NIS2 and TISAX: Why ISO 27001 Should Come First

Paula’s Parts Plant makes parts for car manufacturers and runs a plant in Poland. A German automaker wants to buy what they’re selling.

But first, there are some hoops to jump through. The automaker’s procurement team sends a questionnaire asking for their TISAX (Trusted Information Security Assessment Exchange) label. At the same time, their lawyer asks whether NIS2 (the second Network and Information Security Directive), the European Union’s newer cybersecurity law, applies to their EU operations.

Yikes. Which of these two requirements do they need to handle first? How much will be the cost to secure either one of them?

If you’re in Paula’s shoes, you’re probably asking the same questions.

This time, there is a right answer:. If you don’t have ISO 27001 yet, start there. ISO 27001 is the international standard for running an information security management system (ISMS), and both TISAX and NIS2 build on the same foundation.

If you already have ISO 27001, you’ve got a strong foundation. From there, it’s a matter of adding the specific processes required for TISAX and NIS2, and we’ll guide you through what needs to be added in this article.

Let’s take a look at what NIS2 and TISAX are, how they compare, and how to plan the work without building three separate security programs.

What Are NIS2 and TISAX?

NIS2 is a European Union (EU) law. TISAX is a security assessment that automotive customers ask their suppliers to pass. So when a customer asks for “proof,” you can’t just hand over a certificate.

What is TISAX?

TISAX (Trusted Information Security Assessment Exchange) is the automotive industry’s shared security assessment. Think of it as a background check that automakers agreed to share. Instead of every customer auditing you separately, an approved audit provider assesses you once. If you pass, you receive a TISAX label that stays valid for three years. 

Two organizations handles TISAX:

1. The German Association of the Automotive Industry (VDA) writes the requirements, which they compile in a catalogue called the VDA ISA (Information Security Assessment). This document spells out the detailed list of security questions every supplier is assessed against.
2. The European Network Exchange (ENX) Association runs the TISAX program. It’s a non-profit group of automakers, suppliers, and national automotive associations. It approves the audit providers and runs the online portal where you register and share your results. (ENX also operates a private data network for the car industry and a vehicle cybersecurity certification.)

In other words, the VDA writes the exam and ENX runs the testing center.

TISAX matches the depth of the audit to how sensitive your work is. Most suppliers go through an assessment level 2 (AL2) review, where an auditor checks your documentation and interviews the people who run your security processes.

Prototypes require a more stringent security evaluation process. To an automaker, an unreleased vehicle is one of its most guarded secrets, and one leaked photo of next year’s model can undo years of careful planning. So if you handle prototype parts or vehicles, TISAX requires assessment level 3 (AL3), its most demanding review. The auditor visits your site in person, watches your processes as they actually run, and can pull employees aside for interviews without advance notice.

An ideal prototype environment must have restricted areas with controlled access and camera surveillance. Test vehicles wrapped in camouflage, parked in secured areas, and covered by a strict no-photography rule. Even trade shows and photo shoots come with their own rules for keeping prototypes under wraps.

What is NIS2?

NIS2 (the second Network and Information Security Directive) is EU Directive 2022/2555. It sets minimum cybersecurity rules for medium-sized and larger organizations in sectors the EU considers critical, such as energy, transport, health, digital infrastructure, and parts of manufacturing.

Each EU member state wrote NIS2 into its own national law, so national authorities handle enforcement and the details vary a little from country to country. If your organization falls within scope, compliance isn’t optional. Here’s what’s at stake:

• Fines. The EU sets a floor for how high fines can go. Essential entities, such as energy and healthcare providers, face maximum fines of at least €10 million or 2% of worldwide annual revenue, whichever is higher. Important entities, which can include manufacturers, face at least €7 million or 1.4%.
• Personal accountability for leaders. Your management team must approve your cybersecurity measures, oversee them, and take cybersecurity training. Leaders can be held liable when the company falls short. For essential entities, authorities can even temporarily bar a responsible executive from a management role.
• Hands-on supervision. Authorities can inspect your company, order security audits, set deadlines to fix specific problems, require you to notify affected customers, and publicly name your company.
• Business fallout. Companies covered by NIS2 must vet their suppliers’ security, so falling short can cost you contracts. A badly handled incident also damages customer trust, which takes far longer to rebuild than a fix takes to put in place.

