VDA ISA questionnaire. Unlike voluntary evidence, a TISAX label today is a mandatory business prerequisite for almost every company that works directly or indirectly with automotive manufacturers. If you process sensitive development data or have access to customer systems, OEMs require the proof as standard as part of supply chain security.

Who exactly needs the label? The obligation no longer affects only the large Tier 1 suppliers. Smaller service providers in the German Mittelstand are also obliged as soon as they are integrated into the automotive value chain. The requirements depend on the type of service provided and the protection needs of the data.

• IT and software service providers that maintain or develop systems or cloud services for the automotive industry
• Logistics companies that are integrated into sensitive supply chains or the transport of pre-series vehicles
• Engineering firms and prototype builders that work with highly confidential design data
• Marketing and advertising agencies that receive early access to unreleased vehicle models or product campaigns

TISAX differs from classic certifications such as ISO 27001 (on which it is built in terms of content) above all through the standardized exchange mechanism via the ENX portal. This means that you demonstrate your security level once and can then share the result directly with several business partners. So that you can master these requirements efficiently and without an enormous organizational effort of your own, our specialized managed services for cybersecurity and compliance support you directly with the implementation of the technical controls.

The New VDA ISA Catalog 6.0: What Has Changed Since April 2024

Since 1 April 2024, version 6.0 of the VDA ISA catalog has been the binding basis for all new TISAX assessments. This update brings far-reaching changes that you, as a managing director or IT manager in the Mittelstand, need to be aware of. The most striking formal change is the switch to English as the leading main language, which underlines the global orientation of automotive supply chains. At the same time, the catalog offers improved implementation guidance to make practical implementation easier for you. In addition, the data protection module has been revised to meet current regulatory standards.

A central focus of version 6.0 is the tightened protection of IT and OT systems (Operational Technology). In view of growing threats from ransomware and state actors, OT availability in your production chains is coming into focus. The previous "Information Security" label has been fully replaced by two separate labels: "Availability" and "Confidentiality." Especially for producing suppliers in the Mittelstand, this means that production facilities and networks (IACS) must be protected in accordance with international security standards such as IEC 62443. This reveals a close relationship to statutory NIS2 compliance, in which supply chain security is likewise the top priority.

To meet these strict requirements without a huge internal compliance team, modern platform approaches support you. With the Cybersecurity and Compliance modules, CAVRIX offers you an integrated solution that unites IT security and regulatory audits. Through automated evidence provision and proactive monitoring in the Command Center, you keep an eye on the status of your IT and OT security at all times. This significantly reduces the effort for your TISAX preparation and at the same time protects your ability to deliver.

The TISAX Assessment Levels: Remote Audit or On-Site Inspection?

The effort your company must invest in TISAX certification depends largely on the required Assessment Level (AL). The three levels determine not only the depth of the assessment, but also the type of audit and the associated costs. For Mittelstand suppliers, the right classification is crucial in order to avoid unnecessary expenditure on on-site audits when a digital procedure is sufficient.

For most Mittelstand suppliers, the more cost-effective Level 2 is the standard. The auditor reviews your self-assessment and IT documentation purely digitally in a remote audit as well as through targeted telephone interviews. A time-consuming on-site audit at Level 3, on the other hand, is required by OEMs whenever you work with real prototypes or physically process sensitive development data on your premises. Since physical on-site controls are more expensive, you should check carefully in advance which label your clients actually require.

The good news: many technical measures that you build up for a TISAX label directly coincide with your statutory obligations under other standards. Anyone who already has their cybersecurity under control also masters the TISAX hurdles significantly faster. With the automated evidence from our platform for compliance, this process can be further simplified so that you meet the NIS2 requirements at the same time and demonstrate a certified security level to your customers.

Costs and Duration of a TISAX Certification for SMEs

A TISAX certification is an important project for Mittelstand suppliers that ties up both financial and time resources. How high your actual effort turns out depends largely on how well your IT infrastructure is already documented and secured.

The total costs consist of three main components: the one-time ENX registration fee, the fees for the accredited assessment service provider and the costs for internal preparation. With CAVRIX services such as Managed IT and Compliance, this internal preparation effort can be drastically reduced, as many technical proofs are already continuously recorded in the Command Center.

In terms of time, you should plan a frame of 3 to 12 months for the entire project. Especially for managing directors and IT managers in the Mittelstand, it pays off to use existing synergies with statutory requirements such as NIS2 or standards such as ISO 27001 in order to shorten the TISAX introduction to 3 to 6 months.

• ENX registration: Initial registration of your company on the ENX platform as a prerequisite for all further assessment steps.
• 9-month deadline: The entire assessment process, from the initial review by the service provider to the resolution of all deviations, may take a maximum of 9 months.
• 3 years of validity: After successful completion, the issued TISAX labels are valid for three years before a re-assessment becomes necessary.

