Frameworks
Supply the automotive industry with TISAX assessment results
Supplying German carmakers without a TISAX label keeps you out of tenders and prototype work.
Tidal prepares you for the assessment. Work through the VDA ISA control questions, reach the target maturity level, and keep the evidence ready for your audit provider.
These companies run their compliance on Tidal Control
TISAX in depth
The Information Security module of the VDA ISA asks 45 control questions across policies and organisation, human resources, physical security, identity and access management, IT security and cyber resilience, supplier relationships and compliance. Each question comes with must and should requirements and with additional requirements for high and very high protection needs.
It is common to fill in the ISA workbook once, in the weeks before the assessment. An audit provider then asks for the evidence behind each answer, and a self-assessment that cannot be backed up costs the label.
In Tidal each control question is linked to controls, documents and test results, so every answer in your self-assessment points to evidence that already exists.
How Tidal helps you get certified
Hit the ground running
Start with our pre-built controls, policies, and risk assessment templates.
Our platform guides you through establishing your ISMS scope, identifying assets, and implementing right-sized controls that match your business needs.
Why Tidal Control
We understand your challenges because we've been there. Our team of GRC experts and security professionals built Tidal to solve the real problems compliance teams face every day.
Made in Europe
Built and hosted in Europe. Your compliance data stays in the EU for full control and peace of mind.
Continuous automation
Automated evidence collection from cloud providers and development tools working 24/7 for you.
Real security
Build secure systems that protect your business and satisfy auditors, not just check compliance boxes.
Go beyond TISAX
Explore frameworks that support your automotive security programme.
ISO 27001
Want an internationally recognised certificate as well? The VDA ISA is based on ISO 27001, so the two share most of their evidence.
GDPR
Handling personal data for your customers? The TISAX data protection objective builds on the GDPR obligations.
IEC 62443
Securing production systems? IEC 62443 covers the industrial automation and control systems in your plants.
NIS2
A manufacturer in the EU? NIS2 lists the manufacture of motor vehicles as a sector, so a TISAX programme also supports its duty of care.
Integrate with your existing tools
Testimonials
What our customers say
With a single click, one Tidal test checks dozens of disks for encryption. Doing that manually would take a lot of time.
Frequently asked questions
TISAX (Trusted Information Security Assessment Exchange) is the assessment and exchange mechanism the German automotive industry uses for information security at suppliers and service providers. It is run by the ENX Association on behalf of the German Association of the Automotive Industry (VDA). Assessments are made against the VDA Information Security Assessment (VDA ISA) catalogue, and the results are shared with your customers through the ENX portal.
Tidal holds the Information Security module of the VDA ISA 6.0.3: 45 control questions, each with its objective and its must, should, high and very high requirements. Prototype protection and data protection are separate TISAX assessment objectives and are not included.
TISAX uses assessment levels that decide how thoroughly an audit provider checks your answers. Assessment level 1 is a self-assessment that customers rarely accept. Assessment level 2 is a plausibility check of your self-assessment with evidence and an interview, usually remote. Assessment level 3 is a thorough check, usually on site. Your customer decides which level you need, based on the protection need of the information you handle.
Each control question is rated on a maturity scale from 0 to 5. The target is level 3, established: the process is documented, applied and its effectiveness is checked. Tidal tracks the maturity per control question, so you can see which questions are still below target before the audit provider does.
A TISAX label is valid for three years. During that time your information security has to stay at the assessed level, and a customer can ask for a new assessment when the scope changes. Tidal keeps the controls, tasks and evidence current, so the next assessment starts from records instead of a new project.
The VDA ISA is based on ISO/IEC 27001 and 27002, so a supplier with an ISO 27001 certificate already meets much of it. TISAX adds automotive-specific requirements and the maturity rating, and the two are assessed separately. In Tidal you link the VDA ISA control questions to your ISO 27001 controls, so evidence counts for both.