TISAX® has just entered its most significant transition since its creation. The VDA, in collaboration with ENX Association, has officially published VDA ISA 2027, the new version of the catalogue underpinning every TISAX® assessment. This is the most relevant update to the standard in recent years, and it directly affects manufacturers, suppliers, and any organisation forming part of the automotive supply chain.
From 1 January 2027, this new version will be mandatory for any new TISAX® assessment. The preparation window is shorter than it appears, and companies that leave their adaptation to the last minute will face considerable time pressure. In this article, we explain what VDA ISA 2027 is, when it takes effect, why this update was necessary, and exactly what changes compared to the previous version.
What Is VDA ISA 2027?
VDA ISA 2027 is the new version of the requirements catalogue that forms the basis of every TISAX® assessment. It replaces the previous version, VDA ISA 6.0.3, in force since 2024, and has been jointly developed by the VDA and ENX with a threefold objective: to bring the standard closer to current international security frameworks, to formulate existing requirements more clearly, and to improve the comparability of assessments carried out in different countries and by different auditors.
This is not a minor adjustment or a cosmetic update: the catalogue thoroughly revises how information security, supplier management, and prototype protection are assessed across the entire automotive supply chain.
Timeline — The Date Every TISAX®-Certified Company Needs to Know
From 1 January 2027, VDA ISA 2027 will be mandatory for any TISAX® assessment requested. This is not an indicative date — it is the official cut-off point set by the VDA and ENX.
Until 31 December 2026 — Assessments can still be requested and completed under the current ISA 6.0.3 catalogue.
From 1 January 2027 — VDA ISA 2027 becomes mandatory for any new assessment requested, with no exceptions.
In practice, this means:
· Any organisation requesting a TISAX® assessment before 31 December 2026 can still complete it under the ISA 6.0.3 catalogue.
· Any assessment requested from 1 January 2027 onwards must be carried out under VDA ISA 2027, with stricter documentation and process requirements.
· Existing certifications remain valid until their expiry date — there is no need to repeat an assessment already passed.
· However, any recertification or new request submitted after 1 January 2027 will automatically fall under the new catalogue.
In practice, this leaves companies with just over a year to review their documentation, internal processes, and supplier relationships before the new standard takes effect. The sooner this review begins, the lower the risk of facing tight deadlines or a rushed audit.
Why Was This Update Necessary?
This update responds to two realities that have changed significantly since the previous version of the catalogue was published:
A growing risk environment. The automotive sector combines global supply chains, digitalised production, connected vehicles, and cloud-based development environments. This level of digitalisation increases the sector’s efficiency, but also its exposure to cyberattacks, industrial espionage, and sabotage. The VDA itself frames this update as part of a broader economic protection strategy for the sector.
An outdated regulatory foundation. ISO/IEC 27001, the technical backbone of TISAX®, was updated in 2022 (the ISO/IEC 27001:2022 edition). The previous version of the catalogue, ISA 6.0.3, still referenced the 2013 edition of that standard. VDA ISA 2027 corrects this gap and, for the first time, introduces a direct mapping to the NIST Cybersecurity Framework (CSF) 2.0, widely used outside Europe.
The Most Relevant Changes in VDA ISA 2027
1. Alignment with international security standards
The catalogue is updated to ISO/IEC 27001:2022 and now includes a direct mapping to NIST CSF 2.0. In practice, this makes it easier for organisations that already hold a certified information security management system (ISMS) to align their processes with TISAX® requirements, and improves the international comparability of assessments.
2. Clearer, more binding requirements
The wording of numerous controls has been revised to reduce ambiguity between companies and auditors. In addition, several requirements that were previously optional — the VDA itself cites certain password security measures as an example — now become mandatory. The goal is to align the catalogue with the current state of the art in security.
3. Greater rigour in IT supplier management
Organisations will need to demonstrate, in greater detail and with more transparency, how they assess and monitor their critical IT suppliers. The Supplier Statement of Applicability (Supplier SoA) gains greater weight within the assessment process. This reinforcement responds to the fact that a significant share of security incidents in the supply chain originate through third parties.
4. Complete restructuring of the Prototype Protection module
The module governing the protection of vehicles, parts, or components not yet made public has been entirely reorganised: a new internal structure, merged controls, added organisational requirements, and removed outdated content. The result, according to the VDA itself, is a notably simpler implementation in practice.
5. Greater integration between information security and data protection
Information security and personal data protection are no longer treated as separate matters. This allows both areas to be justified with shared evidence during the audit, simplifying the process for organisations that handle sensitive data belonging to customers, employees, or partners.
What Should TISAX®-Certified Companies Do Now?
Organisations that already hold a valid TISAX® certification, or that have a recertification scheduled for 2026 or 2027, should begin preparing as soon as possible. Specifically, we recommend:
· TISAX® certification process under the new VDA ISA 2027 update for automotive industry companies
· Reviewing current documentation against the new catalogue, to identify gaps and potential weak points before the auditor does.
· Updating internal processes, particularly those related to IT supplier management and, where applicable, prototype protection.
· Formalising measures that were previously voluntary, such as certain security policies, since several recommendations are now mandatory.
· Planning the next audit well in advance, taking into account whether it should be carried out under ISA 6.0.3 (before 31/12/2026) or already under VDA ISA 2027.
· Not leaving it until the last quarter of 2026: the closer assessment requests cluster around the deadline, the greater the pressure on auditors’ and consultants’ availability.
Organisations that do not yet hold TISAX® certification and are considering starting the process should seriously consider doing so directly under VDA ISA 2027, avoiding a double adaptation within a short period of time.
At Ariol Automotive, we support manufacturers and suppliers across the sector through their transition to VDA ISA 2027, with the same rigour we have applied to their TISAX® certification processes to date. If your next assessment is approaching, now is the time to start preparing for it.