Where does ISO 27001 fit?

ISO 27001 is an international standard for building and running a security program, which includes the policies, risk decisions, controls, and reviews. Unlike TISAX and NIS2, it’s industry-neutral, and an accredited certification body can certify you against it. (New to the standard? Start with our guide to ISO 27001 basics.)

Both TISAX and NIS2 borrow heavily from ISO 27001. The security practices required for both frameworks have similarities to the ones covered already by ISO 27001.

For instance, the VDA ISA catalogue that TISAX auditors work from is built around ISO 27001’s controls. NIS2 is less direct, but it encourages organizations to use European and international standards to meet its requirements. ENISA (the European Union Agency for Cybersecurity) has even published guidance that maps NIS2’s security measures to ISO 27001.

Think of ISO 27001 as the foundation of a house. TISAX adds a room built to the automotive industry’s specifications, with features like prototype protection. NIS2 adds legal paperwork: registering with the government, reporting incidents on a deadline, and putting leadership on the hook. 

So if you’re starting from scratch, ISO 27001 gives you a working security program you can show to almost any customer and sets you up for success for NIS2, TISAX, or any other GRC requirement in your future. 

Now let’s compare NIS2 and TISAX to each other.

How Are NIS2 and TISAX Similar and Different?

NIS2 and TISAX share a foundation but do different jobs. TISAX proves to automotive customers that you can protect their information. Complying with NIS2 shows EU regulators that you can protect services the public depends on.

Here’s what they have in common:

• Both are risk-based. Neither hands you a fixed checklist. Each expects you to understand your own risks and pick controls that fit them.
• Both lean on ISO 27001. The VDA ISA catalogue is built around ISO 27001 controls, and NIS2 encourages organizations to use European and international standards to meet its requirements.
• Both cover the same core security measures. NIS2’s Article 21 lists the security basics every covered company needs, such as risk analysis, incident handling, and supply chain security. In April 2025, ENX published an expert opinion saying a TISAX assessment already covers all of them. If you’re an automotive supplier with a TISAX label, that’s a nice head start. Just remember who’s grading the homework: the opinion comes from ENX, the group that runs TISAX. And even ENX doesn’t claim TISAX handles NIS2’s legal duties, so registering with the government and reporting incidents on deadline are still on you.

And here’s where they split:

	TISAX	NIS2
What it is	An industry assessment	An EU law
Who asks for it	Automotive manufacturers and their suppliers	National governments in the EU
Is it required?	When a customer’s contract requires it	When your organization falls in scope
Who checks	An ENX-approved audit provider	Your national cybersecurity authority
What you get	A label you share through the ENX portal	No certificate; you’re either compliant or you’re not
How long it lasts	Three years, then you’re re-assessed	Ongoing
What happens if you fall short	Customers may decline to work with you	Maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities (€7 million or 1.4% for important entities), whichever is higher

So which one should you tackle first? For most companies, neither.

Don’t Have ISO 27001 Yet? Start There.

In our experience, ISO 27001 is the best first move for most companies facing TISAX or NIS2. One certificate works in any industry and any country, and both TISAX and NIS2 build on the same management system it requires.

ISO 27001 asks you to build the parts of a security program that TISAX and NIS2 assume you already have:

• A defined scope. You decide and document which parts of the business your security program covers.
• A risk assessment and treatment plan. You identify what could go wrong and decide how to handle each risk, which is the heart of cyber risk management.
• A Statement of Applicability (SoA). This document lists all 93 controls in ISO 27001’s Annex A and explains which ones you use and why.
• Internal audits and management reviews. You check your own program on a schedule, and leadership reviews the results.

