TISAX audit preparation: what VDA ISA requires from your network security — and how Zenarmor provides the evidence

A TISAX audit is an assessment by an ENX-approved audit provider against the VDA ISA catalogue. If you pass, you receive TISAX labels, which you share with your automotive customers through the ENX portal. Network security is where many suppliers lose points. Typical problems are a flat network in which office, production and test environments can all reach each other, remote access without strong authentication, and logs that exist but are never reviewed. This guide explains what VDA ISA actually asks for, what evidence an assessor expects, and how Zenarmor helps you produce that evidence, with Secrotec as the official Zenarmor partner in the Netherlands.

Secrotec is an independent ISO 27001 Lead Auditor firm and also implements Zenarmor. We are not an ENX-approved TISAX audit provider and we do not issue labels. Our job is preparation: readiness, implementing controls and organising evidence, so that the official assessment runs smoothly.

Key points at a glance

• TISAX results in labels, not a certificate. Labels are valid for three years and there are no annual surveillance audits.
• Assessments ordered before 1 January 2027 use VDA ISA 6. From that date, ISA2027 applies.
• The network-related controls that matter most are 5.2.7 network management, 5.2.3 malware protection, 5.2.4 logging, 5.1.2 information transfer, 2.1.4 remote work, 4.1.2 authentication, 5.3.2 network services and 1.3.3/1.3.4 approved services and software.
• A firewall does not make you compliant. It does deliver the technical evidence, provided the processes around it reach maturity level 3.

What is TISAX®?

TISAX® stands for Trusted Information Security Assessment Exchange. The scheme is run by the ENX Association. The requirements come from the VDA ISA (Information Security Assessment), published by the German Association of the Automotive Industry (VDA). The idea is simple: you are assessed once and share the result with every customer in the supply chain. Without TISAX, you would answer a separate questionnaire or host a separate audit for each OEM.

The terminology matters. TISAX is often loosely called "TISAX certification", but the result is a set of TISAX labels, not a certificate. You share the labels with selected partners in the ENX portal. According to ENX's TISAX Participant Handbook (v2.8), labels are generally valid for three years, after which you go through the process again. Unlike ISO 27001, TISAX has no annual surveillance audits.

Who requires TISAX?

Car and truck manufacturers (OEMs) and large Tier-1 suppliers require TISAX from anyone who handles their sensitive information, prototypes or personal data. That includes many companies in the Netherlands and Belgium, such as metal and plastics processors, engineering firms, software houses, test facilities, photo studios and logistics providers working for German OEMs or their suppliers.

A concrete example: since 2025, Daimler Truck has required a TISAX label at assessment level 3 from all production material suppliers. A reasonable grace period can be agreed when a new contract starts or an existing one is extended (Daimler Truck Supplier Portal). If you receive such a request, it normally states exactly which labels and which level you need.

VDA ISA 6 and the move to ISA2027

VDA ISA 6 applies to assessments ordered since 1 April 2024. The catalogue has three modules: Information security, Prototype protection and Data protection. Each control is rated on a maturity scale from 0 to 5. The target maturity level is 3 ("established"): a defined, documented process that is applied across the organisation and whose effectiveness is monitored.

The VDA published ISA2027 on 1 July 2026. According to ENX, ISA2027 applies to all TISAX assessments ordered from 1 January 2027. Existing labels remain valid for their full term. ISA2027 also starts an annual release cycle, with each version named after the year in which it becomes mandatory. The largest restructuring is in prototype protection, where five control groups have been merged into two domains: organisational requirements, and physical and environmental security.

What this means in practice: the control numbers in this article are ISA 6 numbers and may change in ISA2027. Organise your evidence by the content of a control (network management, logging, authentication), not only by its number. If you order your assessment in 2026, you will still be assessed against ISA 6.

Assessment levels, labels, costs and timeline

TISAX has three assessment levels. AL1 is a self-assessment with low trust value and is not used in TISAX. At AL2, the auditor checks your self-assessment and evidence for plausibility, usually remotely. At AL3, the auditor verifies everything thoroughly, including on-site inspection, interviews and observation of processes. The level you need follows from the labels your customer asks for:

Label (assessment objective)	Module	Assessment level
Confidential	Information security	AL2
Strictly confidential	Information security	AL3
High availability	Information security	AL2
Very high availability	Information security	AL3
Proto parts / Proto vehicles	Prototype protection	AL3
Test vehicles / Proto events	Prototype protection	AL2 (since 1 January 2025)
Data	Data protection	AL2
Special data	Data protection	AL3

A higher level automatically covers the lower one. ENX notes in the handbook that the total effort for AL3 is not necessarily higher than for AL2. Because the auditor does not visit you at AL2, your documentation often has to be more precise.

What does TISAX cost?

