The VDA ISA2027 will apply to newly commissioned TISAX® assessments starting January 1, 2027. Even though there is still some time until then, affected companies should begin addressing the changes now. This is because the new version will affect, among other things, supplier management, prototype protection, the required documentation, and future assessment planning. By identifying early on which requirements are relevant to their own company, organizations can specifically address existing gaps and avoid unnecessary time pressure ahead of their next TISAX assessment.
TISAX® stands for “Trusted Information Security Assessment Exchange” and is used for the cross-organizational assessment and sharing of information regarding a company’s security level. The process is aimed in particular at organizations that process sensitive information within the automotive value chain. In addition to automakers and suppliers, these include, for example, development service providers, consulting firms, logistics companies, and providers of IT, cloud, and hosting services.
The ISA catalog forms the technical basis of a TISAX assessment. ISA stands for “Information Security Assessment.” The catalog contains requirements and assessment criteria that companies can use to evaluate their information security and demonstrate it to business partners. It is based on international standards but also takes into account the specific risks and requirements of the automotive supply chain. As such, it serves as a central foundation for information security in the automotive industry.
The VDA ISA2027 does not represent a complete overhaul of the previous process. However, it further develops the set of requirements in several key areas. According to the ENX Association, the focus is particularly on improving clarity, ensuring more consistent evaluations, and strengthening safety management within the automotive supply chain. Overall, there are five key changes that companies should address at an early stage.
The first major change concerns the future publication and versioning model. Catalog versions will no longer be designated exclusively by sequential version numbers. Instead, they will henceforth include the year in which they become mandatory for newly commissioned assessments. The designation VDA ISA2027 thus makes it immediately clear that this version applies to TISAX® assessments commissioned on or after January 1, 2027.
At the same time, the new catalog marks the start of an annual publication cycle. Future versions are generally scheduled to be released in the summer and will take effect on January 1 of the following year. This will allow requirements to be adapted more regularly and in smaller increments to address new threats, technological developments, and lessons learned from assessment practice.
For companies, this means that new publications should be monitored on an ongoing basis in the future and incorporated into their own TISAX planning. However, existing TISAX® labels do not automatically lose their validity due to the annual cycle. They remain valid for their regular term, which can still be up to three years. The new publication schedule therefore does not necessarily lead to more frequent assessments. However, it does require organizations to verify which version of the catalog applies before each new TISAX assessment.
The second change concerns the updated references to international standards and frameworks. The mappings to the NIST Cybersecurity Framework 2.0 have been updated, the links to ISO/IEC 27001:2022 have been reviewed, and the references to ISA/IEC 62443 have been clarified. At the same time, references to the older ISO/IEC 27001:2013 have been removed.
This is particularly relevant for companies that already have an information security management system in accordance with ISO/IEC 27001 or that take into account security requirements for industrial automation and control systems. Existing management systems and documentation can continue to serve as an important foundation for preparation. Nevertheless, one should not assume that ISO 27001 certification automatically covers all the requirements of a TISAX assessment. Information security in the automotive industry involves additional requirements arising from the specific risks, customer requirements, and dependencies within the automotive value chain.
As a third major change, numerous phrases, definitions, and requirement structures were revised. The goal is to make VDA ISA2027 easier to understand and more consistent in its application. The goal is to reduce ambiguities that have arisen over time so that companies and audit service providers can interpret the requirements more uniformly.
It is particularly important to clarify the wording “The following aspects are taken into account.” In the future, it must be evident that all of the aspects mentioned have been deliberately considered. In the assessment, a company should also be able to provide a clear explanation of why a particular measure was implemented—or, following a well-reasoned evaluation, why it was not implemented.
In practice, this means that an existing document alone does not constitute sufficient evidence. The key factor is whether the described processes are actually being applied and whether decisions, controls, and reviews are documented in a traceable manner. For example, it is not sufficient to stipulate regular supplier evaluations in a policy if no current evaluations, approvals, or documented follow-up actions can be provided.
Executives and other organizational leaders are also explicitly identified as the target audience for information security awareness and training initiatives. This underscores that responsibility for information security in the automotive industry does not rest solely with the IT department or the information security officer. It must be understood at all levels of the company and incorporated into business decisions.