With those pieces in place, TISAX and NIS2 become a matter of filling specific gaps. Your ISO 27001 certificate lasts three years, with a yearly check-in audit to confirm you’re still following your own rules.

(For a deeper walkthrough) Read our guide to ISO 27001 ISMS requirements.

How long does ISO 27001 take?

Getting ISO 27001 certified from scratch, with minimal existing security or compliance program, typically takes a year.

That timeline surprises many business leaders, so it helps to know where the time goes. You have to write or update your policies and run a risk assessment. Then you put the controls in place and operate them long enough to produce real evidence that they work. After that comes an internal audit and a management review, and finally a two-stage certification audit: the auditor first reviews your documentation, then checks that your controls work in practice. Most of these steps depend on the one before, so they’re hard to rush.

If you already have a strong SOC 2 (System and Organization Controls 2) program, you can often get certified in 6 months, because much of that groundwork already exists. The key word is strong. A check-box SOC 2 program, where you comply on paper but your controls are mediocre, won’t cut it for ISO 27001. (For more on how the two compare, read SOC 2 vs ISO 27001.)

How much does ISO 27001 cost?

This one falls into the “it depends” zone. Costs vary widely, and any single number we gave you would be wrong for most readers. Here’s what drives the price:

• Your company’s size. More people, locations, and systems mean more to secure and more to audit.
• The scope of your ISMS. Covering one product line costs less than covering the whole organization.
• How mature your current program is. A company with documented policies and working controls has far less to build than one starting from zero.
• The auditor you choose. Certification bodies price their audits differently, and the cheapest audit is rarely the most useful one.

Instead of quoting a number that won’t fit your situation, we’d rather scope it with you. If you’d like a sense of how we structure our engagements, take a look at our pricing and packages.

What if your customer says they only want TISAX

Our advice is: still get ISO 27001 first, and work on TISAX in conjunction. Work with your customer to make sure that’s acceptable. Most of the time these compliance terms are negotiable as long as your customer expects you are putting a good-faith effort to get it soon and do a good job.

Already ISO 27001 Certified? What Do You Add for TISAX?

If you hold ISO 27001, you already have the core of what TISAX checks. Some of your existing work even counts twice: TISAX requires someone independent to review your ISMS regularly, and a well-run ISO 27001 internal audit program usually covers that, as long as the auditor isn’t also running the program.

The remaining work falls into four areas: registration, maturity, scope, and the automotive-specific modules.

How do you register and pick an assessment level?

Your customer decides your assessment level. The level depends on how sensitive the information or parts you’ll handle for them are, so ask your customer which TISAX label they need before you book anything.

From there, you register on the ENX portal, choose an approved audit provider, and select the assessment objectives that match your customer’s request. Those objectives set two things:

• What you have to meet. Objectives for more sensitive information add requirements on top of the baseline. Protecting “very high” sensitivity data or prototypes, for example, means stricter controls than routine business information does.
• How the auditor checks it. At assessment level 2 (AL2), the auditor reviews your documents and evidence and interviews the people who run your security processes. At assessment level 3 (AL3), the auditor also comes to your site, watches your processes in action, and can interview employees without advance notice.

Do your controls reach maturity level 3?

ISO 27001 and TISAX ask slightly different questions. An ISO 27001 auditor wants to know whether you do something. A TISAX auditor wants to know how well established it is, and scores each requirement on a maturity scale from 0 to 5:

Level	Name	What it means
0	Incomplete	The process doesn’t exist, or it doesn’t do its job.
1	Performed	The process works, but it isn’t fully documented, so results depend on who happens to be doing it.
2	Managed	The process is documented and controlled, and you can show evidence that it runs.
3	Established	The process is a standard part of how you operate. It connects to related processes, and its documentation stays current.
4	Predictable	You measure the process, for example with KPIs (key performance indicators), so its results are consistent and predictable.
5	Optimizing	You invest people and budget in improving the process continuously.

