On 1 July 2026, the German Association of the Automotive Industry (VDA) published the successor to VDA ISA 6 – the assessment catalogue on which every TISAX® assessment is based. Many expected “ISA 7.0”; officially the new version is called ISA 2027, because the VDA has switched to year-based version names. The structure is largely retained – but the requirements become more binding, the supply chain moves more sharply into focus and prototype protection has been completely rebuilt.
The key facts in numbers
- Year-based naming: “2027” instead of “7.0” – from now on a catalogue will be published every year (ISA 2028 has been announced for summer 2027). Labels nevertheless remain valid for up to three years.
- Information security: 46 control numbers, 45 of them effective – as in ISA 6 (3.1.2 remains replaced by 1.6.3, 5.2.8 and 5.2.9). There are no new controls; 1.2.4 becomes 6.1.3. Requirements change specifically in 10 controls, plus rewording throughout the catalogue.
- Prototype protection: from 22 to 20 controls, in two instead of five sections – the module has been completely restructured (13 organisational, 7 physical controls).
- Data protection: unchanged – the change history lists no changes for the 12 controls in chapter 9.
- New framework mapping: ISA 2027 refers to NIST CSF 2.0, ISO/IEC 27001:2022 and IEC 62443; the old references to ISO 27001:2013 are dropped.
From recommendation to obligation
The most consequential change is a quiet one: requirements move from the should level (recommendation) to the must level (obligation). Two examples:
- Control 1.1.1: making security policies available to employees and informing them about relevant changes used to be a should requirement – in ISA 2027 it is mandatory.
- Control 4.1.2: passwords according to the state of the art move from a side note into the regular requirements.
If your ISMS was built only to reach the must threshold of ISA 6, this is exactly where the first new gaps arise.
Chapter overview
| Chapter | What changes | Rating |
|---|---|---|
| 1 – IS policies | Making policies available to employees is now a must requirement (1.1.1) | Minor change |
| 2 – Human resources | Training programmes for senior management added (2.1.3), must requirements for mobile working reworded (2.1.4) | Major change |
| 3 – Physical security | Individual clarifications | Minor change |
| 4 – Access management | Password requirement reworded (4.1.2), time limit on identification means for high protection needs removed (4.1.1) | Minor change |
| 5 – IT security | Individual adjustments, e.g. IT service continuity for high protection needs (5.2.8), control question switched to IT services (5.3.1) | Minor change |
| 6 – Suppliers | Supplier verification tightened for high and very high protection needs (6.1.1), 1.2.4 becomes 6.1.3 | Major change |
| 7 – Compliance | Rewording only | Minor change |
| 8 – Prototype protection | Completely restructured: two instead of five sections, 22 → 20 controls | Major change |
| 9 – Data protection | No changes | Unchanged |
We explain the logic of the questionnaire — maturity levels, assessment levels, audit logic — in detail under TISAX® questionnaire.
The supply chain moves into focus
Control 1.2.4 (external IT service providers) moves into the supplier chapter as the new control 6.1.3. The “Supplier SoA” must requirement planned in the first draft was removed again with version 2027.1. The real tightening lies in 6.1.1: for high protection needs, suppliers' security evidence must in future be documented and reviewed regularly and whenever there is cause; for very high protection needs, a third-party audit or a suitable TISAX® label of the supplier is expected. Supplier management thus becomes one of the areas with noticeably growing effort.
Prototype protection: rebuilt, not extended
Prototype protection is the biggest structural change: the five sections of ISA 6 (8.1 to 8.5) are merged into two (8.1 organisational, 8.2 physical and environmental security), controls are combined and outdated content is removed – the module shrinks from 22 to 20 controls (13 organisational, 7 physical); new ones include 8.1.1, 8.1.2, 8.1.4 and 8.1.11–8.1.13. If your assessment scope includes prototype protection, your documentation structure must be remapped, even if the underlying measures stay the same.
What stays the same: data protection
Chapter 9 (data protection) is unchanged – the ISA 2027 change history lists no changes for its 12 controls. If your scope includes the data protection module, nothing changes here.
When does VDA ISA 2027 apply?
ENX has set the cut-off date: VDA ISA 2027 applies to all TISAX® assessments commissioned from 1 January 2027. Assessments commissioned by 31 December 2026 continue under ISA 6. The decisive factor is the ISA version at the time the initial assessment is commissioned. Existing TISAX® labels remain valid for their full term (up to three years); the annual catalogue cycle does not lead to annual assessments. ISA 2028 is expected to be published in summer 2027.
What you should do now
- Plan when to commission: if your assessment is commissioned in 2026, ISA 6 applies; assessments commissioned from 1 January 2027 run under ISA 2027.
- Review the substantial chapters first: 1, 2, 6 and 8 – policies, senior management training and mobile working, supplier management and prototype protection.
- Check the should-to-must promotions: previously optional requirements may now be mandatory.
- Run a GAP analysis against the changed controls instead of reworking the entire catalogue.
How 360 Digitale Transformation supports you
We support you in moving to VDA ISA 2027 – from the gap analysis against ISA 2027 through implementing the tightened controls and remapping prototype protection to preparing for the assessment. The basis is a comparison of your ISMS with the TISAX® questionnaire and the TISAX® requirements. Still on ISA 6? Then, too, the move starts with the gap analysis – the path to the label remains the same.
Source: VDA – Information Security
About the Author
Can Adigüzel is co-founder and managing director of 360 Digitale Transformation GmbH, a consultant on TISAX® and an ISO 27001 Lead Auditor with more than 200 audits. He has worked in IT project management since 2012 and in information security since 2019. He helps SMEs implement information security pragmatically.