The fourth change—which is particularly relevant in practice—concerns supplier management. Organizations that process information requiring a high level of protection will, in the future, be required to document more thoroughly how they verify and monitor their suppliers’ compliance with information security requirements. This is not merely a one-time assessment prior to awarding a contract. Security measures and supporting documentation must be reviewed regularly and whenever significant changes occur.
Such a change may occur, for example, when a new subcontractor is brought on board, a service is migrated to a cloud environment, or a critical IT service provider is replaced. Organizational changes at the supplier or new dependencies within the supply chain may also necessitate a reassessment.
When the need for protection is very high, expectations regarding supplier management increase even further. Suppliers must be able to demonstrate an appropriate level of information security, for example, through a suitable TISAX® certification, a comparable independent assessment, or an appropriate supplier audit. The form of evidence that is required and proportionate depends on the security requirements, the service provided, and the associated risks.
A development service provider that processes a vehicle manufacturer’s confidential design data and uses an external hosting provider for this purpose must therefore consider more than just its own security measures. It must also define the requirements applicable to the hosting provider, how compliance with these requirements is demonstrated, and how to handle deviations or significant changes.
Effective supplier management therefore requires transparent evaluation criteria, up-to-date documentation, and clearly defined responsibilities. Companies should also verify whether relevant information security requirements have been contractually agreed upon and, if necessary, passed on to subcontractors. Since contracts, external documentation, and supplier evaluations often cannot be adjusted on short notice, this area should be addressed as early as possible.
The fifth key change concerns prototype protection. The corresponding module has been comprehensively restructured in accordance with VDA ISA2027. The previous division into five control groups has been consolidated into two overarching areas: organizational requirements and physical and environmental security. This is intended to more clearly distinguish fundamental organizational measures from more advanced physical protection measures.
In addition, new controls have been implemented to ensure the traceability and monitoring of protected vehicles, components, and parts throughout their entire lifecycle. This also applies to the handling of prototypes, tools, components, or relevant data storage media at the end of their useful life. Depending on the specifications of the respective customer, these must be returned, recycled, disposed of, or securely destroyed in a controlled manner.
Companies whose scope of operations includes prototype protection should therefore do more than just update their policies. The actual processes involved in development, storage, transport, use, return, and disposal must also be regulated in a traceable manner. Responsibilities, handoffs, and the whereabouts of protected items should be documented in such a way that traceability can be demonstrated during the TISAX assessment using appropriate evidence.
A structured gap analysis is a useful approach for preparing for the VDA ISA2027. This involves comparing the requirements that have been implemented to date with the new version of the catalog. This approach makes it possible to determine which measures remain sufficient, which processes need to be adjusted, and where additional or more detailed evidence is required.
Such an analysis should not be limited solely to policies and process descriptions. Contracts, supplier evaluations, training records, technical configurations, test reports, approvals, and actual processes in practice should also be included. Particularly in supplier management, it can be helpful to verify early on whether all relevant service providers have been identified, assessed for risk, and bound by appropriate security requirements.
These five changes demonstrate that information security in the automotive industry is increasingly becoming an ongoing management task. The new annual publication cycle, updated references to standards, more precise documentation requirements, stronger supplier management, and the restructuring of prototype protection all have an impact on various areas of a company.
Companies should therefore determine well in advance when their next TISAX assessment is scheduled and which version of the catalog will apply. Conducting an early assessment of their current status provides planning certainty and prevents necessary adjustments from being identified only immediately before the assessment.
The VDA ISA2027 also offers companies the opportunity to critically review existing processes and embed information security more sustainably into their own business operations. Those who address the new requirements early on can close potential gaps in a structured manner and prepare specifically for the next assessment.
We help companies understand the changes to VDA ISA2027, review their existing structures, and implement the necessary measures in a practical manner. This ensures that preparation for the next TISAX assessment is not a last-minute reaction, but rather a predictable component of information security management.
Source for the technical changes: ENX Association – VDA ISA2027 Released
TISAX® is a registered trademark of the ENX Association.