Most requirements need at least a 3, and a few critical ones call for a 4.

Picture a control that works because one dedicated employee remembers to do it every month. An ISO 27001 auditor might accept it. A TISAX auditor will likely score it a 1, because nothing is written down to keep it running if that employee leaves.

Does your ISO 27001 scope match TISAX?

With ISO 27001, you choose your own scope. Some companies start narrow, covering one office or one product line. TISAX doesn’t give you that choice. It uses a standardized assessment scope that covers every location, system, and team that handles your customer’s information.

If the two don’t line up, you have extra work ahead. Say your ISO 27001 scope covers your headquarters, but the automaker’s design files will live at your plant in Poland. Before your TISAX assessment, that plant needs the same controls, documented processes, trained staff, and evidence your headquarters already has. Pulling a whole site into scope is a project in its own right.

Compare your ISO 27001 scope with what TISAX will cover as soon as your customer asks for a label. If the gap is big, you should widen your ISO 27001 scope at your next audit, so you don’t end up duplicating GRC work.

Do you handle prototypes?

This is where TISAX goes well beyond ISO 27001. If you handle unreleased parts, vehicles, or design data for an automaker, TISAX expects you to protect them physically and digitally. That covers secure areas for prototype parts, classification of design files such as CAD (computer-aided design) drawings, and rules for test drives, camouflage, and transport. ISO 27001 has almost no equivalent.

Do you process personal data for customers?

Privacy and security overlap, but they aren’t the same thing. Security protects data from people who shouldn’t have it. Privacy governs how you collect, use, share, and delete personal data, even when everyone handling it is authorized.

ISO 27001 covers security well, but it says much less about privacy. That gap matters if you process personal data on a customer’s behalf, such as employee records or customer contact lists.

TISAX handles this through a separate data protection module. The module doesn’t certify that your company complies with the General Data Protection Regulation (GDPR), the EU’s main privacy law. It checks a narrower set of privacy controls built around your role as a processor under GDPR Article 28, meaning a company that handles personal data on someone else’s instructions.

Expect the auditor to look for privacy practices such as:

• A data protection officer or equivalent role, with clear responsibilities.
• A record of the processing you do for your customer.
• Signed data processing agreements, with the same obligations passed down to your own subcontractors.
• A process for helping your customer answer requests from people whose data you hold.
• A process for notifying your customer quickly if their personal data is involved in an incident.
• Rules for transferring data outside the EU.

If you handle sensitive categories of personal data, such as health information, the module applies at assessment level 3, with an on-site review. Many of these controls go beyond what ISO 27001 asks for, so budget additional time for them.

TISAX is about what your customers expect. NIS2 is about what the law requires, which changes the to-do list.

Already ISO 27001 Certified? What Do You Add for NIS2?

Your ISO 27001 controls cover most of NIS2’s security measures. What ISO 27001 doesn’t cover are NIS2’s legal duties: registering with the government, reporting incidents on a deadline, and holding leadership personally accountable.

Are you in scope, and have you registered?

Start by checking your country’s national NIS2 law, since each member state wrote its own version. If you’re in scope, you must register with your national authority and share details such as your sector, contact information, and the EU countries where you operate. If any of those details change, NIS2 gives you two weeks to report the update.

Can you report an incident within 24 hours?

ISO 27001 requires you to handle incidents. NIS2 also puts you on a clock, but only for significant incidents. An incident counts as significant if it causes, or could cause, severe disruption to your services or financial loss for your company. It also counts if it causes, or could cause, considerable damage to other people or organizations.

A ransomware attack that halts production at your plant would likely qualify. A phishing email that an employee reported and deleted would not.

You report to your country’s computer security incident response team (CSIRT) or national cybersecurity authority. Each country sets its own channel, and many use an online portal. Germany, for example, uses a single portal run by its Federal Office for Information Security (BSI) for both NIS2 registration and incident reports.

