TISAX cost for dealerships in the United States typically lands between $85,000 and $140,000 all in during the first year for a single rooftop with reasonably modern IT, and between $122,000 and $205,000 for a group of two to four stores.
That is a wide range, and the width of it is the point. What you actually pay depends on how much of the underlying security work you have already done, and most dealerships have done less than they think.
The good news is that the range collapses quickly. A two-week readiness check tells you exactly where you sit inside it, usually for a fixed $7,500, before you commit to anything larger.
In this guide, we will break TISAX cost into the three buckets it actually falls into, show you which parts go to us and which go to other people, and give you a timeline you can budget against.
Verify with your factory representative. OEM cybersecurity guidelines are issued through dealer channels rather than published publicly, and requirements and dates can change. Confirm the standard your manufacturer accepts and the date it applies in writing before you budget against it.
The Three Buckets Your Money Falls Into
Dealers are often quoted one number for a program that has three genuinely different cost centers. Separating them makes the whole thing easier to plan and easier to challenge.
Here is how a TISAX program is actually funded:
- Assessment and registration fees. Paid to the ENX Association and to an independent audit provider. Fixed, published, and outside anyone’s control.
- Remediation and tooling. Paid to software vendors and to whoever does the technical work. This is the largest and most variable bucket.
- Professional services and internal time. Paid to your readiness partner, plus the hours your own team spends on policy review, evidence collection, and audit meetings.
Only the second and third buckets are negotiable, and the second one is largely spend you owe anyway under the FTC Safeguards Rule, which has applied to US dealers since June 2023.
Bucket 1: What You Pay ENX and Your Assessor
These are third-party costs. No consultant, including us, can issue a TISAX label, and any firm that implies otherwise is worth walking away from.
| Line item | Cost | Frequency |
| ENX registration | EUR 405 net, approx. $475, per location, per scope | Once, no recurring fee during validity |
| TISAX AL2 assessment, independent provider | $5,000 to $15,000 | Once per three-year cycle |
| TISAX AL3 assessment, on-site | $12,000 to $25,000 | Once per three-year cycle |
| Annual penetration test, if required | $10,000 to $25,000 | Annually |
The ENX registration fee is published by the ENX Association, is billed in euros, and discounts apply from five locations upward, which matters if you run a group. ENX also offers an alternative participation-based model at a flat annual fee covering unlimited locations and scopes, which is worth pricing if you operate more than a handful of rooftops. Accredited assessors charge on a day-rate basis, and an AL2 remote assessment for one site with one label scope typically takes two to three days. AL3 requires a physical site inspection and runs three to five days.
The penetration test line is conditional. Mercedes expects continuous monitoring; if you do not have it, an annual penetration test performed by a certified professional is the accepted alternative. For many single-rooftop stores, a managed detection and response subscription works out cheaper over three years than an annual test, so run the math both ways.
Bucket 2: Remediation and Tooling
This is the bucket that decides whether your program costs $85,000 or $200,000, and it is almost entirely a function of your starting point.
| Dealership profile | Year-one remediation range |
| Single rooftop, modern IT, MFA already deployed | $25,000 to $60,000 |
| Two to four rooftops, mixed or legacy systems | $50,000 to $100,000 |
| Larger group with fragmented IT across stores | $100,000 and up |
The line items that consistently drive the number:
- Multi-factor authentication everywhere. Not just email. Every system holding customer data, plus all remote access. Cheap in licensing, expensive in change management.
- Eliminating shared logins. The most common assessment blocker in dealerships, and the one that meets the most resistance on the sales floor.
- Logging and monitoring. Getting twelve months of searchable security logs in place, either through a SIEM or through a managed service.
- Backup and disaster recovery you have actually tested. Backups that run are not the same as backups you have restored from.
- Endpoint detection and response. Consumer antivirus does not satisfy either standard.
- Vendor access cleanup. Reviewing, documenting, and often revoking access held by DMS integrations, marketing platforms, and third-party service providers. Our third-party risk assessment work usually finds more connections than a store knew it had.
Here is the part worth telling your ownership group: most of this spend is not a TISAX cost. It is a federal compliance cost you already carry, and a TISAX program simply forces you to finally schedule it.
Bucket 3: Professional Services and Internal Time
Somebody has to scope the program, run the gap assessment against the current VDA-ISA catalog, ISA 2027, write the management system, build the evidence room, run a mock audit, and prepare your team for the assessor interview.
| Scope | Timeline | Professional services range |
| Readiness check | 2 weeks | $7,500 fixed |
| TISAX AL2, single rooftop | 8 to 9 months | $55,000 to $65,000 |
| TISAX AL2, two to four rooftops | 9 to 11 months | $65,000 to $80,000 |
| TISAX AL2 plus AL3 | 10 to 12 months | $70,000 to $105,000 |
| ISO 27001, full path | 7 to 11 months | $50,000 to $100,000 |
| Ongoing support, per year of the cycle | Annual | $31,000 to $50,000 |
AL3 is only relevant if your store handles pre-launch vehicles, press fleets, or engineering loaners. Most dealerships do not, and adding AL3 without a reason is the easiest way to overspend on this program.
