TISAX Certification: Cost, Assessment Levels & Process

What is TISAX?

TISAX (Trusted Information Security Assessment Exchange) is the information-security assessment and exchange mechanism used by the German automotive industry. It is governed by the ENX Association on behalf of the German Association of the Automotive Industry (VDA), and it is built on the VDA ISA (Information Security Assessment) catalogue.

Strictly speaking, TISAX is not a certificate in the ISO sense. You undergo an assessment by an ENX-approved audit provider, and the result is a TISAX label published to the ENX exchange portal, which you then share with the customers who require it. The label is valid for three years.

Key focus: Information security, prototype protection, and data protection across the automotive supply chain.

Why is TISAX important?

Automotive OEMs share highly sensitive information with their suppliers, designs, prototypes, source code, and personal data. Rather than every manufacturer auditing every supplier separately, TISAX creates one assessment that many customers accept. You are assessed once, and you share the result with each OEM through the ENX portal.

Who needs TISAX?

TISAX applies to any organisation that handles sensitive information on behalf of an automotive manufacturer or Tier 1 supplier, including:

Automotive suppliers (Tier 1, Tier 2 and below) handling designs or specifications; engineering and design service providers; software and IT/SaaS vendors serving automotive clients; prototype builders, testing and tooling firms; and marketing, logistics and data-processing partners that touch automotive data.

If an OEM has asked you to "get TISAX" or to register on the ENX portal, this page is your starting point. Talk to an Avantcert expert to confirm the scope and assessment level you actually need.

TISAX assessment levels: AL 1 vs AL 2 vs AL 3

Your customer sets the assessment level, based on the protection needs of the information you handle for them. The level decides how the audit provider verifies your controls, and therefore most of the effort and cost.

What is TISAX Level 1?

TISAX Level 1 (AL 1) is a self-assessment against the VDA ISA catalogue with no independent verification. Because nobody checks the answers, AL 1 results are not published as a TISAX label in the ENX portal, and OEMs rarely accept them. Treat AL 1 as an internal readiness exercise before an AL 2 or AL 3 assessment.

What is TISAX Level 2?

TISAX Level 2 (AL 2) is the most common level. The audit provider reviews your completed VDA ISA self-assessment and the evidence behind it, then holds a plausibility interview, usually remotely. AL 2 applies to information with high protection needs and covers the Info high and Data labels that most supplier contracts ask for.

What does TISAX Assessment Level 3 require?

TISAX Level 3 (AL 3) is a comprehensive verification, normally carried out on site, with inspection of evidence, interviews and observation of controls in operation. It applies to very high protection needs, including the four prototype-protection labels. AL 3 takes longer and costs more, mainly because of auditor days on site and the physical security controls prototypes demand.

TISAX labels and scope

TISAX is not one single label. You are assessed against the scope your customer requires, and you receive labels accordingly. The main label families are:

Information Security, the core label, covering your information-security management system. Prototype Protection, additional physical and organisational controls for handling prototype vehicles, parts and test data, usually assessed at AL 3. Data Protection, controls aligned to GDPR requirements where you process personal data on behalf of the customer.

Choosing the wrong scope is one of the most expensive mistakes in a TISAX project: too narrow and your customer rejects the label; too broad and you pay for controls you did not need. Avantcert scopes this correctly before any assessment is booked.

VDA ISA requirements

TISAX assessments are conducted against the VDA ISA catalogue, a control set that is closely aligned with ISO 27001. It is organised into modules covering information security, prototype protection and data protection, and each control is scored on a maturity scale (from 0, incomplete, up to 5, optimising). Most customers expect a target maturity of 3 across the applicable controls.

If you already hold ISO 27001 certification, you have a substantial head start, much of the evidence, policy set and risk-management framework carries directly across, which shortens the TISAX project and reduces cost.

TISAX implementation process

Avantcert follows a proven four-stage methodology for TISAX:

1. Scoping and gap analysis. We confirm the assessment level, locations and labels your customer requires, then measure your current controls against the VDA ISA catalogue and produce a maturity scorecard.

2. Implementation. We close the gaps, policies, risk management, access control, supplier management, physical security, incident response and (where in scope) prototype-protection and data-protection controls.

3. Internal audit and self-assessment. We complete the VDA ISA self-assessment with you, verify the maturity scores are evidenced, and run a mock assessment so there are no surprises.

4. Assessment support. We prepare your team, support you through the ENX-approved audit provider's assessment, and manage any corrective actions through to the issued label.

The TISAX assessment and the ENX portal

You register your company and your scope on the ENX portal, then engage an ENX-approved audit provider, Avantcert prepares you for the assessment; the assessment itself must be performed by an approved provider, not by your consultant. Once you pass, your result is published to the portal as a TISAX label.

Unlike an ISO certificate, a TISAX label is not a public document you print and display. It lives in the exchange, and you actively share it with each customer who needs to see it. The label is valid for three years, after which you reassess.

Benefits of TISAX

Market access. A valid label removes the single biggest blocker to winning and keeping German automotive contracts.

Assess once, share many times. One assessment satisfies multiple OEMs and Tier 1 customers, instead of a separate audit for each.

Genuinely stronger security. The VDA ISA controls materially reduce the risk of breach, IP theft and prototype leaks.

A foundation for other standards. The work overlaps heavily with ISO 27001, so pursuing both together is far cheaper than doing them separately.

How much does TISAX certification cost?

TISAX certification with Avantcert costs $8,000 to $35,000 and takes up to 4 months. A small single-site supplier at AL 2 sits near $8,000; a mid-sized supplier typically pays about $18,000; a large enterprise at AL 3 with prototype labels and several locations reaches $35,000. These figures are already 30–50% below typical market rates.

The ENX-approved audit provider fee is separate and paid directly to them, because the organization that prepares you cannot also audit you. ENX also charges a registration fee for your participant account and assessment scope.

What drives the cost of a TISAX assessment?

• Assessment level. AL 3 needs on-site verification and more auditor days than AL 2.
• Labels in scope. Each prototype label adds physical and organisational controls to build and evidence.
• Number of locations. Every site in scope is assessed, so multi-site suppliers pay more.
• Existing ISO 27001. An ISMS already in place shortens the project and lowers the preparation fee.

Get an exact figure for your scope with our free certification cost calculator, or request a scoped quote.

TISAX FAQs

About Avantcert

Avantcert is an ISO and compliance certification consultancy that works alongside accredited certification bodies, helping organizations achieve TISAX through VDA ISA gap analysis, implementation, and assessment support. Avantcert has supported 3,000+ organizations across 40+ markets, following a proven four-stage methodology, Gap Analysis, Implementation, Internal Audit, and Assessment. To begin your TISAX project, request a free quote or talk to an Avantcert expert.

Related certifications

Avantcert also helps organizations achieve these related standards, often alongside TISAX as part of one programme: ISO 27001, IATF 16949, ISO 9001, GDPR, VAPT, SOC 2. Not sure which you need? Use the free estimator or talk to an expert.

Official reference: ENX Association, TISAX.