The TISAX® questionnaire based on the VDA ISA is the foundation of every TISAX® assessment: it defines which information security requirements are assessed and how your maturity level is evaluated. Two versions are currently relevant — VDA ISA 6, under which all assessments commissioned in 2026 are carried out, and its successor VDA ISA 2027. On this page you will find the structure of the catalogue, the assessment levels and maturity levels, as well as the differences between the versions.

Current status: VDA ISA 2027 has been published

On July 1, 2026, the VDA published the successor to ISA 6 — officially VDA ISA 2027, as the association has switched to year-based naming. For your ongoing project, nothing changes for now: according to ENX, ISA 2027 is the basis for all TISAX® assessments commissioned from January 1, 2027. Assessments you commission in 2026 will continue to be carried out under ISA 6. The content of this page therefore still applies unchanged — but if you are going into your assessment in 2027, you should get to know the new catalogue now.

→ VDA ISA 2027: the most important changes in the catalogue

What is the VDA ISA questionnaire for TISAX®?

The VDA ISA catalogue version 6.0 is a questionnaire developed by the German Association of the Automotive Industry (VDA) to assess how manufacturers and suppliers in the automotive industry handle sensitive information.

This catalogue is based on the ISO 27001 standard for an information security management system (ISMS) and serves as the assessment objective for TISAX®. The auditor ensures that the minimum requirements are met and that continuous improvement in the handling of information is guaranteed.

Since April 1, 2024, TISAX® assessments have been carried out according to version 6.0; for all assessments commissioned from January 1, 2027, VDA ISA 2027 applies. In addition to the must and should requirements, the catalogue contains additional requirements for high and very high protection needs. It is important for companies to understand and implement the new requirements so that their data is adequately protected. The catalogue is available from the VDA or the ENX Association.

The revised TISAX® questionnaire in version 6 (previously version 5)

Since April 1, 2024, the VDA ISA catalogue has been updated to version 6. This update brings new labels and assessments under TISAX®. Version 5.0 or 5.1 is no longer valid for new commissions.

What changed with VDA ISA 6.0

The changes to the ISA catalogue 6.0 bring a number of new features. Automotive manufacturers and their suppliers must prepare for the new information security requirements of the VDA ISA. ISA 6 contains updated assessment objectives and a new catalogue of requirements to meet the TISAX® standard. The current version of the ISA catalogue 6.0 replaces version 5.1 and defines an assessment and exchange mechanism for information security based on ISO 27001.

TISAX® VDA ISA 5.1 vs. 6.0 – How do the versions differ?

The main differences and changes between versions 5.1 and 6 are as follows:

- New labels: the previous “Information Security” label has been split into “Confidentiality” and “Availability”.
- New controls: version 6.0 adds controls on incident management, crisis management, backup/recovery and IT service continuity.
- Implementation of Industry 4.0 technologies (IoT/OT): the TISAX® controls are now more strongly focused on IoT/OT in order to meet stricter cybersecurity requirements.
- Data protection catalogue: this has been completely revised and now contains a total of 12 controls, divided into subgroups.
- New references: reference is made to ISO/IEC 27001:2022, BSI IT-Grundschutz, ISA/IEC 62443 and the NIST Cybersecurity Framework version 1.1.
- The leading language is now English.

With VDA ISA 2027, the next step is already on its way. Information security remains at 46 control numbers, 45 of which are in effect; there are no new controls, and the requirements of 10 controls change in concrete terms. Prototype protection has been completely restructured (from 22 to 20 controls, in two sections instead of five), while data protection remains unchanged. The most noticeable change is a quieter one: requirements move from the should level to the must level. If you built your ISMS only up to the must threshold of ISA 6, that is exactly where you will find the first new gaps.

Which maturity levels does the TISAX® questionnaire define?

The maturity levels of the ISA catalogue are defined as follows:

0 – incomplete
A complete process is lacking. No defined process is followed, or the process is not effective in achieving the intended objective.

1 – performed
A process that is not officially documented is followed (“informal process”), and there are indications that the objective is being achieved.

2 – managed
A process is followed that successfully achieves its objectives. There is documentation and evidence of process execution.

3 – established
A standard process integrated into the overall system is followed. Dependencies on other processes are documented and suitable interfaces have been created. There is evidence that the process has been used successfully over an extended period.

