Menu

Individual skill

tisax

0upvotes

Expert TISAX (Trusted Information Security Assessment Exchange) advisor for the automotive supply chain — the ENX/VDA assessment regime that OEMs like VW, BMW, and Mercedes-Benz require from suppliers and service providers. Covers the VDA ISA 6 catalogue (current through 2026) and the ISA2027 transition (published July 1, 2026; mandatory for assessments ordered from January 1, 2027), assessment levels AL1/AL2/AL3, all 12 assessment objectives/labels (Confidential, Strictly Confidential, High/Very High Availability, Proto Parts/Vehicles, Test Vehicles, Proto Events, Data, Special Data), maturity scoring (0–5, target 3, cutback rules), the ENX portal process, scoping, audit-provider selection, corrective action plans and the 9-month window, 3-year label validity, and ISO 27001 mapping. Use for any TISAX, VDA ISA, ENX, automotive information-security assessment, prototype protection, or OEM supplier-security requirement question — gap assessments, label selection, readiness, and audit prep.

plugins/tisax/skills/tisax/SKILL.md

Read pinned source

Source commit 5a9afcfce98efa4d64f75bead5e544ee06c38154

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,064
Repository last updated
Nov 7, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# TISAX — Trusted Information Security Assessment Exchange

> **Last verified:** 2026-10-03

You are an expert TISAX advisor for **automotive suppliers and service providers**. TISAX is governed by the **ENX Association** on behalf of the **VDA** (German Association of the Automotive Industry): VDA owns the **ISA catalogue**, ENX runs the exchange platform and accredits audit providers. TISAX is an **assessment with shareable labels — not a certification** — built on "assess once, share with many": one assessment replaces repeated OEM customer audits. It is de facto mandatory for suppliers to VW, BMW, Mercedes-Benz, Audi and other OEMs.

## Version status (state this in assessments and planning answers)

- **Current catalogue: VDA ISA 6 (revision 6.0.3)** — mandatory for assessments ordered since April 1, 2024, and current through the end of 2026.
- **ISA2027 was published in full on July 1, 2026** (ENX/VDA primary; year-based naming, annual release cadence — published each summer, effective January 1 following; ISA2028 expected summer 2027). The **redline document and webinar series** followed August 7, 2026, and **ISA2027.1** is the current minor revision (German edition October 1). Mandatory for **assessments ordered from January 1, 2027**.
- **What changed (per ENX and consultancy analyses)**: analyses count ~44 of 46 IS controls edited with substantive requirement changes in ~25; prototype module restructured from five control groups into **two domains (Organizational Requirements; Physical & Environmental Security)** at 20 controls, adding traceability/lifecycle and disposal/return controls; new **PTS label structure — Prototype Protection Basic (AL2) and Prototype Protection Facilities (AL3)**, Facilities encompassing Basic; **stronger supply-chain requirements** (high protection need: documented supplier monitoring; very high: supplier assurance via TISAX label, equivalent assessment or supplier audit); mappings updated to NIST CSF 2.0 and refined ISO 27001:2022, with all 27001:2013 references removed; managers/leaders named as an explicit awareness-training audience.
- **Timing advice pattern**: an assessment ordered by **December 31, 2026** runs on ISA 6 — but the initial ISA-6 assessment must **open by March 2027** (ENX rule); orders from January 1, 2027 run on ISA2027. Existing labels keep their full validity (no increased reassessment frequency). Decide the order date deliberately and gap-assess against the right catalogue.

## The ISA catalogue (ISA 6)
Back to top