Each incident requires three separate, time-bound reports:

1. An early warning within 24 hours of becoming aware of the incident. It flags whether the incident looks like a deliberate attack and whether it could affect other EU countries.
2. An incident notification within 72 hours. It updates the early warning with an initial assessment of how severe the incident is and its impact, plus any technical clues about the attacker where available.
3. A final report within one month of that notification. It covers what happened, the likely root cause, what you did to fix it, and any cross-border impact. If you’re still dealing with the incident at that point, you file a progress report instead, then send the final report once it’s resolved.

Authorities can also ask for interim updates along the way. And if an incident is likely to hurt the people or companies you serve, you may need to tell them too.

Twenty-four hours goes fast, especially on a weekend. Decide in advance who makes the call that an incident is significant, and set up access to your country’s reporting channel before you need it. Germany’s portal, for example, requires a certificate that can take two to three weeks to arrive. Then build reporting templates into your incident response plan, and practice the whole process in a tabletop exercise.

Is leadership on the record?

NIS2 requires your management body to approve your cybersecurity measures and oversee how they’re carried out. Leaders must also take cybersecurity training, and they can be held liable when the organization falls short.

ISO 27001 already asks leadership to commit to the security program, so you have a head start. For NIS2, make that commitment visible: document the approvals, schedule the training, and keep records of both.

What does Article 21 require?

Article 21 is the heart of NIS2’s security requirements. It tells covered organizations to take “appropriate and proportionate” steps to manage their cybersecurity risks. The security measures should fit your size, your risks, and what it would cost to fix them. A 300-person parts maker isn’t expected to run the same program as a national power company.

The article then lists ten areas every program has to cover. Here’s what each one means, and where ISO 27001 already has you covered:

Article 21 measure	What it means	ISO 27001 match
Risk analysis & security policies	Know what could go wrong & write down how you protect against it	Yes, core requirement
Incident handling	Have a plan for spotting, responding to, and recovering from attacks	Yes
Business continuity	Keep running during a crisis, with tested backups and disaster recovery	Yes
Supply chain security	Check the security of your direct supplies and service providers	Yes
Secure buying, building, and manufacturing of systems	Choose, build, and patch systems securely, and handle reported vulnerabilities	Yes
Checking that your measures work	Have rules for when and how you encrypt data	Yes, through internal audits and management reviews
Basic cyber hygiene and training	Cover the fundamentals and train your employees	Yes
Cryptography and encryption	Have rules for when and how you encrypt data	Yes
Staff security, access control, and asset management	Vet people, limit who can access what, and track your equipment and data	Yes
Multi-factor authentication and secure communications	Require more than a password to log in, and protect calls, messages, and emergency channels	Yes

Do your controls meet Article 21?

Give supply chain security a close look first. NIS2 expects you to manage the security of your direct suppliers and service providers, so review your vendor risk management process: which vendors are critical, how you assess them, and what your contracts require of them. While you’re at it, confirm you use multi-factor authentication everywhere it belongs, since Article 21 names it directly.

For the other measures, ENISA’s June 2025 mapping between NIS2 and ISO 27001 is a useful shortcut. ENISA itself warns that the mapping “should not be interpreted as a measure of equivalency,” so a matching control name won’t prove compliance on its own. Go through each Article 21 measure, find the control that covers it, and confirm the control works the way NIS2 expects.

Skip this step and the fines in the comparison table can apply to you. Closing the gaps usually means adjusting a program you already run, so the work is focused and finite.

How Do You Plan the Work?

The smartest plan treats TISAX and NIS2 as add-ons to one security program, not as separate projects. Here’s how we’d approach it:

1. Run a gap assessment. Compare your ISO 27001 program against the VDA ISA catalogue, NIS2’s Article 21, or both. List every requirement you don’t yet meet.
2. Keep one set of controls. Map each control to every framework it supports, so one access review, for example, produces evidence for ISO 27001, TISAX, and NIS2 at the same time.
3. Add the missing processes. Work through the TISAX and NIS2 additions above, starting with whatever your customer or regulator needs soonest.
4. Put every deadline on one calendar. Track your annual ISO 27001 surveillance audit, your three-year TISAX reassessment, and your NIS2 reporting and registration duties in one place.