The cost has three components. All figures are indicative and exclude VAT:

Cost item	Indication	Source / notes
ENX registration	€405 per location per scope, one-off	ENX price list. Volume discount from five locations; no recurring fees while the labels are valid
Assessment AL2	approx. €3,500 – €15,000	Depends on size, locations and provider (Secjur, Docusnap)
Assessment AL3	approx. €6,500 – €35,000 plus travel	Same sources; multiple locations increase the price
Preparation and controls	Varies widely	Internal hours, external support and technical controls (firewall, segmentation, logging). Secjur estimates the full programme for a single-site SME at roughly €28,000 – €51,000.

Timeline: organisations with a working ISMS (for example ISO 27001) are often ready for assessment within a few months. Without an ISMS, six to twelve months is more realistic. You also need to allow for the audit provider's availability and for up to nine months of corrective actions. These are rules of thumb; your starting point sets the pace.

TISAX vs ISO 27001 vs NIS2

Many suppliers have to deal with all three. They overlap a lot, but they are not the same thing:

	TISAX	ISO 27001	NIS2
Nature	Assessment and exchange mechanism for the automotive industry	International, certifiable standard for an ISMS	EU directive, implemented in national law (e.g. Dutch Cyberbeveiligingswet in force since 15 August 2026; German implementation act since 6 December 2025)
Who requires it	OEMs and suppliers in the automotive chain	Customers and tenders across all sectors	The law, for essential and important entities
Criteria	VDA ISA (maturity levels 0–5, target 3), including prototype protection	Clauses 4–10 plus 93 Annex A controls	Risk-management measures (Art. 21) and incident reporting (Art. 23)
Who assesses	ENX-approved audit provider	Accredited certification body	National supervisory authority
Outcome	Labels in the ENX portal, valid for three years	Certificate, valid for three years with annual surveillance audits	No certificate; supervision and enforcement

Manufacture of motor vehicles, trailers and semi-trailers (NACE C29) is listed in Annex II of the NIS2 Directive, so medium-sized and large automotive companies may also be legally in scope. In an analysis published in July 2025, ENX concluded that TISAX based on ISA 6 addresses all relevant NIS2 requirements. National reporting obligations to authorities and CSIRTs still need to be handled separately. For more on combining the frameworks, see ISO 27001 and NIS2 and our NIS2 and compliance support.

Network security requirements in VDA ISA and how to evidence them

This is the core of the article. The table below maps the network-related ISA 6 controls to what an assessor typically wants to see, what Zenarmor contributes technically and what evidence you can present. Zenarmor runs as a next-generation firewall layer on platforms such as OPNsense. Endpoint agents, ZTNA and central management through Zenconsole are optional extensions.

ISA 6 control	What the assessor wants to see	How Zenarmor supports it	Evidence you can show
5.2.7 Network management	Segmentation by protection need (office, production, test/development, guest, IoT); controlled and monitored traffic between zones; detection of lateral movement and data leakage	Policies per interface, VLAN, device, user, group and time schedule; application and security rules between zones; device identification	Network diagram with zone model, exported policy configuration, report of allowed and blocked inter-segment traffic, review record
5.2.3 Malware protection	Protection at the gateway and on endpoints, including encrypted traffic where risk requires it; up-to-date signatures; handling of detections	Security rules (malware, phishing, botnet C&C, newly registered domains), cloud threat intelligence, IPS, TLS inspection with a justified bypass list	Security rule configuration, threat reports, TLS inspection policy with documented exceptions, incident tickets
5.2.4 Log management	Which events are logged, for how long, how logs are protected, and who reviews them regularly	Local reporting (Elasticsearch/SQLite) or cloud reporting with data stored in the Netherlands or Germany; streaming to SIEM/syslog; Zenconsole audit trail of admin changes	Logging concept with retention periods, SIEM dashboards, scheduled reports, minutes of log reviews, audit trail export
5.1.2 Information transfer	Rules for transferring information according to its classification; approved channels only	CASB rules (SSE and higher) that block upload, sharing or download to unapproved cloud services; web categories for file sharing and webmail. Note: no content-aware DLP	"Approved transfer channels" policy, screenshot of CASB rules, report of blocked uploads
2.1.4 Remote work	Secured access outside the office with strong authentication; the same protection level as on site	Endpoint agents (Windows, macOS, Linux, iOS, Android) enforce policy off-site; ZTNA mesh with device posture checks	Remote-work policy, agent rollout report (e.g. via Intune), ZTNA access policy, posture check configuration
4.1.2 Authentication	Secure user access to network services and systems; MFA for critical access; identity-based permissions	User and group policies via Entra ID, Google Workspace, Okta or SAML 2.0, LDAP groups and captive portal; MFA is enforced in your identity provider	Conditional access policy with MFA, user-based Zenarmor policies, per-user reporting
5.3.2 Network services	Defined requirements for network services (availability, security, SLAs); redundancy for critical connections	High availability on OPNsense, central management, configuration backups	Network service requirements document, HA configuration, failover test record, ISP SLA
1.3.3 / 1.3.4 Approved external services and software	Only assessed and approved IT services and software in use; visibility of shadow IT	Application control with a database of 5,000+ applications, reports of cloud apps in use, blocking of unapproved categories	List of approved services, app usage report, blocked-app policy, periodic review

More detail per topic: network segmentation for NIS2 and ISO 27001, logging and reporting as audit evidence, application control and shadow IT, TLS inspection (including GDPR and works council) and CASB against unwanted uploads.

