TISAX® ISA2027: Key Changes for Automotive Suppliers
Nov 13, 2026AuditThe new VDA ISA2027 catalogue introduces updated information security requirements and a new annual publication cycle for TISAX® assessments. Find out what is changing, when the latest version applies and what organizations should consider when preparing for their next assessment.
The automotive industry relies on the secure exchange of sensitive information across increasingly complex supply chains. From vehicle manufacturers and component suppliers to engineering partners and service providers, organizations must demonstrate that appropriate information security measures are in place to protect business-critical information.
The VDA ISA2027 catalogue introduces the next development of the assessment requirements underpinning TISAX®. Alongside updates to individual requirements, the new version introduces a year-based versioning model and establishes an annual publication cycle for future ISA catalogues.
For organizations participating in TISAX®, understanding these changes is important when planning future assessments and reviewing their information security management systems.
What is changing with TISAX® ISA2027?
The Information Security Assessment (ISA) catalogue forms the foundation of TISAX® assessments. Developed and maintained by the ENX Working Group ISA and published by the VDA, it provides a common set of information security requirements for organizations operating within the automotive industry.
ISA2027 introduces several important developments.
When does ISA2027 become applicable?
ISA2027 is the basis for TISAX® assessments ordered from 1 January 2027.
According to ENX, the transition arrangements permit initial assessments to be conducted under ISA 6 only if two conditions are met: the order was placed with the audit provider by 31 December 2026, and the initial assessment is opened no later than 31 March 2027. The opening is the first audit day, i.e. the opening meeting of the initial assessment; a preceding kick-off meeting does not count.
Orders placed from 1 January 2027 are carried out under ISA 2027, and from 1 April 2027 ISA 2027 is the assessment basis for all assessments.
Existing TISAX® labels are not automatically affected by the introduction of ISA2027. Their validity remains unchanged, subject to the established label validity period.
Organizations planning an assessment around this period should confirm their eligibility and the applicable version with their assessment provider before proceeding.
How should organizations prepare for ISA2027?
The introduction of ISA2027 provides an opportunity for organizations to review their existing information security arrangements and identify areas that may require further attention.
While the specific preparation required will depend on each organization's existing processes, assessment scope and information security maturity, the following areas are worth considering:
- Review the updated ISA catalogue.
Understand the revised requirements and identify changes relevant to your organization and assessment scope.
- Evaluate existing information security controls.
Review whether current policies, procedures, technical measures and supporting documentation address the updated requirements.
- Review supplier security management.
Consider how information security requirements are communicated to suppliers and how their implementation is monitored.
- Plan your next assessment.
Consider your current TISAX® label validity, assessment timeline and the applicable ISA version when planning your next assessment.
Customers planning an ISA 6 assessment should schedule the first audit day bindingly before 1 April 2027. Early preparation can help organizations identify potential gaps, allocate responsibilities and approach their next assessment with greater clarity.
TISAX® provides a recognized framework for assessing information security within the automotive industry. Preparing for an assessment requires organizations to understand the applicable requirements and demonstrate how information security is managed across their operations.
DEKRA supports organizations through independent TISAX® assessments, helping them evaluate their information security management systems against the applicable assessment requirements.
Whether your organization is preparing for its first TISAX® assessment or planning its next assessment under ISA2027, DEKRA can support you in understanding the assessment process and applicable requirements.
FAQ
No. ISA2027 is the updated assessment catalogue used as the basis for TISAX® assessments. It is not a separate certification scheme.
It applies to TISAX® assessments ordered from 1 January 2027, subject to the published transition arrangements.
No. The annual publication cycle does not change the validity period of TISAX® labels, which remains up to three years.
Key developments include year-based versioning, updated standards references, improved requirement clarity, and supplier security considerations.
No. Existing labels retain their validity, subject to their original validity period.
Organizations should review the updated catalogue, assess their existing information security controls and plan their next assessment according to the applicable transition requirements.
The information in this article is based on the VDA ISA2027 catalogue and information published by the ENX Association. Organizations should consult the official ENX publications and confirm applicable assessment and transition arrangements with their assessment provider.
