Mercedes-Benz Dealer ISO 27001 & TISAX Certification Deadline 2026

If you lead IT, security, or compliance at a Mercedes-Benz dealership, you have probably already seen the note buried in your dealer communications: Mercedes-Benz now expects its dealer network to stand up a qualified information security program, backed by ISO 27001, TISAX Level 2 certification, by September 30, 2026. This is not a new announcement, and it is not a rumor. It is a contractual expectation that has been working its way through the network for a while now, and the deadline is close enough that it deserves a real plan rather than a spot on next quarter's wish list.

For years, dealership cybersecurity has been treated as a checklist. Multi-factor authentication? Check. Antivirus? Check. A written policy sitting in a shared drive somewhere? Check. Everyone felt a little better, and everyone went back to selling cars. The Mercedes-Benz Cyber Security Guideline makes it clear that this era is ending. The question is no longer whether you have security controls. The question is whether you can prove they work.

Why Mercedes-Benz Is Raising the Dealership Cybersecurity Bar

The pressure on dealerships used to come almost entirely from the FTC Safeguards Rule. Now the manufacturers themselves are stepping in, and the reason is straightforward. A dealership holds an enormous amount of sensitive data. Credit applications, Social Security numbers, driver's license scans, financing details, and service histories flow through dealer systems every single day. That data, combined with a direct network connection back to the OEM, makes every dealership a potential doorway into the manufacturer's own environment.

The 2024 CDK Global ransomware incident made that risk impossible to ignore. When that single platform was compromised, it disrupted operations at more than 15,000 dealerships across North America. OEMs watched sales, service, and financing grind to a halt, and they saw firsthand how a weakness in the dealer channel becomes their problem too. What manufacturers fear most is a downstream breach, where an attacker slips into the corporate network through a vulnerable dealer's VPN connection. Requiring independent certification is how Mercedes-Benz is closing that gap.

What the Mercedes-Benz Cyber Security Guideline Actually Requires

Here is the part that trips up a lot of dealers. Mercedes-Benz is not mandating full ISO 27001 adoption and nothing else. The requirement is built around proof, and it offers more than one accepted path:

• ISO 27001 certification, the internationally recognized standard for an Information Security Management System (ISMS)

• TISAX Level 2, the automotive-specific assessment built on ISO 27001 controls with added layers for the auto industry

• Equivalent recognized programs, including SOC 2 Type 2 in some supplier contexts, that meet a similar level of rigor

Access and proof of certification are handled through the ENX portal, the same system used across the European automotive supply chain. The important word in all of this is proof. There is a meaningful difference between being encouraged to improve your security and being required to demonstrate it with documented evidence. The Guideline lays out controls that must be implemented, monitored, and evidenced, and it is a requirement rather than a suggestion.

It is also worth understanding the full scope. These certifications go well beyond firewalls and endpoint protection. They cover physical security, IT infrastructure, data flow documentation, access management, third-party risk, and the organizational processes that hold everything together. This is not something a dealership can knock out in a couple of weekends.

ISO 27001 vs. TISAX Level 2: Which Path Fits a Dealership?

This is the first real decision point, and it comes up constantly. ISO 27001 is the broadest, most portable credential. It is recognized across industries and geographies, and it signals a mature security program to customers, partners, and regulators alike. TISAX Level 2 is narrower and purpose-built for the automotive world, which is why it is often described as a lighter lift for retail dealer operations. It layers automotive concerns like prototype data handling on top of a familiar control set.

The good news for anyone weighing the two is that they share the same DNA. TISAX is built directly on ISO 27001 controls. In practical terms, if you build a solid ISO 27001 program first, you are already most of the way to satisfying TISAX. Done thoughtfully, the same underlying ISMS can support either certification and meet the Mercedes-Benz requirement regardless of which route you formalize. That overlap is a gift, because it means the work you invest is not wasted no matter which door you eventually walk through.

Why Checking the Box No Longer Passes

Many dealerships have leaned on compliance platforms that function as little more than self-reported questionnaires. The classic example is the MFA question. Do you use multi-factor authentication? Yes. Technically true, because MFA exists somewhere in the environment. But an auditor, and now an automaker, wants to know more than that.

