TISAX ISA 2027 vs ISA 6: What's Changed?
Key Takeaways
ISA2027 introduces year-based catalogue naming and annual releases, with changes to Prototype Protection structure, supplier assurance expectations, selected requirement wording and framework mappings.
The assessment order date determines the applicable catalogue. Transition dates for opening an initial assessment and scheduling Stage 2 are separate milestones.
Existing TISAX labels remain valid until their stated expiry date, for up to three years. Publication of ISA2027 doesn't trigger an automatic reassessment.
Prepare for your next assessment by mapping controls to the applicable catalogue, reviewing supplier evidence and testing that controls operate in practice.
TISAX ISA2027 vs ISA 6: the main changes
The Trusted Information Security Assessment Exchange is managed by the ENX Association. The VDA Information Security Assessment (ISA) catalogue sets the questions and requirements used for assessments.
VDA published ISA2027 on 1 July 2026. ENX's release announcement confirms the move to year-based naming. The Information Security Assessment catalogue is set for annual releases. As of October 2026, it is published, but its default application date has not arrived.
The main differences affect structure, assurance and interpretation.
Area | ISA 6 | ISA2027 |
|---|---|---|
Catalogue naming | Version-number naming | Year-based naming and annual releases |
Prototype Protection | Five control groups | Two domains and revised labels |
Supplier assurance | Existing supplier controls | Stronger evidence expectations for elevated protection needs |
Requirement wording | Previous mandatory and advisory wording | Selected requirements strengthened and interpretation clarified |
Framework references | Earlier mappings | Updated mappings, including NIST CSF 2.0 |
Data Protection | Existing questionnaire | Unchanged questionnaire |
Your existing information security management system remains a useful foundation. The published changes call for a review of evidence against revised requirements before your next assessment. ISO 27001 certification doesn't automatically provide a TISAX label. Our guidance on TISAX requirements beyond ISO 27001 explains the additional scope, evidence and assessment obligations.
When ISA2027 applies to your assessment
The assessment order date determines which catalogue applies. The transition timetable also sets dates for opening an initial assessment and scheduling Stage 2.
Date or milestone | What it means |
|---|---|
Assessment ordered before 1 January 2027 | ISA 6 may still be used |
Assessment ordered from 1 January 2027 | ISA2027 is the default catalogue |
March 2027 | Final month to open an initial assessment under the previous catalogue |
Initial Stage 2 scheduled before 1 April 2027 | May still proceed within the transition arrangements |
These dates concern separate milestones. A Stage 2 date within the transition window doesn't replace the assessment-order rule. Check ENX's official TISAX downloads for current transition documentation and ISA 6 requirements.
ENX has announced an annual release cycle, with a catalogue each July taking effect the following January. Annual catalogue updates don't mean annual assessments.
For planning, record the order date, initial assessment-opening date and Stage 2 schedule separately. Treating them as one milestone can create uncertainty about the applicable version.
Existing labels, renewals and scope extensions
Valid labels keep their stated expiry date
An existing TISAX label remains valid until its stated expiry, for up to three years. Publication of ISA2027 doesn't cancel it or trigger an automatic reassessment.
If your label expires in 2027, check the applicable renewal catalogue and allow time for corrective actions. A label expiring in 2028 doesn't require an ISA2027 assessment now. Maintain your controls and include catalogue updates in ongoing improvement.
At renewal, use the ISA version required under current ENX rules. Before a TISAX reassessment, check those rules rather than assuming ISA 6 will still apply. The annual release cycle means you shouldn't assume which catalogue will apply several years ahead.
Group assessments and extensions retain their baseline
Simplified Group Assessments and scope extensions continue under the ISA version used for the initial assessment. All locations within one assessment scope must use the same version.
Record which catalogue applies to each scope. This helps when adding a warehouse, engineering centre or shared-service location during the transition.
A label's validity doesn't remove the need to review changes in operations, information flows or customer requirements.
Prototype Protection: structure and labels
Five control groups become two domains
ISA2027 groups the requirements into two domains: Organizational Requirements and Physical and Environmental Security. These replace the former five control groups.
For TISAX, organisations should map existing procedures and evidence to the revised structure. The catalogue reorganisation doesn't make established controls unnecessary.
Relevant evidence can include visitor arrangements, restricted photography, secure storage, protected transport and disposal records. Controls must match the prototype activities at each location in scope.
Basic and Facilities have different assessment levels
The labels are Prototype Protection Basic (AL2) and Prototype Protection Facilities (AL3). Prototype Protection Facilities includes all requirements in Prototype Protection Basic.
Assessment levels describe the depth of assurance, not the organisation's size or its general security maturity.
This assessment isn't automatically required for every automotive supplier. Its relevance depends on the customer request, assessment scope and work involving prototype parts, vehicles or related confidential information.
For an AL3 assessment, prepare site-level evidence that shows controls operate in practice. Policies alone won't demonstrate how access restrictions, visitor supervision or prototype handling work.
Stronger supplier assurance by protection need
For supply chain security, ISA2027 sets supplier assurance expectations according to protection needs and the sensitivity of the information and services involved.
High protection needs require active monitoring
For high protection needs, document, review and monitor supplier compliance with agreed security requirements. Check the current catalogue to confirm which requirements apply to significant changes.
A signed contract is only part of that evidence. Supplier records should show the agreed obligations, evidence reviewed, review outcome and follow-up actions.
