Information security inside companies

With VDA ISA 2027, the German Association of the Automotive Industry (VDA), together with ENX, has systematically enhanced the TISAX® assessment catalogue and aligned it with current information security requirements. As the basis for all TISAX® assessments, the VDA ISA catalogue defines the security requirements for companies across the automotive supply chain. The new version aims to place greater emphasis on international standards, formulate requirements more clearly, and further improve the comparability of assessments.  
 
With VDA ISA 2027, the VDA is consistently advancing the TISAX® assessment catalogue and establishing a modern foundation for information security in the automotive industry. Companies should review the changes at an early stage and align their documentation and processes with the new requirements. This will enable them to prepare efficiently for future TISAX® assessments while sustainably strengthening their own information security.  
 
Alignment with Current Standards  
The VDA has aligned the ISA catalogue with the current ISO/IEC 27001:2022 standard and has also integrated a mapping to the NIST Cybersecurity Framework (CSF) 2.0. This strengthens alignment with internationally recognized security standards and enables companies to more easily align their existing information security management systems with TISAX® requirements.  
 
Clearer and More Precise Requirements  
Many controls have been revised and clarified to reduce room for interpretation. In addition, individual recommendations have been converted into mandatory requirements, while existing measures, for example regarding password security or organizations with high protection needs, have been updated to reflect the current state of the art.  
 
Greater Focus on the Supply Chain  
In VDA ISA 2027, the VDA strengthens the requirements for supplier management. In the future, companies will be required to demonstrate even more transparently how security-relevant IT service providers are assessed and monitored. The Supplier Statement of Applicability (Supplier SoA) will also play a more significant role.  

Revised "Prototype Protection" Module  
The Prototype Protection module has been completely revised. In addition to a new structure, controls have been consolidated, organizational requirements have been added, and outdated content has been removed. This makes practical implementation significantly easier.

The automotive industry is one of the world’s most innovative and highly interconnected sectors. Global supply chains, digitalized production processes, intelligent vehicles, and cloud-based development environments make companies more efficient, but at the same time increase their exposure to threats. Cyberattacks, economic espionage, sabotage, or disruptions to critical infrastructure can cause substantial economic damage within a very short period of time. Against this backdrop, economic security is becoming increasingly important from a strategic perspective. The VDA understands economic security as a holistic approach to protecting companies, technologies, know-how, and supply chains. The objective is to strengthen the resilience of the entire automotive value chain and make companies more resilient to both physical and digital threats. Information security, cybersecurity, the protection of classified and sensitive information, product protection, crisis management, and physical security are closely interconnected. 

The requirements for economic security have changed significantly in recent years. In addition to protecting sensitive development data, the focus today also includes securing production facilities, operational technology (OT), supply chains, and critical services. Modern attacks increasingly aim to disrupt production processes, steal intellectual property, or deliberately cause economic harm to companies. For companies in the automotive industry, this means that security measures should not be considered in isolation but integrated into a holistic security and risk management approach. Economic security is therefore becoming a key element of corporate strategy and makes an important contribution to safeguarding companies’ capacity for innovation and their competitiveness.  

With the introduction of new legal requirements, such as the KRITIS Umbrella Act (KRITIS-Dachgesetz) and the KRITIS Regulation (KRITIS-Verordnung), the protection of critical facilities is moving further into focus. At the same time, geopolitical developments and increasing digitalization demonstrate that industrial production and logistics structures also play a central role in security of supply and economic stability. The VDA advocates for the specific requirements of the automotive industry to be taken into account when shaping these regulatory frameworks. Modern production networks, central control systems, and global platforms need to be protected, while companies should not be burdened by unnecessary regulatory duplication or disproportionate requirements.

Effective economic security does not end at company boundaries. The security of the entire supply chain is increasingly becoming a decisive success factor. Manufacturers, suppliers, and service providers must work together to establish security standards, identify risks at an early stage, and implement appropriate protective measures. To support this, the VDA promotes exchange and cooperation within the industry and supports the development of common security standards and best practices. Economic security is becoming a key success factor for the automotive industry. In light of growing geopolitical risks, increasing digitalization, and ever more complex supply chains, traditional information security alone is no longer sufficient. The VDA therefore pursues a holistic approach that combines cybersecurity, physical security, resilience, and the protection of critical infrastructure. Companies that recognize economic security as a strategic priority at an early stage not only strengthen their compliance but also safeguard their innovative capacity, ability to deliver, and competitiveness in the long term.