A customer's completion of a TISAX (Trusted Information Security Assessment Exchange) assessment is a distinctive testimonial moment in the automotive and adjacent manufacturing vertical because TISAX — operated by the ENX Association on behalf of the European automotive industry — produces label-and-assessment-level artifacts that are visible only to qualified portal participants and that follow disclosure norms that diverge from SOC 2, ISO 27001, and FedRAMP. Most testimonial programs treat TISAX completion as interchangeable with ISO 27001 because the control framework is derived from the VDA ISA catalogue (which aligns with ISO 27001), but the operational reality is that TISAX assessments produce a specific label combination (Information Security, Confidential, Strictly Confidential, High Availability, Prototype Protection, Data Protection) at one of three assessment levels (AL 1, AL 2, AL 3), and the disclosure visibility is gated by the ENX portal rather than published on a public registry.
This guide separates the TISAX assessment cycle into four phases, explains the testimonial-wall risks in each phase, and provides per-phase playbooks calibrated to the automotive-vertical procurement mechanics that most TISAX-completing customers operate under. For broader context on compliance-anchored testimonials, see the playbooks on testimonials when a customer completes a SOC 2 audit, testimonials when a customer completes ISO 42001 certification, and testimonials when a customer completes HITRUST CSF certification.
The four TISAX assessment-cycle phases
A typical TISAX assessment path runs through self-assessment, audit-provider engagement, on-site or remote assessment, and label issuance through the ENX portal. The cycle commonly spans six to twelve months for a first-time AL 2 assessment and three to nine months for an AL 3 assessment that includes both Information Security and Prototype Protection labels. Customers move through four distinct phases relative to the assessment.
Phase 1: Scoping and self-assessment (the period before the audit provider is engaged). The customer is selecting the assessment objectives (which label combination, which assessment level), assigning the assessment scope (which locations, which information classification levels), and completing the VDA ISA self-assessment. The customer is highly engaged with the vendor's security posture and control-implementation evidence but cannot yet claim a TISAX label. Testimonials produced during scoping-and-self-assessment have a control-implementation-and-evidence-quality character — the customer can speak to the vendor's documentation quality, control-mapping clarity, and self-assessment-support responsiveness.
Phase 2: Audit and assessment (the period between audit-provider engagement and ENX label decision). The customer has engaged the audit provider and is producing the assessment artifacts under the audit-provider review. The customer is highly engaged operationally and is preparing for the label-issuance decision through the ENX portal. Testimonials produced during audit-and-assessment have an audit-process-and-vendor-collaboration character — the customer can speak to vendor responsiveness during the audit, on-site or remote evidence-presentation quality, and finding-resolution discipline, but should not claim a TISAX label before the label issues through ENX.
Phase 3: Post-label (the period after the label is issued and the assessment result appears in the ENX portal). The customer holds an active TISAX label combination at a specified assessment level and has accumulated operational data from the assessed environment. The customer is the highest-value testimonial source for automotive-vertical claims because the label is verifiable through the ENX portal by qualified portal participants. Testimonials produced post-label have an assessment-realized character — the customer can claim the specific label combination with substantiation, quote the assessment level (AL 1, AL 2, or AL 3), and reference the assessment date and the assessment-result visibility window.
Phase 4: Re-assessment cycle (the three-year cycle that follows label issuance). The customer holds an active label combination and is preparing for the next re-assessment, which is required at the three-year anniversary of the original label decision. Testimonials produced during the re-assessment cycle have a sustained-assessment character — the customer can speak to the vendor's audit-cycle predictability, the operational stability of the assessed environment, and the re-assessment-preparation support over the multi-year period.
Per-phase playbook for the automotive-vertical testimonial wall
Phase 1: Scoping and self-assessment
During scoping-and-self-assessment, the testimonial wall faces a premature-label-claim risk and a scope-confusion risk.
First, do not request label claims from scoping-phase customers. The scoping-phase customer has not yet received a TISAX label and cannot substantiate label status. A quote that claims TISAX completion during scoping will not survive verification against the ENX portal. The remediation is to request control-implementation-and-evidence-quality quotes that the customer can substantiate from their current self-assessment work.
Second, avoid scope confusion in the quote framing. Scoping-phase customers and uninformed reviewers sometimes describe the TISAX scope in broader terms than the actual assessment will eventually cover, and a quote that implies a multi-location or multi-label scope during a single-location single-label scoping phase invites a substantiation gap when the actual label issues with a narrower scope. The remediation is to require explicit scope language in every quote and to validate the scope against the eventual label decision before publication.
Phase 2: Audit and assessment
During audit-and-assessment, the testimonial wall faces a premature-completion-claim risk and an audit-finding-disclosure risk.