Include relevant managed service providers, logistics partners and shared-service arrangements. An outsourced activity can affect the assessment even when the supplier doesn't manufacture automotive components.
Very high protection needs require stronger assurance
For very high protection needs, follow the assurance route specified in the current catalogue. This may include a TISAX label, an equivalent independent third-party assessment or a suitable supplier audit.
Evidence should cover the service, information and locations involved. A supplier's unrelated certificate won't automatically show that the relevant activity has been assessed.
A supplier's assurance evidence needs to cover the activity you're relying on, not merely the company name.
Our guidance on supplier certification and security assurance supports a more structured supplier review.
Requirement wording and framework mappings
Selected requirements become mandatory
ISA2027 makes several requirements that were previously advisory mandatory. The wording change from should to must is clear in control 1.1.1: information security policies must be available to employees in a suitable form.
Notifying employees and external business partners about relevant changes also becomes mandatory.
For this control, a policy approval record alone isn't enough. Prepare evidence of availability and communication, such as the controlled publication location, employee access arrangements and change notices.
For a TISAX assessment, the question is whether people can access the applicable policy and receive relevant updates. An approved document that remains inaccessible doesn't demonstrate implementation.
"Considered" requires a documented decision
The phrase "The following aspects are considered" has a formal definition. Organisations must consciously evaluate each listed aspect and explain their implementation decision.
This doesn't mean every listed aspect must automatically be implemented. It means omissions need a reasoned decision, rather than silence.
Record whether the aspect applies, how it's addressed and the rationale if implementation isn't appropriate. Link that decision to the relevant scope and risk assessment. This gives assessors a clear explanation without treating every example as an identical technical requirement.
Mappings reflect current frameworks
Mappings are updated to NIST Cybersecurity Framework 2.0 and refined references to ISO/IEC 27001:2022. They also clarify ISA/IEC 62443 mappings and remove references to ISO/IEC 27001:2013.
These mappings help organisations reuse relevant ISMS evidence. ISO 27001 certification isn't interchangeable with a TISAX assessment.
Update control-mapping documents so evidence points to current references rather than obsolete standard editions.
Data Protection and ENX VCS
The Data Protection questionnaire is unchanged
The Data Protection questionnaire hasn't changed between ISA 6 and the latest release. ENX confirms this in its redline introduction, available through its ISA2027 redline announcement.
There is no new questionnaire content to implement solely because of this release. Existing privacy obligations and applicable assessment requirements still need to be maintained.
Treat "unchanged" as continuity of requirements, not a reason to stop reviewing evidence or operational changes.
Vehicle Cyber Security remains a separate scheme
Vehicle Cyber Security (VCS), based on ISO/SAE 21434, is separate from TISAX. The two assessment schemes remain distinct.
ENX expects a valid TISAX label for each location within the VCS audit scope when the VCS audit takes place.
If both programmes are planned, align their location lists and schedules. A TISAX assessment booked for a later date won't provide the valid label expected at the VCS audit.
Preparing for your next TISAX assessment
A focused gap analysis should separate confirmed requirement changes from evidence gaps. Don't rewrite the entire ISMS before identifying what needs attention.
Use the following sequence:
Record your label expiry dates, assessment scope, objectives and planned order date. Confirm whether your next assessment is an initial assessment or a renewal, then identify the applicable catalogue and transition milestones.
Map existing controls to ISA2027 as part of the gap analysis. Separate structural changes, strengthened requirements and updated framework references.
Review supplier assurance against protection needs. Address missing assessment evidence, overdue reviews and unresolved supplier findings.
Reorganise Prototype Protection evidence around the two domains. Match the requested label to the activities and locations involved.
Test implementation through an internal audit. Sample policy communications, supplier reviews, access records and relevant site controls before the external assessment.
Assign an owner and completion date to each gap. Prioritise changes that require supplier cooperation, facility work or evidence collected over time.
Our TISAX assessment preparation support covers gap analysis, implementation, internal audits and evidence review. The objective is a manageable preparation programme with clear responsibilities and demonstrable control operation.
Frequently Asked Questions
When does ISA2027 apply to a TISAX assessment?
Assessments ordered from 1 January 2027 use ISA2027 by default. The transition timetable has separate dates for opening an initial assessment under ISA 6 and scheduling Stage 2, so check the current ENX guidance.
Does ISA2027 make an existing TISAX label invalid?
No. An existing label remains valid until its stated expiry date, for up to three years, and publication of ISA2027 doesn't trigger an automatic reassessment. Check the catalogue required under current ENX rules when you plan a renewal.
What changes to Prototype Protection does ISA2027 introduce?
ISA2027 groups Prototype Protection requirements into Organizational Requirements and Physical and Environmental Security, replacing the former five control groups. It also defines Prototype Protection Basic (AL2) and Prototype Protection Facilities (AL3), with AL3 including all Basic requirements.
What supplier evidence should organisations prepare?
For high protection needs, document and monitor supplier compliance with agreed security requirements, including review outcomes and follow-up actions. For very high protection needs, use the assurance route specified in the current catalogue and check that evidence covers the relevant service, information and locations.
Conclusion: prepare for your next TISAX assessment
Plan ISA2027 preparation around your next assessment date and the scope of your TISAX assessment. An existing label alone doesn't trigger an automatic reassessment.
Use the published catalogue to check relevant requirements and prepare evidence for your next assessment.
If you would like to find out more information or require any of our services please Contact Us and complete our contact form.
Comments