TISAX: AL1-AL3 Assessment Levels and the VDA ISA Catalogue

There are three levels. AL1 is a self-assessment with no external verification, generally insufficient for a demanding customer. AL2 adds a remote document review by an accredited assessment provider. AL3 requires a full on-site audit, including interviews and technical checks. The required level is set by the customer requesting the label, based on the sensitivity of the information exchanged.

TISAX is not an ISO certification but a sector-specific automotive standard, with a control catalogue (VDA ISA) broadly compatible with ISO 27001's structure but focused on risks specific to the automotive supply chain: protection of development data, prototypes and highly sensitive information exchanged with manufacturers. An existing ISO 27001 certification eases a TISAX assessment but does not replace it.

Any automotive supplier or subcontractor that a manufacturer or tier-1 supplier contractually requires to hold TISAX in order to access sensitive information: development data, prototypes, technical drawings, or personal data handled in automotive projects.

The label is valid for three years from the completion of the assessment, provided any findings are remediated within the required timeframe. The supplier must then renew the assessment to keep the label active on the ENX platform.

Yes. CISAPP's multi-framework compliance module reuses evidence already collected for ISO 27001 or GDPR against the VDA ISA control catalogue, and the evidence register tracks findings through to closure ahead of the assessment.