TISAX Guide (2026): Assessment Levels, Labels, ISA2027 and Costs

Who it applies to

TISAX is a contractual requirement in the automotive supply chain, not a law. It applies to suppliers and service providers that handle a partner's confidential information, prototypes or personal data. The protected material can include design data, production information, customer information, prototypes and intellectual property (ENX).

Typically, a vehicle manufacturer or Tier-1 customer asks you to get TISAX-assessed for specific assessment objectives (ENX handbook).

Under ISA2027, organisations with very high protection needs must get assurance from their own suppliers. That assurance can be a TISAX label, an equivalent third-party assessment or a supplier audit (ENX). This pushes TISAX further down the supply chain.

Key requirements

The ISA catalogue

The ISA covers information security and is aligned with other major standards. It also includes modules for prototype protection and data protection (ENX).

ISA2027 changes several things (ENX; VDA):

• updated mappings to ISO/IEC 27001:2022 and NIST CSF 2.0
• clarified mappings to ISA/IEC 62443
• removal of the ISO/IEC 27001:2013 references
• some recommendations turned into requirements
• a formal definition of "the following aspects are considered", meaning each aspect must be consciously considered and the decision explained
• managers named as a target group for security awareness
• stronger supplier management, with the Supplier SoA playing a bigger role
• prototype protection consolidated into two domains (Organizational, and Physical and Environmental), with new traceability and disposal controls

ISA2027.1 (1 October 2026) added a German version. The English version is still authoritative, and the 2027.1 changes are editorial only (ENX).

Assessment objectives and labels

The handbook defines objectives for different situations (ENX handbook):

• information with high or very high protection needs: Confidential and Strictly confidential (these replaced Info high and Info very high from 1 April 2024), and High and Very high availability
• prototype parts and vehicles, test vehicles, and prototype events
• Data and Special data: data protection under GDPR Article 28 (processor), with Special data adding Article 9 special categories

Labels follow a hierarchy. For example, Strictly confidential includes Confidential (ENX handbook).

Assessment levels

Each objective maps to an assessment level (ENX handbook):

• AL 1: self-assessment only. It is not used within TISAX.
• AL 2: a plausibility check of your self-assessment, with evidence and an interview, usually by web conference. An optional "AL 2.5" full remote assessment also exists.
• AL 3: thorough verification, including on-site inspection.

AL 3 applies to Strictly confidential, Very high availability, Proto parts, Proto vehicles and Special data. AL 2 applies to Confidential, High availability, Test vehicles, Proto events and Data (ENX handbook).

Certification process and timeline

TISAX has four steps (ENX):

1. Registration: register as a participant and register an assessment scope in the ENX Portal.
2. Selection: choose an approved audit provider.
3. Assessment: complete a self-assessment against the ISA, followed by the external audit.
4. Exchange: share your results with chosen partners. Results are never public (ENX).

If the audit finds nonconformities, you prepare a corrective action plan. No implementation period may exceed nine months. A "minor non-conform" result can earn temporary labels, valid for up to nine months. Follow-up assessments must happen within nine months of the initial assessment (ENX handbook).

Labels are generally valid for three years. Renewing them means going through the process again with a new scope (ENX handbook).

ISA versions in 2026–2027

These rules apply (ENX):

• Assessments ordered in 2027 use ISA2027, whatever the scope registration date.
• March 2027 is the last date to open an initial ISA6 assessment.
• Scope extensions and simplified group assessments keep the ISA version of the initial assessment.
• All locations in a scope are assessed against the same version.

ISA2028 is due in summer 2027. Annual releases do not change label validity (ENX).

Costs

ENX charges participation fees (ENX price list):

• Assessment Based Charges (ABC): EUR 405 per location per scope, one-time. The discount is 10% for 5–9 locations and 20% for 10 or more.
• Participation Based Charges (PBC): EUR 5,000 per year, flat rate, by arrangement for 20 or more locations.

German VAT applies where relevant (ENX price list). Audit provider fees are charged separately and depend on your scope (ENX handbook).

Penalties

TISAX has no statutory penalties. The consequences are commercial. Without the labels your customer asks for, you may not be able to win or keep the contract.

Mapping to related frameworks

• ISO/IEC 27001:2022: ISA2027 maps to it (VDA). However, the ISMS scope and the TISAX assessment scope are not necessarily the same (ENX handbook).
• NIST CSF 2.0: mapped in ISA2027 (ENX).
• ISA/IEC 62443: OT and industrial security mappings were clarified (ENX).
• GDPR: the Data and Special data objectives cover Article 28 processor duties (ENX handbook).

Readiness checklist

1. Confirm the objectives your customer requires.
2. Define the assessment scope, including locations, processes and protection needs (ENX).
3. Download ISA2027 or ISA6 depending on when you will order (ENX).
4. Complete the ISA self-assessment and close gaps against the target maturity levels (ENX handbook).
5. Review supplier assurance and the Supplier SoA (VDA).
6. For prototypes, check the new traceability and disposal controls (ENX).
7. Register in the ENX Portal and pay the ENX fee.
8. Select an audit provider and schedule the assessment.

Common pitfalls

• Ordering a pre-assessment or gap analysis. ENX generally advises against both (ENX handbook).
• Assuming an ISO 27001 certificate equals TISAX.
• Misjudging the ISA version switch in early 2027 (ENX).
• Leaving out locations that handle partner information.
• Neglecting supplier assurance under ISA2027 (ENX).

How AssureCore helps

• Cross-framework Mapping reuses your ISO 27001 and NIST CSF controls for TISAX.
• The Controls Register and Evidence Management keep ISA evidence linked to controls, with expiry alerts.
• The Risk Register tracks supplier and prototype risks.
• Audit Reports (PDF/CSV) help you prepare for the audit.

Frequently asked questions

Official references

• ENX – About TISAX
• ENX – TISAX Participant Handbook
• ENX – 10 Years of TISAX: VDA ISA2027 released
• ENX – ISA2027 webinars, redline and timeline
• ENX – ISA2027.1 German version
• VDA – Information security / VDA ISA 2027
• ENX – TISAX participation price list

Related frameworks

• ISO 27001 guide
• ISO 22301 guide
• NIS2 guide
• SOC 2 guide