Who it’s for
You supply parts, systems or engineering services to vehicle manufacturers and other suppliers. Your customers require evidence of information security, and as a manufacturer of motor vehicle parts you fall under NIS2 from medium size. Complass builds your ISMS under ISO 27001 and prepares you for the TISAX assessment with a self-assessment along the VDA ISA.
Vehicle manufacturers and large suppliers make an information security assessment a condition for contracts, often with a fixed deadline.
Design data, prototypes and test vehicles need special protection, both organisational and physical.
Just-in-time deliveries do not tolerate outages. An attack on production or IT quickly endangers your ability to deliver.
The manufacture of motor vehicles and parts is listed in Annex 2 of the German BSI Act. From medium size onwards you are therefore an important entity under NIS2:
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
Vehicle manufacturers and type approval. For vehicle type approval, UN Regulations No. 155 and 156 require a cyber security management system and a software update management system. These obligations fall on the vehicle manufacturer, who passes them on to its suppliers. Complass does not include a framework of its own for them.
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Series production for vehicle manufacturers: ISO 27001 and NIS2 for the company, customer evidence and contingency planning for the ability to deliver.
Design, simulation and testing with confidential customer data and prototypes.
Control units and software for vehicles as well as diagnostic and workshop products, to some of which the CRA applies.
Often the second or third supply tier: here too customers ask about information security.
From project mandate to a certification-ready ISMS, with Statement of Applicability and all mandatory documents, as the basis for customer evidence.
More about this featureSelf-assessment along the VDA ISA with a current maturity level from 0 to 5 per requirement, prototype protection and data protection in their own phases, through to registration, assessment and corrective action plan.
To the frameworkCapture production controllers and network components without agents, divide them into zones and work through vulnerabilities by priority.
More about this featureClassify your own suppliers, request and review self-assessments and evidence.
More about this feature
ISO 27001 lays the foundation and you add TISAX as a framework of its own; for your production the industry template is an option.
available
from €179 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
available
from €526 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
No software vendor awards the TISAX label; it requires an assessment by an approved audit provider. Complass prepares you for it: with a self-assessment along the VDA ISA, the current maturity level per requirement, templates and a corrective action plan. Whether you receive the label is decided by the assessment.
If you manufacture motor vehicle parts and are at least medium-sized, usually yes, as an important entity. What counts is your main activity, the number of employees and turnover and balance sheet total. The applicability check tests this in a few minutes.
Not for parts covered by type approval under Regulation (EU) 2019/2144. For other products with digital elements, such as diagnostic devices, workshop software or accessories without type approval, it can apply. The CRA module clarifies applicability per product.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
