Note: with VDA ISA 2027, the VDA published the successor catalogue on 1 July 2026. According to ENX, it applies to all TISAX® assessments commissioned from 1 January 2027. All the changes are covered in our article VDA ISA 2027 – the most important changes.
With VDA ISA 6.0, the German Association of the Automotive Industry (VDA) fundamentally updated the assessment catalogue for TISAX®. Since 1 April 2024, version 6.0 has replaced the previous version 5.1. New assessments commissioned up to 31 December 2026 are carried out under 6.0; from 1 January 2027, VDA ISA 2027 applies. The update noticeably extends the information security requirements, particularly in incident and crisis management, business continuity, backup/recovery and the completely revised data protection module.
What is new in VDA ISA 6.0?
New controls and requirements
A stronger focus on IoT/OT, software management (approval, licensing, patch management), incident/crisis management, IT service continuity and backup/recovery. New or renamed controls include: 1.3.4 software approval, 1.6.2 management of security incidents, 1.6.3 handling crises (replaces 3.1.2), 5.2.8 IT service continuity planning, 5.2.9 backup and recovery.
Revised data protection module
Completely restructured, now with 12 controls (9.1.1–9.8.1) aligned with the GDPR: data protection policies, organisation, record of processing activities, DPIA, data transfers, data subject rights/incidents, human resources, instructions.
New labels
The previous labels “Info high”/“Info very high” were split into High/Very High Availability and Confidential/Strictly Confidential – for a more precise classification of protection needs.
Figures 5.1 vs. 6.0
VDA 5.1: 41 controls, 271 requirements (Info high/AL2), 5 requirements (Info very high/AL3). VDA 6.0: 46 control numbers, 45 of them effective controls (3.1.2 replaced by 1.6.3, 5.2.8 and 5.2.9), 297 requirements (Info high/AL2), 17 requirements (Info very high/AL3) – around 12% more requirements overall; the additional implementation effort depends on the maturity of your ISMS.
Validity & transition
Binding for all assessments commissioned from 1 April 2024 to 31 December 2026. For assessments commissioned from 1 January 2027 – including re-assessments – VDA ISA 2027 applies.
The transition from 5.1 to 6.0 – step by step
- Conduct a GAP analysis
- Update documentation
- Implement new controls
- Training & awareness
- Internal audit
- Management review
- TISAX® assessment by an ENX-approved audit provider
How 360 Digitale Transformation supports you
We support you in assessments under VDA ISA 6.0 and in the move to VDA ISA 2027 – from the GAP analysis through implementing the controls to assessment preparation. Foundations: the TISAX® questionnaire and the overview of the requirements. Happy to help as part of our consulting on TISAX®.
Book a free initial consultation
About the Author
Can Adigüzel is co-founder and managing director of 360 Digitale Transformation GmbH, a consultant on TISAX® and an ISO 27001 Lead Auditor with more than 200 audits. He has worked in IT project management since 2012 and in information security since 2019. He helps SMEs implement information security pragmatically.