01 · ISMSIS
Information security
Assess the management system and safeguards used to protect sensitive information across automotive operations and partnerships.
VDA ISA · Automotive information security
Turn supplier assurance into a living system.
Connect automotive sites, services, assets, suppliers, policies, risks, evidence and remediation around the VDA ISA assessment journey—without reducing readiness to a one-off questionnaire.
The supplied STORM technical description does not list VDA ISA as a current built-in framework. STORM provides documented governance and assessment building blocks; confirm catalogue content and mappings before use.
Automotive assurance networkEvidence connected
ISAassurance scope
OEM requirementsObjectives & protection needs
Sites & operationsAssets, people and processes
Tiered suppliersDependencies and evidence
Findings & actionsOwnership and remediation
Scope · self-assessment · evidence · remediation
ISA 6.0.3current assessment catalogue baseline during the 2026 transition
ISA2027published for assessments ordered in 2027
3 cataloguesinformation security, prototype protection and data protection
12 objectivesthe current TISAX assessment objectives described by ENX
What the assessment can address
One catalogue family. Different protection needs.
VDA ISA is the requirements catalogue underlying TISAX. The selected assessment objectives determine which catalogue content, questions and requirement levels apply to the organisation's scope.
02 · ConfidentialityC
Confidential information
Address high or very high confidentiality needs according to the information handled for automotive partners.
03 · AvailabilityA
Operational availability
Address availability needs where disruption to products or services could quickly affect a customer's ability to produce or deliver.
04 · PrototypeP
Prototype protection
Cover relevant prototype parts, vehicles, test vehicles, events and associated physical or organisational safeguards.
05 · PrivacyD
Data protection
Address processor responsibilities for personal data and, where relevant, special categories of personal data.
06 · EcosystemS
Supply-chain assurance
Create a common assessment baseline for manufacturers, suppliers, service providers, engineering partners and software organisations.
Product evidence boundary
Strong operating workflows, without an unsupported VDA ISA claim.
The technical description documents configurable assessments and extensive evidence workflows, but it does not name VDA ISA among STORM's current built-in frameworks.
Documented STORM building blocks
- Supplier inventory, tiering and assessments
- Configurable questionnaires and evidence uploads
- Asset, service and dependency cartography
- Risk, policy, incident and remediation workflows
- Audit records, management reviews and exports
Must be confirmed or configured
- Official ISA 6 or ISA2027 catalogue content
- Ready-made VDA ISA assessment template
- Mappings to assessment objectives and protection needs
- VDA ISA maturity scoring and reporting logic
- Direct ENX Portal or audit-provider integration
Where STORM can support readiness
Connect every answer to accountable evidence.
Use documented STORM capabilities to organise the operational record behind an automotive security programme while official ISA content, maturity interpretation and TISAX assessment decisions remain outside the product claim.
Scope & cartography
Model locations, services, processes, data, hardware, software, users and external providers together with their dependencies.
Sites · assets · servicesConfigurable assessments
Create tailored internal or supplier questionnaires, track implementation status, compare periods and schedule reassessments.
Self-assessment · reviewSupplier evidence
Let suppliers complete assigned questionnaires, upload supporting evidence per control and make submissions available for review.
Portal · evidence · oversightRisk & remediation
Capture risks, likelihood, impact, controls, treatment decisions, mitigation plans, owners, dates and supporting attachments.
Risk register · actionsPolicy governance
Manage policy authoring, versions, approvals, acknowledgements, scheduled reviews and mappings with a retained audit trail.
Policy Center · lifecycleAudit & management review
Consolidate findings, risks, incidents, supplier results, policy status and improvement actions into structured oversight records.
Audit · review · reporting
Coordinate the ecosystem
Turn supplier submissions into a managed assurance record.
STORM combines supplier inventory, configurable questionnaires, evidence uploads, implementation status and remediation tracking. That supports automotive supplier oversight without claiming a preconfigured VDA ISA questionnaire.
- Supplier classification and configurable assessment criteria
- Control-level evidence collection through the Supplier Portal
- Review schedules, reassessment reminders and reports
Keep scope connected
Relate assessment gaps to the systems and services at risk.
