Skip to content 
TISAX
In brief
TISAX (Trusted Information Security Assessment Exchange) is an assessment and exchange process of the automotive industry for information security. Companies have themselves assessed against the VDA ISA questionnaire and share the result with their business partners via the platform of the ENX Association. For suppliers and service providers in the industry, TISAX is often a prerequisite for being allowed to work with confidential data such as design drawings or prototypes.
How TISAX works
The basis is the VDA ISA (Information Security Assessment) catalog of the German Association of the Automotive Industry. It is based on ISO/IEC 27001 and adds topics such as prototype protection and data protection. Assessment is carried out by accredited audit providers. The result is called a label and is generally valid for three years.
| Assessment Level | Type of assessment |
|---|---|
| AL1 | Self-assessment, without external review; hardly used for exchange |
| AL2 | Plausibility check of the self-assessment, usually via document review and remote interview |
| AL3 | Comprehensive assessment with on-site audit |
TISAX is not a certification in the classic sense but an exchange process: the company decides which partners it shows its result to.
TISAX and the decommissioning of IT
Anyone who processes data subject to TISAX must also regulate the end of use: how are data carriers erased or destroyed, and how are service providers contractually involved? Typical are non-disclosure agreements and documentation for each data carrier. What you should check when selecting a service provider is shown by the guide Choosing an ITAD provider.
Second IT is certified to ISO/IEC 27001, concludes NDAs on request, and documents every erasure with a digitally signed certificate for each device.
Frequently asked questions about TISAX
Is TISAX the same as ISO 27001?
No. TISAX uses its own catalog, modeled on ISO/IEC 27001 with industry-specific additions, and is an exchange process, not an ISO certification.
Who needs TISAX?
Mainly suppliers and service providers of the automotive industry who work with confidential information of their customers. Whether it is necessary is determined by the respective client.
How long is a TISAX label valid?
Generally three years. After that, a new assessment is necessary.
What do the assessment levels AL2 and AL3 mean in TISAX?
AL2 is a plausibility check of the self-assessment, usually via document review and remote interview. AL3 is the comprehensive assessment with an on-site audit. AL1 is only a self-assessment without external review and is hardly used in exchange.
What does TISAX mean for the decommissioning of IT hardware?
Anyone who processes data subject to TISAX must also regulate the end of use. Data carriers are erased or destroyed, and service providers are contractually involved. Typical are non-disclosure agreements and documentation for each data carrier.
Confidential data on old devices? Erase with documentation for each data carrier.
Send us your device list. You will receive your offer in 48 hours on average.