Is MFA enabled everywhere it should be? Is it enforced for remote access, administrator accounts, SaaS applications, and outside vendors? Is it monitored, tested, and maintained as users and systems change over time? That is the difference between having MFA and having MFA that actually reduces risk. An ISO or TISAX audit does not ask whether you have a policy. It asks you to show how that policy is implemented, monitored, tested, and improved. For dealerships that have historically relied on stretched-thin internal IT teams, compliance software with no operational follow-through, or vendor assurances instead of independent validation, that is a significant shift in expectations.

What an Effective Information Security Program Looks Like

Mercedes-Benz's guidance lines up neatly with what the FTC Safeguards Rule, NIST, and the CIS Critical Security Controls have been saying all along. Dealerships need to develop, implement, and maintain a real information security program, not just document one. In practice, that means several things working together:

• A designated security owner at the dealership who is genuinely accountable for the program

• A written information security program that reflects how the store actually operates, not a generic template

• Continuous monitoring and logging so you can see what is happening across your systems

• Regular risk assessments that feed real decisions

• Ongoing access reviews as employees join, move, and leave

• A tested incident response plan for when something does go wrong

• Security awareness training that goes beyond a single annual video

The short version is that security has to be treated as a process rather than a product you buy once and forget.

The Domino Effect: Why Other OEMs Will Follow

When one major manufacturer sets a hard certification deadline across its dealer network, it rarely stays a one-brand story. BMW, Volkswagen Group, and other German manufacturers already lean on TISAX throughout their supplier networks, so the framework is well established in the industry. It is reasonable to expect similar dealer-facing requirements to spread to other brands over the next few years. A dealer group that sells more than one franchise should be paying especially close attention, because building one strong program now can position you to satisfy multiple manufacturers later instead of scrambling brand by brand.

This is ultimately a maturity story rather than a fear story. OEMs are nudging dealerships toward the same security standards that are already normal in banking, healthcare, and large enterprises. Given how much financial and personal data moves through a dealership every day, that expectation is fair, and meeting it is good for dealers, customers, and manufacturers alike.

How Long ISO 27001 and TISAX Certification Really Take

This is the number that changes behavior. Starting from scratch, getting audit-ready for ISO 27001 or TISAX Level 2 typically takes nine to twelve months. That timeline includes a gap assessment, building out documentation and controls, operating those controls long enough to generate evidence, and then scheduling and completing the certification audit itself. With a September 30, 2026 deadline, the runway is already tight for any dealership that has not started.

A practical sequence looks like this. First, run a gap assessment against the relevant questionnaire, such as the VDA ISA catalog used for TISAX, to see where you actually stand. Second, determine your assessment level, since most dealers will need Level 2 at minimum. Third, register on the ENX portal (if you’re going the TISAX route) and select an accredited audit provider so your calendar is locked in before availability tightens closer to the deadline. Fourth, begin building your ISMS documentation and implementing the controls that the assessment expects. The dealers who begin this work now will have a real competitive advantage. The ones who wait for a formal escalation from the manufacturer will be explaining, under pressure, why their franchise agreement is exposed.

How Compass Can Help

This is exactly the kind of program Compass IT Compliance builds every day. Our team helps dealerships turn a hard deadline into a clear, achievable roadmap, starting with a gap assessment against ISO 27001 and TISAX Level 2, so you know precisely where you stand and what it will take to close the distance. Because the two frameworks share the same control foundation, we design your program once and position it to satisfy the Mercedes-Benz requirement through whichever certification path fits your operation best. From there, we help you build the documentation, implement and evidence the controls, prepare for the audit, and select the right accredited assessor through the ENX portal. For dealers who do not have the internal bandwidth to own a program of this size, our virtual CISO service provides the ongoing leadership and accountability that ISO, TISAX, and the FTC all expect, so security becomes a managed process rather than a fire drill.

If you are a Mercedes-Benz dealer working toward the September 30, 2026 deadline, or a dealer group that wants to get ahead of the requirements coming from other manufacturers, reach out to Compass IT Compliance. The sooner we start, the more room you have to do this right.