TISAX (VDA ISA v6) control library
Every control CMDash tracks for TISAX (VDA ISA v6), in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
74 controls7 families74 mapped to other frameworksIdentifiers and titles only — text is licensed
Why the control text is not on this page
ENX distributes the VDA ISA workbook at no cost under its own terms of use, which do not permit redistribution of the catalogue text.
CMDash publishes the identifiers, titles and cross-framework mappings so you can see the shape of what is tracked, and links you to VDA, distributed via ENX Association for the document itself. A tenant that holds its own licence can load the real text through the framework import.
Download free from the ENX Portal →Families
Information Security Policies and Organization · 13
Human Resources · 7
| 2.1.1 | Qualification of employees is verified Maps to FedRAMP Moderate, ISO/IEC 27001:2022 |
| 2.1.2 | Employment contracts include confidentiality obligations Maps to ISO/IEC 27001:2022 |
| 2.1.3 | Disciplinary process for IS violations is defined Maps to ISO/IEC 27001:2022 |
| 2.2.1 | Handling of external contractors and suppliers on site Maps to ISO/IEC 27001:2022 |
| 2.2.2 | Termination and role-change procedures revoke access Maps to ISO/IEC 27001:2022 |
| 2.3.1 | Information security awareness programme is in place Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 2.3.2 | Training completion is tracked per employee Maps to ISO/IEC 27001:2022 |
Physical Security and Business Continuity · 7
| 3.1.1 | Physical security perimeters are defined and controlled Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 3.1.2 | Access to security zones is granted on a need basis Maps to ISO/IEC 27001:2022 |
| 3.2.1 | Office and work areas are protected Maps to ISO/IEC 27001:2022 |
| 3.2.2 | Handling of data-bearing media off premises Maps to ISO/IEC 27001:2022 |
| 3.3.1 | Protection against environmental threats Maps to ISO/IEC 27001:2022 |
| 3.4.1 | Business continuity management is established Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 3.4.2 | Continuity plans are tested and maintained Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
Identity and Access Management · 11
| 4.1.1 | User identity lifecycle is managed Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 4.1.2 | User accounts are uniquely identifiable Maps to ISO/IEC 27001:2022 |
| 4.2.1 | Secure logon procedures are enforced Maps to ISO/IEC 27001:2022 |
| 4.2.2 | Strong authentication is used where risk requires Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 4.3.1 | Privileged access is strictly controlled Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 4.3.2 | Privileged activity is logged and reviewed Maps to ISO/IEC 27001:2022 |
| 4.4.1 | Remote access is secured Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 4.4.2 | Remote access is monitored Maps to ISO/IEC 27001:2022 |
| 4.5.1 | Network access is authenticated and authorised Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 4.6.1 | Shared or technical accounts are governed Maps to ISO/IEC 27001:2022 |
| 4.6.2 | Access rights are reviewed at least annually Maps to ISO/IEC 27001:2022 |
IT Security · 22
| 5.1.1 | Change management process is defined and followed Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.1.2 | Emergency changes follow a documented procedure Maps to ISO/IEC 27001:2022 |
| 5.2.1 | Secure development lifecycle is established Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.2.2 | Source code is protected and access is controlled Maps to ISO/IEC 27001:2022 |
| 5.2.3 | Security testing is performed during development and release Maps to ISO/IEC 27001:2022 |
| 5.3.1 | Technical vulnerabilities are identified and managed Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.3.2 | Vulnerabilities are remediated within defined timeframes Maps to ISO/IEC 27001:2022 |
| 5.4.1 | Security incidents are detected and handled Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.4.2 | Incidents are classified and escalated appropriately Maps to ISO/IEC 27001:2022 |
| 5.4.3 | Lessons learned from incidents drive improvements Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.5.1 | Backup procedures protect critical information Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.5.2 | Backup restoration is tested regularly Maps to ISO/IEC 27001:2022 |
| 5.6.1 | Cryptographic controls protect sensitive data Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.6.2 | Cryptographic keys are managed securely Maps to ISO/IEC 27001:2022 |
| 5.7.1 | Networks are segmented according to trust zones Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.7.2 | Perimeter protection (firewalls, proxies) is in place Maps to ISO/IEC 27001:2022 |
| 5.7.3 | Wireless networks are secured Maps to ISO/IEC 27001:2022 |
| 5.8.1 | Logging captures security-relevant events Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.8.2 | Logs are protected against tampering Maps to ISO/IEC 27001:2022 |
| 5.8.3 | Security events are monitored and alerted on Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.9.1 | Endpoints are protected against malware Maps to FedRAMP Moderate, ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.9.2 | Mobile devices are managed and secured Maps to ISO/IEC 27001:2022 |
Supplier Relationships · 6
| 6.1.1 | Information security requirements for suppliers are defined Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 6.1.2 | Supplier agreements include security obligations Maps to ISO/IEC 27001:2022 |
| 6.2.1 | Supplier security is assessed before engagement Maps to ISO/IEC 27001:2022 |
| 6.2.2 | Supplier security is monitored over time Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 6.3.1 | Outsourced IT services are governed Maps to ISO/IEC 27001:2022 |
| 6.4.1 | Supply-chain IT security risks are managed Maps to ISO/IEC 27001:2022 |
Compliance · 8
| 7.1.1 | Legal and regulatory requirements are identified Maps to ISO/IEC 27001:2022 |
| 7.1.2 | Contractual security obligations are tracked Maps to ISO/IEC 27001:2022 |
| 7.2.1 | Data protection requirements (GDPR, national law) are met Maps to ISO/IEC 27001:2022 |
| 7.3.1 | Audit evidence is preserved and available Maps to ISO/IEC 27001:2022 |
| 7.3.2 | Internal audits of IS controls are performed Maps to ISO/IEC 27001:2022 |
| 7.4.1 | Cryptographic use complies with applicable law Maps to ISO/IEC 27001:2022 |
| 7.5.1 | Cross-border data transfers are governed Maps to ISO/IEC 27001:2022 |
| 7.6.1 | Records are retained and disposed of according to policy Maps to ISO/IEC 27001:2022 |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for TISAX (VDA ISA v6) v6, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.