Step by Step to the TISAX Label: The Process at a Glance

The path to the TISAX label follows a clearly defined process of the ENX Association. For managing directors, IT managers and compliance officers, a structured approach is crucial in order to avoid unnecessary loops, delays and unexpected costs. A structured process ensures that you deploy your internal resources in a targeted manner and make optimal use of existing synergies with statutory requirements such as NIS2 or established standards such as ISO 27001. The official assessment and exchange mechanism is divided into four main phases that lead to success step by step.

1. Registration and definition of the assessment scope: First you register your company on the ENX portal and define the assessment scope. This largely determines the complexity and the costs of the entire audit.
2. Self-assessment based on the VDA ISA 6.0: In the next step, you carry out a detailed self-assessment using the current VDA ISA catalog. Here you identify potential security gaps and resolve deviations before the external auditor becomes active.
3. Selection of the assessment service provider and audit: You commission an auditor approved by ENX. After a document review, the actual audit takes place on-site or remotely, depending on the required assessment level (Assessment Level 2 or 3).
4. Resolution of deviations and publication: If deviations are identified in the audit, you have time for corrective measures. After successful completion, the coveted TISAX label is published on the ENX platform and made visible to your partners.

The VDA ISA self-assessment in particular often uncovers undetected weaknesses in the internal IT infrastructure. Instead of viewing this process as an isolated, bureaucratic project, it is worth linking it with your general IT and security objectives. With the CAVRIX Compliance service, the required evidence for information security can be recorded, documented and continuously monitored in a partially automated way. This way, you not only prepare your company optimally for the official TISAX audit, but also strengthen your entire cyber defense at the same time and meet regulatory requirements during ongoing operations.

Leveraging Synergies: The Connection Between TISAX, ISO 27001 and NIS2

For Mittelstand companies, the flood of new regulatory requirements often feels like an insurmountable hurdle. The good news, however, is that you do not have to reinvent the wheel every time. If your organization has already established an information security management system (ISMS) in accordance with ISO 27001, you automatically cover roughly 60 to 70 percent of the TISAX requirements with it. The strategic linking of TISAX and NIS2 also shows that a foundation once built massively paves your way to statutory NIS2 conformity at the same time. An integrated compliance process saves your team valuable time and conserves financial resources.

• Shared build-up of security controls: Core areas such as encryption, incident management and access controls are structured almost identically in all three sets of rules.
• Avoidance of duplicate work: A holistic security concept ensures that you only have to create documents, risk analyses and training records once and can use them for all audits.
• Use of the ISMS as a basis: The existing ISMS serves as a central anchor point, so that for TISAX only the delta project, such as automotive-specific requirements in prototype protection, still needs to be implemented.

Instead of coordinating various isolated solutions and service providers, a consolidated approach is recommended for the Mittelstand. With our Compliance service, you have integrated modules at your disposal that align your processes with standards such as ISO 27001 and NIS2 and collect evidence automatically. In combination with our Cybersecurity service and the Command Center interface, you keep a full overview of your security status at all times, minimize manual effort and make your company fit for any external audit without your own compliance team.

CAVRIX as Your Partner: Compliance and IT Security From a Single Source

Meeting the strict TISAX requirements poses major logistical and personnel hurdles for many Mittelstand companies. Traditionally, management and IT managers have to laboriously coordinate several external partners: a classic system house for IT operations, a specialized service provider for cybersecurity and additional consultants for compliance documentation. CAVRIX breaks up this inefficient silo thinking and unites all these disciplines in a single, seamlessly integrated platform. For you, this means: minimal coordination effort and holistic protection that maps the requirements of the VDA ISA catalog automatically in the background, instead of tying up valuable internal resources.

Our integrated platform relieves your organization in everyday operations on all security-relevant levels:

• Managed IT: Our service takes over seamless patch management, the automatic staging of end devices and gapless IT documentation. This ensures that the solid technical basis for your TISAX certification is always guaranteed.
• Cybersecurity: The proactive service protects your networks with 24/7 SOC monitoring and detection of vulnerabilities. Threats are averted before they can turn into a compliance-relevant security incident.
• Compliance: The integrated modules for compliance continuously collect evidence about the state of your infrastructure in the background. Instead of frantically gathering documents before the next TISAX audit, you can access verifiable reports at any time.
• Command Center: Via the intelligent Command Center, you retain full control by chat (for example via Microsoft Teams or Slack). You can query the current security status and pending tasks in natural language.

Through this close interlocking of technical protection and regulatory documentation, TISAX turns from an annual stress limit into a continuous, automated process. This way, your organization also masters the tightened assessment criteria under the current ISA 6.0 standard with confidence, strengthens supply chain security and remains a trustworthy partner for the automotive industry over the long term.