VDA ISA 6.0.3 or ISA2027: which catalog version applies to your assessment

If you are planning your TISAX® assessment for the end of 2026 or for 2027, you are currently making a decision that will have an effect for three years: which catalog version you will be assessed against. VDA ISA 6.0.3 is still valid, ISA2027 has already been published, and between them lies a transition rule with a cut-off date. Here you will find which version applies to your assessment, what changes and what does not.

The VDA ISA (Information Security Assessment) is the criteria catalog of the German Association of the Automotive Industry (VDA). You assess yourself against it in the self-assessment, and the audit provider assesses you against it in the TISAX® assessment. It is available as an Excel file and consists of three modules: Information Security with 46 requirements, Prototype Protection with 22 and Data Protection with 12. In the first two modules, each requirement is rated with a maturity level from 0 to 5; in Data Protection, with yes or no.

Version 6.0.3 currently applies; it was published in April 2024 and has been the basis of all assessments started since April 1, 2024. There is no version 6.1; on its download page, ENX only lists ISA 6.0.3, its successor ISA2027, the corresponding redline versions and an archive of versions prior to December 2018.

On July 1, 2026, the VDA published the successor, and with it the numbering changes. Instead of consecutive version numbers, the catalog will in future bear the year from which it applies to newly commissioned TISAX® assessments: ISA2027 applies to assessments commissioned from January 1, 2027. ISA2028 is to follow in summer 2027, and further versions are to follow the same annual rhythm.

Important for planning: the annual rhythm does not increase the assessment frequency. Existing labels remain valid for their full term, and future labels will also continue to be valid for up to three years. So you are not reassessed every year; at the next commissioning, you are assessed against the catalog that is current at that time.

What matters is when you commission the audit provider, not when the assessment takes place:

• Commissioned by December 31, 2026: you can still be assessed against ISA 6. The initial assessment must then take place by March 2027 at the latest.
• Commissioned from January 1, 2027: the basis is ISA2027.
• Renewal: labels are generally valid for three years. For renewal, you go through the process again, with a new scope in the ENX portal and a new assessment, against the catalog that applies at the time of that commissioning. If you renew in 2027 or later, plan with the respective annual version.

If you start at the end of 2026, you therefore have a real choice: quickly under ISA 6 with the familiar catalog, as long as the deadline for the initial assessment is realistic, or directly under ISA2027, so that the renewal later builds on the same structure. Both are defensible; the only mistake is leaving the decision to the calendar.

The VDA documents the changes in the catalog’s change history, and ENX also provides a redline version from August 2026. The most important points for suppliers:

• The Prototype Protection module has been completely reorganized. The previous chapters on transport and handling, on test vehicles, and on events and shoots no longer exist as separate chapters; they are replaced by 13 organizational requirements, including the new incident management, and 7 requirements for physical security.
• Providing the security policies to employees (requirement 1.1.1) changes from a “should” to a “must” requirement.
• References to other standards are updated: NIST CSF 2.0 is added, the mapping to ISO 27001:2013 is dropped, ISO 27001:2022 remains.
• Individual requirements are moved or reworded, for example the former 1.2.4, which moves to supplier relationships as 6.1.3.

What does not change: the Data Protection module remains unchanged, with the same twelve requirements and the same wording. The maturity logic remains, and the assessment objectives and assessment levels are unchanged in the published documents. What remains open is how ENX maps the Test Vehicles and Proto Events assessment objectives to the reorganized prototype protection module; we will not make any statement on this before ENX does.

For us, the catalog version is part of scoping, not a detail that the audit provider determines later. Together with you, we clarify whether the deadline for an initial assessment under ISA 6 is realistic, what the restructuring of prototype protection means for your assessment objectives and what your renewal will look like in three years. We then conduct the self-assessment against exactly the version you will be assessed against. How the path from there to the label looks is described on our TISAX® consulting page.