Cartography gives teams a reusable view of assets, operations and third parties. Findings can then be managed as risks with treatments, owners, due dates and attachments instead of remaining isolated questionnaire answers.
- Business services, processes, assets and external dependencies
- Impact, threat and vulnerability assessment context
- Risk treatment, acceptance and mitigation ownership
Maintain the operating record
Keep policies, incidents and corrective work reviewable.
Controlled documents, incident records, internal audit findings and management reviews support the evidence trail behind security operations. Qualified teams and approved TISAX audit providers remain responsible for assessment conclusions.
- Document lifecycle, acknowledgements and history
- Incident ownership, root cause and corrective action
- Audit findings and management-review follow-through
Catalogue and process
01
02
03
04
Keep the content, assessment and exchange roles distinct.
The official materials separate the ISA catalogue from the TISAX assessment and result-sharing mechanism.
Information Security
The core catalogue addresses a shared baseline for information and cybersecurity management across the automotive ecosystem.
ISMS · safeguards · maturityPrototype Protection
Applicable objectives bring in requirements for protected parts, vehicles, test vehicles and prototype-related events.
Physical · organisational · handlingData Protection
Applicable objectives address processor activities involving personal data and special categories under the GDPR context.
Processor · personal data · evidenceTISAX process
Registration, scope, self-assessment, independent assessment, corrective action and controlled result exchange sit around the catalogue.
ENX · audit provider · labelsThese summaries do not reproduce the official ISA questions or requirements. Use the applicable official catalogue and the ENX Participant Handbook when defining assessment scope and objectives.
Readiness workflow
01
02
03
04
From partner requirement to controlled follow-through.
STORM can organise readiness work; TISAX registration, assessment and labels follow the official ENX process.
Define
Confirm locations, scope, partner expectations, protection needs and assessment objectives.
Scope · objectivesAssess
Use the applicable official ISA content to evaluate implementation and assemble supporting evidence.
Self-assessment · evidenceRemediate
Convert gaps into owned actions, risks, policy changes and retained proof of completion.
Findings · treatment · ownersDemonstrate
Work with an approved audit provider and share resulting labels through the ENX Portal as authorised.
Independent assessment · exchangePractical questions
Separate readiness support from the official assessment outcome.
Clear boundaries make the page more credible for automotive buyers and audit teams.
What is the difference between VDA ISA and TISAX?
VDA ISA is the assessment catalogue published by VDA and maintained through the ENX Working Group ISA. TISAX is the governed assessment and result-exchange mechanism that uses the ISA as its foundation.
Which ISA version applies during the 2026–2027 transition?
ENX lists ISA 6.0.3 as the current basis for assessments in the existing cycle and has published ISA2027 for assessments ordered in 2027. The downloads page also describes transition dates, so organisations should confirm the applicable catalogue with ENX and their audit provider before starting.
Does STORM currently include a ready-made VDA ISA assessment?
The supplied technical description does not list VDA ISA among the current built-in frameworks and does not document a ready-made VDA ISA template. It does document configurable assessments, supplier questionnaires, evidence collection and supporting GRC workflows.
Can STORM issue a TISAX label?
No. ENX states that TISAX assessments are conducted by approved independent audit providers and that the resulting labels are handled through the official TISAX process and ENX Portal. STORM can organise readiness records and evidence.
Can suppliers upload evidence through STORM?
Yes. The technical description explicitly documents supplier questionnaires, implementation-status responses, control-level supporting evidence uploads, consultant review and assessment-report generation.
Does the page reproduce the official ISA requirements?
No. The page provides a high-level implementation view. Organisations should obtain and use the applicable official VDA ISA catalogue and ENX guidance for the actual questions, requirements, maturity logic and assessment process.
Bring your automotive scope
Book a STORM demo
Test STORM against the evidence your partners will actually review.
Walk through your sites, suppliers, assessment objectives, policies, risks, evidence and remediation needs—and identify the official ISA content that must be configured.