Our clients achieve an average TISAX assessment score of 2.96 out of 3

“We have worked with TMW Resilience on several projects, and they consistently offer realistic guidance and advice that translates complex legislation into practical solutions for our organisation.”
Goodman Masson
“At the start of the relationship, they carried out a comprehensive audit of our current systems and then produced a clear, workable plan of action that has enabled us to be assured that our systems and processes are GDPR compliant.”
JCFT Technology
“Two years in, they’re not just a compliance resource, they’re embedded in how we think about growth. That’s made a real difference to how we operate.”
Health Innovation Yorkshire Humber

Our Services

Applicability

For organisations unsure whether TISAX applies or what level is needed. This 3 to 5 day service provides clarity on TISAX applicability and level as well as preparation advice.

Readiness

Readiness supports organisations that know TISAX applies but haven’t started implementation. This 12 to 15 day service provides a gap analysis to determine current position and support with scoping and prioritising.

Pre-Audit

For those preparing for TISAX assessment who want confidence before the official audit. This 15 to 20 day service provides a review of controls and validates completeness.

Internal Audit

A comprehensive internal audit that mirrors the official TISAX assessment. This service offering assurance, support, and clear corrective actions ahead of an official audit.

Consultancy & project management

Full TISAX delivery support. This service involves our project managers and specialists working alongside your team from certification start to finish.

Led from inside the programme, not just advised on it

We score you the way your auditor will. TMW’s TISAX practice is led by practitioners who have held in-house TISAX Certification Lead roles at both a frontier AI autonomous driving developer and a major European engineering and construction consultancy serving automotive and industrial clients. We are currently supporting a global vehicle logistics operator through a Shared Group Assessment at Assessment Level 3 across its OEM data-processing sites.

Our team has defined ISMS scopes, completed VDA ISA self-assessments, and been on the receiving end of ENX-accredited assessments. That experience shapes how we deliver engagements. We understand where scope definition quietly expands, which controls assessors examine most closely, and the practical realities of assessment scheduling and evidence collection.

Got a TISAX question? Drop in and ask us.

Whether you’re just starting out or already preparing for assessment, our free TISAX Support Drop-In gives you direct access to a TISAX specialist. No obligation. No presentation.

TISAX compliance your way

To find out more about the range of services we provide to support TISAX compliance, please download a copy of our TISAX brochure.

TISAX support from applicability to pre-audit

TISAX, introduced by German automotive manufacturers, is fast becoming the cybersecurity standard across the manufacturing and engineering supply chain. For organisations handling OEM data, certification is increasingly a commercial necessity to retain and win business.

TMW’s expert services cover the full TISAX certification process, from assessing whether TISAX is applicable through to  full delivery support, depending on your organisation’s specific needs.

Proven results

Average client TISAX certification score of
2.96 out of 3

Trusted partnerships

Strong relationships with leading TISAX certification bodies, for a streamlined process from preparation to approval.

Deep insight

Experienced consultants who understand the scope & strategy complexities of TISAX for maximum chance of certification success.

End to end expertise

Experience across both AL2 and AL3, with projects covering green-field site to AL3 certification.

Flexible delivery

Tailored services from assessment to full project delivery to match your specific requirements.

TISAX support from applicability to pre-audit

TISAX, introduced by German automotive manufacturers, is fast becoming the cybersecurity standard across the manufacturing and engineering supply chain. For organisations handling OEM data, certification is increasingly a commercial necessity to retain and win business.

TMW’s expert services cover the full TISAX certification process, from assessing whether TISAX is applicable through to  full delivery support, depending on your organisation’s specific needs.

Proven results

Average client TISAX certification score of
2.96 out of 3

Trusted partnerships

Strong relationships with leading TISAX certification bodies, for a streamlined process from preparation to approval.

Deep insight

Experienced consultants who understand the scope & strategy complexities of TISAX for maximum chance of certification success.

End to end expertise

Experience across both AL2 and AL3, with projects covering green-field site to AL3 certification.

Flexible delivery

Tailored services from assessment to full project delivery to match your specific requirements.

Frequently Asked Questions

Realistically, three to six months from kick-off to receiving your label. The timeline depends on your current ISMS maturity, the assessment level your OEM requires and audit provider availability — which can be constrained, particularly for AL3. If you already hold ISO 27001, you are likely further along than you think and the timeline can compress. We recommend starting immediately rather than waiting — OEM deadlines are firm and audit slots fill up.

Significantly less than starting from scratch. Approximately 90% of TISAX controls map to ISO 27001’s Annex A. The gap typically sits in automotive-specific areas: prototype protection procedures, handling of vehicle and component data, and connected vehicle security requirements. We conduct a focused gap assessment against the VDA ISA catalogue to identify exactly what additional work is needed, so you are not re-doing controls you already have in place.

Your OEM partner will specify this in their supplier requirements. AL2 is a remote documentation-based audit covering most standard supplier relationships involving confidential business data. AL3 requires a full on-site audit and is required where you handle highly sensitive data — prototype vehicles, safety-critical components or vehicle-level testing data. If you are unsure what level applies to you, we can review your OEM’s requirements and advise.

They address different but overlapping concerns. UNECE R155 is a mandatory legal requirement for vehicle type approval in the EU and UK, requiring OEMs to manage cybersecurity risk across their supply chain — including through ISO/SAE 21434-aligned engineering practices. TISAX addresses the information security dimension of supply chain compliance. For suppliers to OEMs operating under R155, both TISAX and ISO/SAE 21434- aligned practices are increasingly expected. We help you understand where your obligations sit across all three and avoid duplicating effort.

TISAX labels are valid for three years and renewal requires a new assessment — there is no automatic extension. The process mirrors the original certification but typically runs faster if your ISMS has been maintained. We recommend starting at least four months before expiry to avoid any gap in your label status, which could affect your ability to retain or bid for OEM contracts.

No. TISAX applies globally to any organisation in the automotive supply chain and the assessment process, audit providers and the ENX exchange platform are all internationally accessible. Being UK-based creates no additional barriers. We regularly support UK suppliers assessed against German, US and Japanese OEM requirements.

Manufacturers are requiring a TISAX label from their suppliers

“In line with the principle of ‘Together we protect Porsche’, Porsche AG leads by example: TISAX certification is required of Porsche subsidiaries and all suppliers involved in critical business processes.”

Book your 30-minute scoping call

You’ll leave knowing which assessment level you need, a realistic timeline against your OEM deadline, and roughly where you stand today. No obligation, and we’ll tell you if you don’t need us.