Cyberattacks, confidential customer information, and growing demands from business partners make information security a critical corporate priority. In this context, companies frequently encounter three terms: TISAX, ISO 27001, and NIS2.
All three pertain to the protection of information and the resilience of organizations. However, they differ in their objectives, binding nature, and type of evidence required. Understanding these differences allows organizations to assess requirements in a targeted manner and effectively combine measures.
As of October 13, 2026
ISO 27001: Systematically Organizing Information Security
The international standard ISO/IEC 27001 outlines requirements for an information security management system (ISMS). It helps organizations systematically identify risks to their information, establish appropriate protective measures, and regularly review their effectiveness.
This involves confidentiality, integrity, and availability: information should be accessible only to authorized individuals, protected against unauthorized modifications, and available when needed.
An ISMS combines technical measures with organizational processes and clear responsibilities. Companies of various sizes and across different industries can use the standard and have their management system audited by an independent certification body.
Certification always applies to a defined scope. Therefore, business partners should carefully examine which locations, services, and processes are actually covered.
TISAX: Demonstrating Information Security in the Automotive Industry
TISAX stands for “Trusted Information Security Assessment Exchange.” It is an assessment and exchange process used primarily in the automotive industry. It is based on the Information Security Assessment Catalog, known as VDA ISA.
TISAX applies, for example, to suppliers and service providers who work with confidential development documents, production information, or prototypes. Which requirements are relevant depends, among other things, on the agreed-upon audit objectives and the level of protection required.
In the process, the company defines the scope of the audit and has itself assessed by an accredited audit service provider. The results can then be shared with selected business partners via the ENX portal.
Unlike ISO 27001 certification, TISAX awards corresponding labels. TISAX is not a general legal requirement, but it can be a contractual prerequisite for collaborating with customers.
NIS2: Legal Requirements for Cybersecurity
NIS2 is a European directive aimed at strengthening cybersecurity. In Germany, the implementing law entered into force on December 6, 2025.
Companies within its scope are subject to legal obligations. These include, in particular, risk management measures, registration with the Federal Office for Information Security, and the reporting of significant security incidents.
Whether a company is affected must be determined based on its specific activities, size, and any special regulations that may apply. A blanket classification based solely on industry or number of employees is not always sufficient for this purpose.
Senior management also has a role to play: It must ensure and monitor the implementation of the required risk management measures. In addition, there are training requirements.
How do TISAX, ISO 27001, and NIS2 differ?
ISO 27001 provides a cross-industry framework for information security management. Certification is generally voluntary but may be required by customers or as part of a bidding process.
TISAX is primarily aimed at companies within the automotive supply chain. The focus is on industry-specific requirements and the ability to share audited results with business partners.
NIS2, on the other hand, establishes legal obligations for entities subject to the respective national regulations. Compliance with the prescribed requirements is crucial here. There is no provision for a general “NIS2 certification” that would replace all legal obligations.
Several of these requirements may be relevant to a company at the same time—for example, due to its business activities, its customer relationships, and its legal classification.
Does ISO 27001 certification replace NIS2 obligations?
An established ISMS can serve as a solid foundation for implementing NIS2 requirements. Risk assessments, responsibilities, emergency planning, and regular audits can be leveraged for this purpose.
However, ISO 27001 certification or a TISAX label does not automatically demonstrate full compliance with all NIS 2 obligations. Companies must also verify whether, for example, the statutory registration and reporting obligations, as well as the requirements for senior management, are covered.
The scope is also crucial: A certified sub-area does not necessarily correspond to the entire legally relevant area of the company.
Security incidents require clear reporting channels
For significant security incidents, the NIS2 framework provides for a tiered reporting procedure. This generally includes an initial report within 24 hours and a follow-up report within 72 hours of becoming aware of the incident.
Companies should therefore clarify before an incident occurs who will assess reports, prepare decisions, and submit reports. Proxy arrangements and accessible points of contact are just as important as technical detection capabilities.
If an incident also involves personal data, potential reporting obligations under the GDPR must also be reviewed. The various reporting procedures should be incorporated into a unified emergency response process.
Make Effective Use of Joint Measures
Our recommendation: Address these requirements through a coordinated security management framework. Many foundational elements can be used for multiple purposes.
This begins with a risk assessment: Which information and business processes are particularly vulnerable? Next, responsibilities are defined, access rights are regulated, and appropriate protective measures are implemented.
Equally important are the vetting of service providers, effective emergency planning, and regular employee awareness training. Audits and drills help evaluate the effectiveness of the measures and document improvements in a traceable manner.
A joint action plan reduces duplication of effort while taking into account the specific characteristics of individual requirements.
Here’s how companies can get started in a structured way
The first step should be to review legal and contractual requirements. Is the company subject to NIS2? Do customers require TISAX certification? Is ISO 27001 certification advisable for certain services, or has it already been agreed upon?
This is followed by an assessment of the current state: What security measures, documents, and responsibilities are already in place? Where is evidence missing, or where are processes not functioning properly?
This analysis leads to a concrete implementation plan with priorities, designated responsible parties, and realistic deadlines. Existing data protection processes can be integrated into this plan, such as those related to service provider management or incident response.
Support for Information Security and Compliance
Would you like to know which requirements from TISAX, ISO 27001, or NIS2 are relevant to your company? We’ll help you assess your current situation, identify areas requiring action, and plan the next steps in a structured manner.
Contact us—together, we’ll develop a tailored approach to information security for your company.
Sources and Further Information
- ISO: ISO/IEC 27001 – Fundamentals of information security management and information on certification. www.iso.org
- ENX Association: TISAX – Fundamentals, audit process, and exchange of results. enx.com
- Federal Government: Implementation of the NIS2 Directive – Entry into force of the German implementation and legal objectives. www.bundesregierung.de
- BSI: NIS2-Regulated Organizations – Information on applicability, registration, and implementation. www.bsi.bund.de
- BSI: Executive Management Training – Guidelines for executive management training. www.bsi.bund.de
- BSI: NIS2 Reporting Requirements – Information on the tiered reporting procedure for security incidents.
