TISAX compliance for Canadian automotive suppliers

What is TISAX, in plain terms

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry's shared information security assessment, run by the ENX Association on the VDA ISA catalogue. One assessment, shared once through the ENX portal, instead of every OEM auditing you separately.

How it works

• Information Security: mandatory for everyone, 46 control questions across 7 chapters, scored on a maturity scale.
• Prototype Protection: only if you handle physical prototype parts or vehicles (22 control questions).
• Data Protection: only if you process personal data as a processor under GDPR (12 control questions).
• Every control is scored 0 to 5, and the pass bar is level 3 (Established), meaning documented and consistently followed, not just written down.
• The formal label is issued only by an ENX-accredited audit provider after a remote (AL2) or on-site (AL3) assessment, and is valid 3 years.

Most suppliers hearing "TISAX" for the first time do not know where they stand. This free check shows you in minutes, so you walk into the real assessment already prepared.

What we do, and what we do not do

We are not an ENX-accredited audit provider and we do not issue the TISAX label. Only an accredited provider can do that, and it should stay that way. What we do is get your evidence in order before one arrives, so the assessment reviews work you have already finished instead of discovering gaps on the day.

Any vendor blurring that line is telling you something about how they work.

If you already have ISO 27001

Most of the work carries over. The VDA ISA catalogue is built on the same control thinking as ISO 27001, so a real ISO programme gives you a substantial head start and most of your existing evidence stays useful. What TISAX adds is the automotive scope, the maturity scoring, and the ENX exchange process. The teams that struggle are usually running two separate projects instead of one system.

On maturity, so nobody panics

Starting at level 1 is normal. Nobody starts at 5, and the bar is 3, not 5. A low starting score is the reason to do the work, not a sign you are behind.

How SecuritComply gets you TISAX ready

• VDA ISA control sets organized by scope, so you track only what applies to you
• A readiness view that surfaces your gaps before an accredited provider sees them
• Policy templates aligned to the controls assessors expect
• One evidence repository for the artifacts that prove each control at level 3
• Risk register, vendor risk and incident management in the same platform
• Canadian data residency, so your evidence does not leave the country
• The same platform carries CPCSC, ISO 27001, SOC 2 and PIPEDA, so a second requirement does not mean a second tool

TISAX questions we get asked

Who needs a TISAX label? Suppliers whose automotive customers require it, most often when a German OEM or a Tier 1 is involved. It flows down the supply chain, so if you handle a customer's data or prototype parts, expect the question.

Does SecuritComply issue the label? No. Only an ENX-accredited audit provider issues it. We get you ready for that assessment and hold the evidence behind every control.

We already have ISO 27001, does that count? Not on its own, but it is a substantial head start. The gap is usually the maturity scoring and the automotive scope.

How long does it take? It depends on your starting maturity, your number of sites and which scopes apply. The free readiness check below tells you where you actually stand before anyone quotes you anything.