Glossary term
TISAX
Also: Trusted Information Security Assessment Exchange
Audit standard and exchange platform of the German automotive association (VDA) for information security. ISA catalogue is the assessment grid, ENX operates the platform.
TISAX is mandatory for suppliers processing OEM data (Volkswagen, BMW, Mercedes, Audi, Porsche, Stellantis). Levels: TISAX label high, very high, special requirements (prototype protection, data protection, connectivity).
Validity 3 years. Audits by accredited providers, results exchanged anonymously via the ENX platform. Avoids sending separate audit reports to each customer.
In practice
TISAX is de facto mandatory in German mechanical engineering and automotive. Without a TISAX label, no OEM contract. Initial certification effort typically 6-12 months.
Related terms
ISO 27001
International standard for information security management systems. Current version ISO/IEC 27001:2022. Certifiable through accredited bodies. Core framework for ISMS implementation, risk treatment, continuous improvement.
Supply Chain Risk
Risks from the software and hardware supply chain: compromised open-source packages, build-pipeline attacks, updates with backdoors, sub-suppliers without audit trail. Mandatory under NIS2 Art. 21 (d) and DORA Art. 28 (sub-outsourcing).
TCO modelling
A structured estimate of the full lifetime cost of a vendor decision, including licence, implementation, integration, operation, change management and exit cost. List price is usually 20 to 40 percent of real TCO; modelling exposes the rest.
TIA
Assessment of the protection level in the recipient country for data transfers to third countries after Schrems II. Required under SCC, BCR, and Art. 49 derogations. Output: decision whether the transfer may proceed without, with, or not at all.
TPRM
Discipline and tool category for governing risks from external providers (SaaS, cloud, outsourcing, advisory). Mandatory under DORA Art. 28-30 for financial entities and NIS2 Art. 21 (d) for essential/important entities.
Trade-off analysis
The explicit documentation of what each option gives up to deliver its strengths. Good trade-off analysis makes the cost of the winning option as visible as its benefits, and shows how robust the choice is to changes in weights.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.