Let’s see how that plays out for Paula’s Parts Plant.

Paula’s Parts Plant has about 300 employees, and Paula’s team earned ISO 27001 certification two years ago. Along with the automaker’s TISAX request, Paula’s lawyer confirmed that the company falls under NIS2 in Poland, where its plant operates.

Instead of starting separate TISAX and NIS2 projects, Paula’s team runs one gap assessment against its existing ISO 27001 program.

For TISAX, they register on the portal run by ENX (the automotive industry association that manages TISAX), raise a few controls to maturity level 3, and add prototype protection for the design files the automaker will share.

For NIS2, they register with Poland’s national authority, write an incident reporting playbook covering the 24-hour early warning, 72-hour incident notification, and one-month final report, and get the board’s approval and training on record. The internal audit program they already run for ISO 27001 now checks the TISAX and NIS2 additions too.

The automaker’s procurement questionnaire is no longer a headache. Paula fills in the TISAX line with a label instead of a blank. Her lawyer gets a clear answer about NIS2. And her team has built one security program instead of three.

You can get to the same place. If you don’t have ISO 27001 yet, start there, unless an automotive customer’s TISAX deadline forces your hand. If you already have it, add the specific TISAX and NIS2 processes on top. Either way, you’re building on the same foundation.

This is where organizations such as Fractional CISO can help. Our Virtual CISO Services help companies plan and run ISO 27001 programs, then extend them to meet TISAX and NIS2 requirements. Learn more about our ISO 27001 certification services.

---

Want to get great cybersecurity content delivered to your inbox? Click here to sign up for our monthly newsletter, Tales from the Click.

---

Acronyms Used in this Blog:

AL (assessment level): How thoroughly a TISAX auditor checks your company. AL2 involves a document review and interviews; AL3 adds an on-site visit.

BSI (Bundesamt für Sicherheit in der Informationstechnik): Germany’s Federal Office for Information Security, the country’s national cybersecurity authority.

CAD (computer-aided design): Software used to create technical drawings and 3D models, such as car part designs.

CISO (chief information security officer): The executive responsible for a company’s security program.

CSIRT (computer security incident response team): A national team that receives and responds to cybersecurity incident reports.

ENISA (European Union Agency for Cybersecurity): The EU agency that supports cybersecurity across member states.

ENX (European Network Exchange): The original name behind the ENX Association, the non-profit automotive group that runs TISAX.

EU (European Union): The political and economic union of 27 European countries.

GDPR (General Data Protection Regulation): The EU’s main privacy law.

IEC (International Electrotechnical Commission): An international standards body that publishes ISO 27001 jointly with ISO.

ISA (Information Security Assessment): The catalogue of security requirements behind TISAX, published by the VDA.

ISMS (information security management system): A company’s overall approach to managing security: its policies, risk decisions, controls, and reviews.

ISO (International Organization for Standardization): The international standards body that publishes ISO 27001 jointly with the IEC.

KPI (key performance indicator): A measurable value that shows how well a process is working.

NIS2 (second Network and Information Security Directive): The EU cybersecurity law that sets minimum security rules for organizations in critical sectors.

SoA (Statement of Applicability): An ISO 27001 document listing which security controls your company uses and why.

SOC 2 (System and Organization Controls 2): A security audit framework that reports on how a company protects customer data.

TISAX (Trusted Information Security Assessment Exchange): The automotive industry’s shared security assessment.

VDA (Verband der Automobilindustrie): The German Association of the Automotive Industry, which writes the security requirements behind TISAX.

vCISO (virtual chief information security officer): An experienced CISO who works with a company part-time instead of as a full-time employee.

---

What Do People Ask Most About NIS2, TISAX, and ISO 27001?