Requirements & evidence
TISAX
The ENX-governed assessment and exchange mechanism for automotive information security, based on the VDA Information Security Assessment catalog. A TISAX label is scope- and site-specific; it is not an ISO certificate or a company-wide platform claim.
- Edition on record
- ISA 6.0.3
- Issuing authority
- ENX Association (opens in a new tab)
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for automotive, manufacturing, supply chain, across EU and global. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Information security
- Prototype protection
- Data protection
- Assessment objectives and labels
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Source access and licensing
The VDA ISA catalog and TISAX program materials carry their own use terms. Confirm rights for software integration, mappings, and redistribution before ingestion.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
TISAX is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; ISA requirements, assessment objectives, scoring, and TISAX participant or assessment workflows are not ingested or implemented.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.
Announced transition
ENX has published ISA2027, which becomes the basis for TISAX assessments ordered from 2027-01-01. Assessments ordered before then may remain on ISA 6, and March 2027 is the final date to open an initial ISA 6 assessment.
Authority’s stated timing: 2027-01-01
Read the authority’s announcement (opens in a new tab)- ISA 6.0.3Current edition on record · Replaces ISA 5.1.0
- ISA 5.1.0Superseded editionPublication date not recorded
Recorded change history
· TISAX: ENX has published ISA2027, which becomes the basis for TISAX assessments ordered from 2027-01-01. Assessments ordered before then may remain on ISA 6, and March 2027 is the final date to open an initial ISA 6 assessment.
· TISAX ISA 6.0.3 supersedes ISA 5.1.0 and is the current edition.
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.
- ENX Association (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: tisax-isa-6.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Information security · Prototype protection · Data protection · Assessment objectives and labels.
Record last updated: August 30, 2026.
Common questions
A closer look.
What is TISAX?
The ENX-governed assessment and exchange mechanism for automotive information security, based on the VDA Information Security Assessment catalog. A TISAX label is scope- and site-specific; it is not an ISO certificate or a company-wide platform claim.
Who does TISAX apply to?
TISAX applies to automotive, manufacturing, supply chain, EU, global, per ENX Association.
What is the current version of TISAX?
The current edition is ISA 6.0.3, issued by ENX Association and published 2024-04-25. Source: https://www.enx.com/en-US/TISAX/downloads/.
What does an assessment under TISAX require?
No control catalog has been ingested for TISAX yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
TISAX
ISA 6.0.3
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize TISAX requirements, evidence preparation, and review for your assessment scope.