02 / Compliance and certification
TISAX, prepared before the audit provider arrives
We help automotive suppliers and service providers work through the VDA ISA catalogue, close the gaps and walk into the assessment with evidence instead of intentions.
Overview
What TISAX is
TISAX (Trusted Information Security Assessment Exchange) is the assessment and exchange mechanism used across the automotive industry. It is operated by the ENX Association, and assessments are based on the VDA ISA (Information Security Assessment) catalogue published by the German Association of the Automotive Industry.
Your customer usually tells you which assessment objectives they expect, for example information with high or very high protection needs, prototype protection or data protection. The objectives decide the assessment level and how deep the audit goes. You register on the ENX portal, complete a self-assessment against the catalogue, and are assessed by one of the audit providers approved by ENX.
The results are labels, and you decide on the ENX portal which partners can see them. Black Fox is not a TISAX audit provider. We prepare you, help close the gaps, coordinate the assessment with our long-standing audit partners or an ENX-approved provider of your choice, and stay with you through it if you want us there.
Who it is for
Automotive suppliers, engineering and design firms, logistics providers and IT service providers whose customers in the industry require a TISAX label, often before a contract can start or continue.
The work, from scoping to evidence.
What we do
Objectives and scope
We help you confirm the assessment objectives your customers require and the locations and processes they cover.
VDA ISA self-assessment
We work through the catalogue with you, set realistic maturity levels and record the evidence behind each answer.
Gap closure
Policies, procedures and technical measures to close what the self-assessment shows, prioritised by what the assessment will look at.
Prototype protection
Where your objectives include it, physical and organisational measures for handling prototypes, vehicles and components.
Data protection
Where your objectives include it, alignment of the data protection questions with your obligations under the GDPR.
Technical checks
Where useful, hardening reviews and penetration tests, so the measures you describe exist in your systems as well.
How the engagement runs
Kickoff
We agree objectives, locations, the people involved and your customer's deadline, and sign an NDA first if you need one.
Self-assessment
A guided pass through the VDA ISA catalogue, ending in a prioritised gap list.
Gap closure
We work with your owners on documents, measures and evidence.
Pre-assessment review
We review your evidence the way an assessor would and point out what would not hold.
Assessment
We coordinate the assessment with one of our long-standing audit partners or the ENX-approved provider of your choice, and help with any corrective action plans that follow.
What you receive
- Confirmed assessment objectives and scope
- Completed VDA ISA self-assessment with evidence references
- Gap report with a prioritised action plan
- Policy and procedure set fitted to your organisation
- Pre-assessment review findings
- Support for corrective action plans
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Are you a TISAX audit provider?
No. Assessments are carried out by audit providers approved by the ENX Association, independent of our preparation work. We prepare you, coordinate the assessment with one of our long-standing audit partners or a provider of your choice, and support you during it.
Is TISAX the same as ISO/IEC 27001?
No, but they are related. The VDA ISA catalogue draws on ISO/IEC 27001 and adds automotive topics such as prototype protection. An ISO/IEC 27001 ISMS is a good base, but it does not replace a TISAX assessment.
Which assessment level do we need?
It follows from the assessment objectives your customer requires. Ask your customer which objectives they expect, and we will help you understand what that means for the audit.
Who sees our result?
You do, and the partners you choose to share it with. You decide on the ENX portal who can see your labels and how much detail they get.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Governance and riskThird-party risk managementSupplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
- Managed securitySecurity hardeningSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.
Start with what your customer asked for
Tell us which objectives your customer requires and by when. We will show you where you stand against the catalogue.