Then there is internal time, which almost no dealership budgets for and every dealership pays. Expect your general manager, controller, and IT lead to lose meaningful hours to policy review, decision-making, evidence collection, and coordination across departments. Plan it, and the program runs on schedule; leave it to chance, and the assessment slips a quarter.
What Does the Full Number Look Like?
Putting the three buckets together for the two most common dealership profiles.
| Single rooftop, modern IT | Two to four rooftops, mixed IT | |
| ENX registration and assessment | $5,500 to $15,500 | $7,000 to $25,000 |
| Remediation and tooling | $25,000 to $60,000 | $50,000 to $100,000 |
| Professional services | $55,000 to $65,000 | $65,000 to $80,000 |
| Year-one total | $85,000 to $140,000 | $122,000 to $205,000 |
| Years two and three | $31,000 to $50,000 per year | $40,000 to $65,000 per year |
For context, the 2024 CDK Global ransomware incident took roughly 15,000 North American dealer locations offline for about two weeks, with losses estimated by Anderson Economic Group at $1.02 billion across the three weeks from June 19 to July 5, 2024, including $605 million in the first fortnight. Divided across the affected rooftops, the average store lost more in three weeks than an entire TISAX program costs.
How to Bring the Number Down
You have more control here than the ranges suggest.
A few practical ways dealerships reduce total cost:
- Scope tightly and deliberately. Scope creep is the single biggest cost driver in the program. Every extra system, department, or location you pull in multiplies evidence work.
- Skip AL3 unless the OEM mandates it. If you do not handle prototype or pre-launch vehicles, AL3 adds cost and months for no benefit.
- Do the readiness check first. Two weeks and $7,500 to replace guesswork with a fixed-scope quote is the cheapest risk reduction in the whole program.
- Bundle rooftops. ENX discounts apply from five locations upward, and shared policies, shared evidence, and one management system across a group cost far less per store than five separate programs.
- Sequence remediation by assessment blocker. Fix the findings that will stop you passing first. Everything else can happen after you hold the label.
- Reuse the work. A control set built on ISO 27001:2022, which VDA-ISA inherits from, satisfies your TISAX path, keeps an ISO 27001 certificate available as an option, and closes most of your FTC Safeguards Rule exposure with one spend.
Frequently Asked Questions
How much does TISAX cost for a US car dealership?
For a single rooftop with reasonably modern IT, expect $85,000 to $140,000 all in during year one. A group of two to four rooftops typically lands between $122,000 and $205,000. That total includes ENX registration and independent assessment fees, remediation and tooling, and professional services. Years two and three run considerably lower, at roughly $31,000 to $50,000 per year for a single store.
What is the ENX registration fee for TISAX?
ENX registration costs EUR 405 net per location per scope, roughly $475, and is charged once by the ENX Association, with no recurring fee during the assessment’s validity period. Discounts apply from five locations upward, which makes group registration meaningfully cheaper per store than registering rooftops individually.
Is TISAX cheaper than ISO 27001 for a dealership?
For most dealerships, yes, though the gap is narrower than people expect. TISAX assessment fees are generally lower than ISO 27001 certification audit fees, and TISAX has no annual surveillance audit, which saves $4,000 to $9,000 per year. The bigger saving is in ongoing effort, because ISO 27001 requires a demonstrably running management system all year while TISAX is assessed at a point in time.
How long does a TISAX program take from start to label?
Eight to nine months for a single rooftop starting from a standing start, and nine to eleven months for a group of two to four stores. The timeline is driven by remediation and evidence collection rather than by the assessment itself, which usually takes two to five days depending on level.
Do I have to pay for TISAX every year?
No. The ENX registration fee is a one-time charge, and a TISAX label is valid for three years. What does recur is the cost of keeping the controls and evidence current, which typically runs $31,000 to $50,000 per year for a single rooftop, plus your tooling subscriptions. Reassessment happens at the end of the three-year cycle.
What is the cheapest way to start a TISAX program?
A fixed-price readiness check, typically $7,500 over two weeks. It gives you a documented scope, a gap assessment against the current VDA-ISA catalog, a ranked remediation roadmap, and a fixed-scope quote for the full program. It is a diagnostic rather than the label itself, but it converts an intimidating range into a number you can take to your ownership group.
Get a Real Number with CyberGlobal
Budgeting against a range is uncomfortable, and budgeting against the word “variable” is impossible. You deserve a figure you can defend to your ownership group.
That is what the readiness check is for. Two weeks, a fixed price, and you walk away with your scope, your gaps ranked by risk, and a fixed-scope quote for everything that comes after. Our GRC team does this work every week, and behind the frameworks and the acronyms, there are real people who will explain every line of the numbers to you in plain English.
We have supported enterprise clients including Mercedes-Benz, and we would be glad to be your ally on this one, every step of the way. Reach out today!
Secure Your Dealership With CyberGlobal
Turn a scary range into a fixed number, a ranked roadmap, and a date you can plan against.
