Skip to content

TISAX pentest: what the VDA ISA catalogue expects, and what it doesn’t

TISAX does not make penetration tests mandatory across the board. The VDA ISA catalogue that TISAX assessments use names penetration tests as one example of a suitable technical check: for critical IT systems at high protection needs, and for purpose-built or heavily customised software at very high protection needs. A pentest report gives your assessor exactly that evidence.

See my fixed price

Prefer to talk first? Book a call

To be clear: Mr Cyber is not a TISAX audit provider and holds no TISAX label itself. We don’t award labels; we deliver test results for your assessment.

What the VDA ISA catalogue says. Version 6.

  • Control 5.2.6: Technical checks of IT systems and services

    Asks to what extent IT systems and services are technically checked (system and service audit). For critical systems at high protection needs, the catalogue lists service-specific tests and penetration tests as examples.

  • Control 5.3.1: Security in new or further developed IT systems

    Asks how information security is considered in new or further developed IT systems. At very high protection needs, purpose-built or heavily customised software is to be tested, for example with penetration tests: at commissioning, after significant changes or at regular intervals.

  • Protection needs and assessment levels

    Requirements for high protection needs usually go with assessment level 2, very high with level 3. At normal protection needs, the catalogue does not name penetration tests at these points.

  • Check your version

    Quoted from VDA ISA 6. With ISA2027, numbering and wording may change. What counts is the version your assessment uses.

How a pentest supports your assessment

Your assessor wants to see how you check critical systems technically and what happens with the results. We align scope and report with the systems in your TISAX scope.

What you get

  • Scope matched to the critical systems in your TISAX scope
  • Report with timeframe, methodology and CVSS 3.1 ratings
  • Free retest within 60 days as proof of remediation
  • Attestation letter: one page with scope, timeframe and status after the retest
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price

Tests for suppliers.

Source: ENX: TISAX downloads (VDA ISA)

TISAX and penetration testing: FAQ

Is a penetration test mandatory for TISAX?
Not across the board. The VDA ISA catalogue names penetration tests as an example of technical checks at high and very high protection needs. At those points, the catalogue asks how you check critical systems technically, and a pentest report answers that question directly.
Do you award a TISAX label?
No. TISAX labels are issued by ENX after an assessment by an approved audit provider. Mr Cyber is not an audit provider and holds no TISAX label itself. We deliver the test results you present in your assessment.
Which protection need calls for a pentest?
At the points named above, only from high protection needs (usually assessment level 2): for critical IT systems and services. At very high protection needs (level 3), also for purpose-built or heavily customised software.
Do you test ECUs and vehicle components too?
Yes, as automotive security testing, quoted per project. Details: Automotive security testing.
How often should we test?
The catalogue names commissioning, significant changes and regular intervals. TISAX labels are valid for three years; testing critical systems at least once a year and after significant changes keeps your evidence current between assessments.

Also useful: NIS2 & CompliancePentest or vulnerability scan?Pentest for ISO 27001Pentest for cyber insurance

What should we test?

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call