The automotive industry\u2019s information security assessment. Not a certificate you publish, but a label you share, and without it OEMs will not send you prototype data.
What is TISAX?
TISAX is the automotive industry\u2019s mechanism for assessing information security across the supply chain. It was initiated by the VDA, the German automotive association, and is operated by the ENX Association. The assessment is made against the VDA ISA catalogue, which builds on ISO 27001 and adds requirements the industry cares about specifically: prototype protection and the handling of confidential development data.
It does not produce a public certificate. It produces labels, which you share with named partners through the ENX exchange. That distinction matters commercially: you cannot put TISAX on your website as a badge, and an OEM cannot look you up, so the sharing step is part of the process rather than an afterthought.
Assessment levels run AL1 to AL3, and only AL2 and AL3 produce proof an OEM will accept. AL2 is the common case, conducted remotely through document review and assessor interviews. AL3 requires a full on-site audit and is expected where strictly confidential information or physical prototypes are involved. The current catalogue is VDA ISA 6.0.3, and a new VDA ISA 2027 catalogue was published on 1 July 2026 and becomes mandatory for assessments commissioned from 1 January 2027, which is worth factoring into when you start.
Compliance requirements
The VDA ISA catalogue, whose modules you are assessed against depends on the labels you need.
The ISO 27001-derived core of the catalogue: policy, risk management, asset management, access control, operations and incident handling.
Physical and organisational protection of prototype vehicles, components and parts, including secure areas, transport and event handling. The module with no ISO equivalent.
Assessed against GDPR expectations where the partner requires it, covering processing of personal data on their behalf.
How you secure connections to partner networks and systems, which is often the reason the OEM asked in the first place.
Each control is scored on a maturity scale, and the target is defined by the label you are seeking rather than by a single pass mark.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We establish which labels your partners actually require and whether AL2 or AL3 applies. Getting this wrong is the most expensive mistake available, in both directions.
We confirm whether your assessment falls under VDA ISA 6.0.3 or the 2027 catalogue, since assessments commissioned from 1 January 2027 use the new one.
We assess you against the applicable modules and score each control on the maturity scale the assessor will use.
Your compliance manager closes the gaps, with particular attention to prototype protection, which is usually where a non-automotive ISMS falls short.
We register you on the ENX portal, manage the accredited audit provider, and prepare your team for the interviews or the on-site audit.
We handle the sharing of your labels with the partners who need them, which is the step that actually unlocks the business.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone