The German Association of the Automotive Industry (VDA) has officially released the new information security assessment catalogue, VDA ISA2027. It will become the mandatory catalogue for all TISAX assessments ordered from 1 January 2027 and marks the next stage in the development of TISAX (Trusted Information Security Assessment Exchange), a mechanism for the mutual recognition of information security assessment results within the automotive industry.
 
What Is New in the Catalogue
Unlike previous versions, which were identified by sequential version numbers, the new catalogue is named VDA ISA2027. The year in the title indicates when the respective edition becomes mandatory for newly ordered TISAX assessments.
ISA2027 also introduces a new annual publication cycle. Future editions are expected to be published each summer and to become effective on 1 January of the following year. Catalogue editions will therefore be identified by the year in which they become mandatory for new assessments rather than by a sequential version number.
 
The main changes include:

• Updated references and mapping tables for ISO/IEC 27001:2022 – the mapping tables for ISO/IEC 27001:2022 have been reviewed and refined, while references to ISO/IEC 27001:2013 have been removed
• Updated mapping tables for NIST Cybersecurity Framework 2.0 – the catalogue now includes updated mapping tables for the latest version of the NIST Cybersecurity Framework, complementing the reference frameworks used alongside ISO/IEC standards
• Improved clarity and consistency of the requirements – the wording has been reviewed, ambiguities have been removed, and frequently used expressions have been clarified to support more consistent interpretation and application of the requirements by all assessors. The definition of a “project” and the distinction between events and incidents have also been clarified
• Stronger focus on supply chain security – organisations that process information with high protection needs must document, review and monitor their suppliers’ compliance with information security requirements. Suppliers that process information with very high protection needs are subject to stricter requirements for demonstrating an appropriate level of security through a TISAX Label, an equivalent independent assessment or a suitable supplier audit
• Restructuring of the Prototype Protection module – some control areas have been consolidated and reorganised to create a more logical structure. New requirements for traceability and prototype lifecycle management have also been introduced
• More precise terminology for IT service providers – the term “IT Suppliers” has been replaced with “IT Service Providers”, clarifying the scope of certain requirements and refining the terminology relating to IT service providers
• Correct use of TISAX terminology – the official term “TISAX Label” is used instead of the commonly used but inaccurate expression “TISAX certification”, as TISAX is not a certification scheme

 
When Does It Apply?
VDA ISA2027 will be mandatory for all TISAX assessments ordered from 1 January 2027.
Existing TISAX Labels will remain valid for their full defined validity period. TISAX Labels issued under future catalogue editions will also remain valid for up to three years.
The introduction of an annual catalogue release cycle does not require more frequent reassessments. In practice, several new editions of the catalogue may be released between two consecutive TISAX assessments without affecting the validity of an existing TISAX Label.
 
Who Is Affected?
The change is relevant to all organisations with an existing or planned TISAX Label, including manufacturers, suppliers and subcontractors in the automotive industry, as well as organisations providing IT services to the automotive sector.
Organisations whose next TISAX assessment is scheduled for 2027 will move directly to the new catalogue. It is therefore advisable to assess compliance with the new requirements now and, where necessary, update policies, procedures and controls.
Preparation is particularly important for organisations that:

• outsource activities to external suppliers
• process information with high or very high protection needs
• work with prototypes, protected components or test vehicles
• still use documentation that has not been aligned with ISO/IEC 27001:2022

 
How CONSEJO Can Help
CONSEJO supports organisations in the automotive industry in preparing for and successfully completing a TISAX assessment, whether they are seeking their first TISAX Label or transitioning to the requirements of VDA ISA2027.
Our services include:

• gap analysis against VDA ISA2027
• assessment of compliance with ISO/IEC 27001:2022
• updating information security management system documentation
• preparation for the TISAX assessment and support throughout the entire process

 
Contact us for a free initial consultation to discuss what the transition to VDA ISA2027 means for your organisation.
 
Source: ENX Association – 10 Years of TISAX: VDA ISA2027 Released