In the automotive industry, engineering designs, proprietary telematics, and pre-series vehicle prototypes represent core competitive assets. To standardize security audits across suppliers, the German Automotive Industry Association (VDA) developed the VDA ISA catalog, while the ENX Association operates the TISAX assessment exchange scheme, widely recognized by European automotive OEMs.

Primary Sources: ENX Association TISAX Scheme (enx.com/tisax); VDA Information Security Assessment Catalog Version 6.0 (vda.de).

1. Distinguishing Protection Needs from Assessment Levels

Suppliers preparing for a TISAX assessment must clearly differentiate two distinct concepts:

Protection Needs (Schutzbedarf)

The Sensitivity of Information Handled

  • Normal: Standard business information where confidentiality breach causes minor impact.
  • High: Confidential engineering specifications, supplier contract details, or sensitive customer data.
  • Very High: Highly confidential crash test results, secret vehicle designs, or unreleased prototype components.

Assessment Levels (Prüfniveau)

The Verification Methodology & Depth

  • Assessment Level 1 (AL 1): Internal self-assessment. Not audited by an external body and rarely accepted by automotive OEMs for commercial contracts.
  • Assessment Level 2 (AL 2): Plausibility audit conducted by an ENX-approved audit provider via remote interviews and evidence reviews. Typically required for 'High' protection needs.
  • Assessment Level 3 (AL 3): Deep technical and physical on-site audit conducted by an ENX-approved audit provider. Mandatory for 'Very High' protection needs and prototype handling.

2. Key Focus Areas in VDA ISA 6.0

The VDA ISA version 6.0 catalog aligns with ISO/IEC 27001:2022 while adding automotive-specific controls across three primary modules:

VDA ISA 6.0 Architecture

  • Information Security: Core ISMS requirements covering access controls, encryption, asset management, and configuration baselines.
  • Prototype Protection: Dedicated controls governing the physical security of pre-series vehicles, disguised testing components, and photography-restricted design studios.
  • Data Protection: Verification of GDPR compliance when processing personal data in automotive environments (e.g., connected car test fleets).

3. ENX Audit Process and Mutual Recognition

Assessments are performed exclusively by audit providers accredited and approved by the ENX Association (such as TÜV SÜD, DEKRA, DQS, or PwC as examples). The supplier registers with ENX, defines their assessment scope, commissions an approved audit provider, and undergoes the AL 2 or AL 3 audit. The resulting TISAX label is published to the ENX portal, allowing the supplier to grant access to OEMs upon request without repeating bilateral audits.

4. Conclusion: Technical Baseline Alignment

Automotive suppliers navigating TISAX requirements benefit from maintaining continuous configuration baselines aligned with ISO/IEC 27001 Annex A.8. While software platforms can help automate technical evidence collection for cloud and identity configurations, a TISAX label is granted solely by accredited independent audit providers following formal ENX assessment procedures.