4 – predictable
A proven process is followed, and the effectiveness of this process is regularly monitored by collecting key figures. Certain thresholds are defined at which the process is considered ineffective and must be adjusted accordingly.

5 – optimizing
A structured process is followed in which continuous improvement is pursued as a key objective. Dedicated resources actively drive improvement.

How is the TISAX® questionnaire used to determine the maturity level?

As described above, the VDA ISA catalogue defines six maturity levels (0 to 5). When carrying out the GAP analysis, you need to evaluate your company, your processes, policies and documentation. This allows you to determine your maturity level accordingly. If you are unsure, rating yourself one level lower always gives you a safety margin.

At the end of the day, the auditor will assess the controls objectively. If a control is not fully applied or critical prerequisites are missing, this results in a low maturity level. The target maturity level in the VDA ISA is level 3 for every relevant control. If a control falls below this, the audit provider rates it as a minor or major nonconformity. Major nonconformities must be resolved within nine months of the closing meeting; if there are only minor nonconformities, a temporary label is possible. This also applies to prototype protection and data protection.

GAP analysis with the VDA ISA questionnaire

Carrying out a GAP analysis using the VDA ISA questionnaire aims to evaluate the current state of a company’s information security practices and to identify the gaps between the existing measures and the TISAX® requirements for level 2 or 3.

How this process can work in detail with the ISA questionnaire

1. Preparation: first of all, the company should obtain the VDA ISA questionnaire and go through it thoroughly to develop an understanding of the requirements it contains. Make sure that all relevant areas are covered, including data protection, physical security, IT security, emergency management etc.
2. Carrying out the GAP analysis: equipped with the questionnaire, the company can carry out a systematic review of its current information security practices. This includes evaluating the existing processes, policies, technologies and controls against the requirements of the VDA ISA questionnaire.
3. Identifying gaps: during the GAP analysis, areas will probably be identified in which the company does not meet the requirements. These gaps can take the form of missing policies, insufficient technical security measures, a lack of employee training or other deficits.
4. Prioritization and planning: once the gaps have been identified, it is important to prioritize them according to their urgency and potential risk. Companies should develop an action plan to close these gaps, including allocating resources, setting deadlines and monitoring progress. A regular internal audit can also be helpful.

Before you apply the questionnaire, the scope must be settled — otherwise you assess too much or too little. Our scoping guide shows which sites, processes and service providers belong in the scope.

External consulting can be very helpful in this process:

- Expert knowledge: an external consultant with experience in preparing for the TISAX® assessment and in working with the VDA ISA questionnaire can offer valuable expertise and insights. They ensure that the GAP analysis is carried out thoroughly and comprehensively, and provide advice and support in preparing for the TISAX® assessment.
- Objectivity: external consulting can bring an objective perspective and help identify potential gaps or weaknesses that may have been overlooked internally.
- Accelerating the process: working with an experienced consultant can speed up the GAP analysis, as they already have proven methods and tools.
- Preparing for the assessment: an external consultant can help the company develop a clear action plan to close the identified gaps and prepare effectively for the TISAX® assessment.

Overall, the VDA ISA questionnaire plays a central role in carrying out a GAP analysis for obtaining the TISAX® label. Involving an external consultant can make the process more efficient and effective. To help a company meet the associated information security requirements, here is a detailed article on carrying out a GAP analysis with the questions of the criteria catalogue.

Book a workshop with us and save time and money

In a one-day workshop, we support you with your GAP analysis for TISAX®. At the end of the workshop, you receive not only the results but also your TISAX® roadmap, a comprehensive project plan tailored to your company. Here you will find the details of our GAP analysis for TISAX®.

External help will also reduce the time spent on the GAP analysis. A one-day workshop with preparation and a final report costs €3,500 (up to 50 employees) or €4,500 (50 employees or more).

Summary

Whether you want to carry out the GAP analysis yourself or bring in external help, the benefit of the GAP analysis is enormous – and at the same time crucial to the success of your TISAX® project!

About the author

Can Adigüzel

Can Adigüzel is co-founder and managing director of 360 Digitale Transformation GmbH, a consultant for TISAX® and ISO 27001 Lead Auditor with more than 200 audits. He has worked in IT project management since 2012 and in information security since 2019. He helps SMEs implement information security pragmatically.