It covers one site, one protection objective and one assessment level. From level 2 upwards, the auditor wants technical evidence for it. We deliver that evidence, mapped to the chapters of the VDA ISA questionnaire.
VDA ISA 6.0, mandatory since 1 April 2024
AL 1 to AL 3
Report within 5 working days
What a label is made of
Three details, one label
1Scope
One site that processes confidential OEM information. A second site means a second assessment object.
2Protection objective
Confidential
Strictly Confidential
High Availability
Very High Availability
Prototype protection
Data Protection
3Assessment level
Your OEM sets it, not you. For Tier-1 suppliers, AL 2 is the most common level.
AL 1
Self-assessment, no external review. No label is issued.
Pentest voluntary
AL 2
Plausibility check by an approved audit provider, usually remote.
Pentest expected
AL 3
Full on-site audit with document inspection and interviews.
Pentest expected, extended scope
=Every combination produces a label of its own. It is valid for three years, is not published and runs only via the ENX platform. You decide in which of the five disclosure levels from A to E a requesting partner sees it.
Which chapter we cover with which test
VDA ISA · Our test module
Chapters 1, 2ISMS and awarenessAwareness test, phishing, vishing, pretexting
Chapter 3Physical securityAccess control, tailgating, server rooms, disposal of storage media
Chapter 6Third partiesRemote access and interfaces of service providers
Prototype protection and data protection are standalone assessment modules, not part of the core questionnaire. We cover both as well.
Where our work ends
The auditor accepts our report as a technical evidence document. It does not replace the auditor. So that the quote raises no expectation we cannot meet, here are both side by side.
What we deliver
The pentest against a scope agreed in advance, physical and technical. The report with CVSS ratings, VDA ISA mapping and an executive summary. On top, a prioritised list of measures, so that before the appointment it is clear what comes first.
What we do not deliver
The assessment itself. That is carried out by an approved audit provider, and the label is issued by the ENX Association. No legal advice and no classification either: which level applies to you is set by your OEM.
The two standalone assessment modules
Prototype protection
Protection of prototype vehicles and components: covers, camouflage, secure storage, transport and access control to prototype areas. For this we test camera blind spots, storage areas and transport processes. The assessment object comprises several separate labels per protection objective, not a single one.
Data protection
Processing of personal data in the automotive context: consent, deletion concepts and technical protective measures. A standalone assessment module for data processing under Article 28 GDPR, in the two tiers Basic and High.
AL 1, AL 2 and AL 3 side by side
Criterion
AL 1
AL 2
AL 3
Assessment method
Self-assessment in the online questionnaire
Plausibility check with evidence and interviews
Full audit with document inspection and interviews
Assessment location
No appointment required
Usually a web conference
On site at the organisation
Conducted by
No external review
Approved audit provider
Approved audit provider
Label on the ENX platform
Not issued
Yes
Yes
Technical pentest
Recommended, voluntary
Expected in practice
Expected, extended scope
What lies behind the six protection objectives
Confidential
formerly Info High
Confidential information with a high protection need, such as development documentation. Typically demonstrated via AL 2.
Strictly Confidential
formerly Info Very High
Strictly confidential information such as unreleased vehicle concepts. Exclusively via AL 3 with an on-site audit.
High Availability
new with VDA ISA 6.0
Demonstrates that systems and processes meet defined requirements for recovery and continuity.
Very High Availability
new with VDA ISA 6.0
The highest availability tier. Relevant where an outage would directly threaten vehicle production at the OEM.
Prototype protection
several labels per protection objective
Components, prototype and test vehicles, events and shootings. Several labels rather than a single one.
Data Protection
Basic and High
Data processing under Article 28 GDPR in two tiers. Relevant as soon as you process personal data on behalf of an OEM.
Version 6.0, and why it matters for your appointment
VDA ISA 6.0 has been mandatory for newly commissioned assessments since 1 April 2024. It adds five controls, among them software approval, crisis management, IT service continuity, and backup and recovery, introduces dedicated availability labels and is aligned with ISO/IEC 27001:2022.
The label is valid for three years, but the questionnaire requires regular review of the technical measures, not just one at assessment time. A rhythm that has proven itself: a full pentest before the assessment, then a shorter test each year on whatever has changed.
Know what the auditor will find before the assessment
A 30-minute initial call, then a fixed-price quote, usually within 24 hours. Free of charge and without obligation.
Access Granted delivers the pentest and the technical evidence. Assessment and label run via an approved audit provider and the ENX platform, not via us. TISAX is a trademark of the ENX Association.