First, request audit-process quotes only. The customer is in the middle of the formal assessment and has not yet received a label decision. A quote that claims TISAX completion is premature and will not survive verification. The remediation is to request quotes about audit-cycle responsiveness, evidence-presentation collaboration, and audit-provider interaction quality — not label status.
Second, do not disclose audit findings. A quote that references specific audit findings, control-implementation gaps, or remediation-plan details creates both a confidentiality risk and a reputation risk for the customer. The remediation is to defer all finding-and-remediation discussion until after the label decision and to require explicit written approval before referencing any finding-and-remediation content in publication.
Phase 3: Post-label
During post-label, the testimonial wall faces a substantiation-leverage opportunity and a label-mismatch risk.
First, prioritize the post-label phase for label-claim collection. The post-label customer is the highest-value testimonial source on the automotive-vertical wall because the label is verifiable through the ENX portal and the assessment level is specified. The remediation is to concentrate label-claim collection in the post-label phase and to require quotes to reference the specific label combination and assessment level.
Second, match label claims to the actual label combination. A vendor whose customer holds the Information Security label at AL 2 cannot truthfully publish a testimonial that implies Strictly Confidential or High Availability label coverage. The remediation is to coach the customer toward label-combination-specific framing during the quote-request interview and to validate the label combination against the ENX portal listing before publication. For broader treatment of claim substantiation, see the playbook on testimonial claim substantiation with data.
Phase 4: Re-assessment cycle
During the re-assessment cycle, the testimonial wall faces a sustained-assessment opportunity and a label-expiration risk.
First, treat the re-assessment cycle as a recurring quote-trigger window. The three-year re-assessment milestone produces a fresh substantiation moment for sustained-assessment claims. The remediation is to time a quote-request conversation to the moment immediately after the re-assessment label issues so the customer's framing is fresh and the substantiation is current.
Second, manage label-expiration risk. A TISAX label is valid for three years from issuance, and a quote whose claim references an expired label will fail verification against the ENX portal. The remediation is to track every TISAX-anchored quote against the label-expiration date and to pull or refresh quotes whose label has expired or is within sixty days of expiration.
The seven quote-request timing risks
Risk 1 — Label claim during scoping. The customer has not yet received a TISAX label and cannot substantiate. Remediation: defer label claims until phase 3.
Risk 2 — Completion claim during audit-and-assessment. The customer is mid-audit and the label decision has not yet issued. Remediation: require explicit phase markers and substitute audit-process framing.
Risk 3 — Label combination mismatch. The quote implies a broader label combination than the actual assessment achieved. Remediation: validate the label combination against the ENX portal listing before publication.
Risk 4 — Assessment-level inflation. The quote implies an AL 3 assessment level when the actual assessment is AL 1 or AL 2. Remediation: require explicit assessment-level language and validate against the ENX portal listing.
Risk 5 — Audit-finding disclosure. The quote discloses specific audit findings or remediation details. Remediation: require explicit written approval for finding-and-remediation content.
Risk 6 — ENX portal visibility misframing. The quote implies that the label is publicly verifiable when in fact ENX-portal visibility is gated by qualified-participant access. Remediation: use precise visibility language ("verifiable through the ENX portal by qualified participants") rather than "publicly verifiable" framing.
Risk 7 — Label-expiration drift. The customer's label expires between quote collection and re-assessment, and the quote's claim becomes stale. Remediation: track every TISAX-anchored quote against the three-year expiration cycle and refresh proactively.
What to publish and what to omit
Testimonials calibrated to TISAX assessment completion should publish: the customer's phase position at the time of the quote (with explicit phase markers where the claim is mid-cycle), the label combination achieved (Information Security, Confidential, Strictly Confidential, High Availability, Prototype Protection, Data Protection), the assessment level (AL 1, AL 2, or AL 3) for post-label quotes, and the assessment date with explicit reference to the three-year re-assessment cycle.
Testimonials should omit: label claims from customers in scoping-and-self-assessment or audit-and-assessment phases, label-combination claims that exceed the actual assessment, assessment-level inflation that exceeds the achieved AL, audit-finding-and-remediation detail without explicit written approval, and "publicly verifiable" framing that misrepresents the ENX-portal visibility model.
The ProofShow approach to TISAX-anchored testimonials emphasizes phase-claim alignment, label-combination specificity, assessment-level precision, finding-disclosure discipline, and three-year-cycle-aligned rotation that tracks label expiration proactively. For broader context on temporal and substantiation strategy, see the playbooks on testimonials in different budget-cycle phases, testimonial confidentiality and NDA handling, and testimonial recency vs. volume tradeoff.