TISAX (VDA ISA v6)
The VDA ISA catalog required across the automotive supply chain.
What TISAX (VDA ISA v6) is
TISAX is the assessment and exchange mechanism used across the European automotive industry, operated by the ENX Association on behalf of the VDA. The underlying catalogue is the VDA ISA — the German automotive industry's information security assessment questionnaire — and the "exchange" half is the point: an assessment result is published on the ENX platform and shared with multiple customers, so a supplier is assessed once rather than by every OEM separately.
The VDA ISA v6 catalogue is organised as chapters covering information security policies and organisation, human resources, physical security and business continuity, identity and access management, IT security, supplier relationships, and compliance. Each question is scored on a maturity scale from 0 to 5, with 3 — an established and documented process — as the normal target, and assessment levels (AL2, AL3) determining how deeply an auditor verifies.
There are three assessment scopes: Information Security, Prototype Protection, and Data Protection. Information Security is the one nearly every supplier needs and by far the largest share of the market.
Who it applies to
- Automotive suppliers at any tier being asked for a TISAX label by an OEM or a Tier 1.
- Engineering services, software and cloud providers selling into automotive manufacturers.
- Suppliers already ISO 27001 certified who have discovered that certificate does not satisfy the ask — although it gets them most of the way.
How it is structured in CMDash
CMDash seeds the Information Security catalogue, flattening each VDA ISA question's sub-requirements into individual rows so that evidence can be attached per sub-control — the same expansion approach used for the FedRAMP control enhancements.
| Information Security Policies and Organization | 13 |
| Human Resources | 7 |
| Physical Security and Business Continuity | 7 |
| Identity and Access Management | 11 |
| IT Security | 22 |
| Supplier Relationships | 6 |
| Compliance | 8 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
Scope: Information Security catalog. Prototype Protection and Data Protection are not included.
The control text
ENX distributes the VDA ISA workbook at no cost under its own terms of use, which do not permit redistribution of the catalogue text.
CMDash ships the control identifiers, the titles, and its own evidence-requirement guidance. If you hold a licence, you can import the official text yourself through the framework CSV import, which records it as customer-provided.
Download free from the ENX Portal →Free to download, but not redistributable
What CMDash does for TISAX (VDA ISA v6)
- The Information Security catalogue tracked per sub-control with owners, statuses and dated evidence.
- By some distance the strongest ISO 27001 crosswalk in the catalogue — the mapping to 27001:2022 Annex A is the densest framework pair CMDash seeds. If you hold a 27001 certificate, this is where you find out how much of TISAX you have already done.
- Further seeded crosswalks to NIST CSF and FedRAMP.
- A time-boxed read-only seat for the audit provider, scoped to TISAX, with access recorded.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to TISAX (VDA ISA v6)’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- The Prototype Protection and Data Protection sub-catalogues are not seeded. They are separate TISAX assessment scopes; if an OEM has asked for one of those labels, this control set does not cover it.
- ENX and the VDA license the ISA catalogue. CMDash ships control identifiers, titles and its own evidence guidance rather than reproducing the questionnaire.
- The VDA ISA 0–5 maturity scale is not modelled per control. CMDash tracks implementation status, not a maturity score, so the target-maturity-level view a TISAX assessment produces is not reproduced here.
- TISAX labels are issued by ENX-accredited audit providers. CMDash is not one.
Common questions
We have ISO 27001. Do we still need TISAX?
Yes, if an OEM has asked for a TISAX label — the label is what gets exchanged on the ENX platform and a 27001 certificate does not substitute for it. But the overlap is enormous: the 27001-to-TISAX crosswalk CMDash seeds is the densest framework pair in the product, and a certified organisation is usually closer to an AL2 assessment than it expects.
Does this cover Prototype Protection?
No. Only the Information Security catalogue is seeded. Prototype Protection and Data Protection are separate assessment scopes with their own requirements, and neither is included.
Does CMDash track the VDA ISA maturity levels?
Not per control. TISAX scores each question 0 to 5 and assesses against a target level; CMDash tracks implemented / in progress / not applicable and the evidence behind each. If maturity scoring is central to how you run the assessment, that is a gap worth knowing about before you buy.
Also in Audit & Attestation
Paid plans cap how many frameworks you run at once, never which ones — TISAX (VDA ISA v6) is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.