Services

TISAX Compliance

TISAX (Trusted Information Security Assessment Exchange) is the information security assessment standard used across the automotive industry, driven originally by German OEMs but now expected throughout the broader automotive supply chain, including suppliers well outside Germany. If you handle prototype data, connected vehicle data, or any information an automaker considers sensitive, a TISAX assessment is likely somewhere on your path, whether as a current requirement or an upcoming one.

What makes TISAX distinct from a general security framework is that the specific assessment scope and required maturity level depend on what you actually handle — prototype parts get different, often stricter requirements than general business information, and connected vehicle data brings its own set of expectations. Getting the scope right at the start matters, because over-scoping wastes real effort and under-scoping means failing the actual assessment.

Where organizations run into trouble

The most common issue is treating TISAX like a one-time hurdle to clear before a specific contract closes, rather than an ongoing state you maintain. Assessment results have a defined validity period, and the underlying controls need to keep operating in between, not just be stood up right before the assessor arrives.

How I'd help

I'd start with a gap analysis against the specific assessment level your situation requires, then work through closing the gaps in a way that's actually sustainable day to day — not a scramble right before an assessment window. If you're new to TISAX, I'll also help you understand what your specific customer relationships actually require, since that varies more than people expect.

If you've got a TISAX requirement coming from an automotive customer, let's figure out what you actually need to do.