Tools support you, processes earn the score

A common mistake is to think: "We have a next-generation firewall, so 5.2.7 is green." An assessor rates maturity, and level 3 means the process is defined, applied across the organisation and monitored for effectiveness. For network security, that includes:

• an owner for every firewall rule and every zone, with a documented reason;
• changes made through change management and traceable in the audit trail;
• periodic reviews of rules, exceptions (such as the TLS bypass list) and logs, with a written record;
• a clear link to your risk assessment explaining why you chose this segmentation and this retention period.

Zenarmor provides the technical control and the evidence. You define the process around it yourself, with Secrotec's support if you wish.

Prototype protection and OT/production networks

If you handle prototypes, test vehicles or confidential design data, the prototype protection module also applies. It mostly covers physical and organisational security, such as security zones, access control, photography bans and screening. The network still plays a role:

• Separating production and test networks. ISA 6 explicitly mentions separating networks with different purposes, such as test and development networks, office networks and manufacturing networks. A test bench holding CAD data does not belong in the same segment as guest Wi-Fi.
• Device identification. Production networks often contain IoT and OT devices nobody has documented. Zenarmor recognises devices and device categories, so you can apply policies per device type and show an up-to-date inventory.
• Remote access for engineers and machine builders. Replace permanent VPNs and ad-hoc remote desktop tools with identity-based access (ZTNA), MFA through your identity provider, time-based policies and logging of every session.

Be realistic, though. Zenarmor mainly protects the boundary between IT and OT zones. It is not a specialised OT monitoring tool for deep analysis of industrial protocols, so additional tools may be needed for that.

How to prepare: a practical 90-day plan

One important point first. In the Participant Handbook, ENX advises against ordering a "pre-assessment" or "gap analysis" from an audit provider. In almost all cases, ENX says, it makes more sense to start the real assessment straight away. An audit provider that has consulted for you also cannot assess you. Preparation is therefore your own work, possibly with an independent adviser. Our plan is not a shadow assessment. We start from the mandatory self-assessment and work towards controls you can demonstrate.

Secrotec's role: preparation and implementation, not assessment

The official TISAX assessment can only be carried out by an ENX-approved audit provider. Secrotec supports you before and after it:

Secrotec does	Secrotec does not
Gap review of your self-assessment against VDA ISA (see our gap analysis approach)	Carry out the TISAX assessment
Support with the self-assessment and evidence file	Issue or promise TISAX labels
Set up ISMS processes and controls	Run a "pre-assessment" on behalf of an audit provider
Design and implement Zenarmor, configured to produce audit evidence	Guarantee the outcome of the assessment
Independent internal audit and corrective action plan support	Advise and assess at the same time

What sets us apart is that we are both auditor and implementer. As an ISO 27001 Lead Auditor, we know what evidence an assessor looks for. As the official Zenarmor partner in the Netherlands (listed on the Zenarmor partner page), we configure the technology so that this evidence is produced as a matter of course. If you already have an ISMS or a NIS2 programme, we build on it.

Why Zenarmor for TISAX suppliers?

Many automotive suppliers are SMEs with one or a few sites. For them, an enterprise security stack is often overkill in both price and management effort. Zenarmor is a better fit for four reasons:

• Cost-effective. Unified Secure starts at a list price of $5.00 per user per month for 10–49 users (Zenarmor plans, as of October 2026, excl. VAT, subject to change). Through Secrotec you also get a partner discount, and the price is always negotiable in Zenarmor projects. See our price comparison with Fortinet, Sophos and others.
• No hardware lock-in. Zenarmor runs on OPNsense, on existing x86 hardware or as a VM (Proxmox, Hyper-V, VMware). You invest in policy and evidence, not in new boxes.
• EU data residency. Cloud reporting data can be stored in the Netherlands or Germany, which helps with GDPR and with the data protection module.
• One policy for all sites and users. Zenconsole manages gateways, agents and ZTNA centrally, with an audit trail. See our Firewall & Networks services and the overview of SSE, ZTNA and CASB.

Secrotec delivers Zenarmor licences and projects throughout Europe and has satisfied Zenarmor customers across the European Union. Visit the Zenarmor partner page with partner discount or start with a free 15-day trial.