---
title: "TISAX Pentest: Evidence for the VDA ISA Catalogue"
url: https://mr-cyber.com/tisax-penetration-testing
language: en
description: "TISAX pentest for automotive suppliers: what the VDA ISA catalogue says about penetration tests at high protection needs. Fixed price, retest included."
---

# TISAX pentest: what the VDA ISA catalogue expects, and what it doesn’t

TISAX does not make penetration tests mandatory across the board. The VDA ISA catalogue that TISAX assessments use names penetration tests as one example of a suitable technical check: for critical IT systems at high protection needs, and for purpose-built or heavily customised software at very high protection needs. A pentest report gives your assessor exactly that evidence.

[See my fixed price](https://mr-cyber.com/quote)

Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book)

To be clear: Mr Cyber is not a TISAX audit provider and holds no TISAX label itself. We don’t award labels; we deliver test results for your assessment.

## What the VDA ISA catalogue says. Version 6.

-   ### Control 5.2.6: Technical checks of IT systems and services
    
    Asks to what extent IT systems and services are technically checked (system and service audit). For critical systems at high protection needs, the catalogue lists service-specific tests and penetration tests as examples.
    
-   ### Control 5.3.1: Security in new or further developed IT systems
    
    Asks how information security is considered in new or further developed IT systems. At very high protection needs, purpose-built or heavily customised software is to be tested, for example with penetration tests: at commissioning, after significant changes or at regular intervals.
    
-   ### Protection needs and assessment levels
    
    Requirements for high protection needs usually go with assessment level 2, very high with level 3. At normal protection needs, the catalogue does not name penetration tests at these points.
    
-   ### Check your version
    
    Quoted from VDA ISA 6. With ISA2027, numbering and wording may change. What counts is the version your assessment uses.
    

## How a pentest supports your assessment

Your assessor wants to see how you check critical systems technically and what happens with the results. We align scope and report with the systems in your TISAX scope.

### What you get

-   Scope matched to the critical systems in your TISAX scope
-   Report with timeframe, methodology and CVSS 3.1 ratings
-   Free retest within 60 days as proof of remediation
-   Attestation letter: one page with scope, timeframe and status after the retest
-   Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
-   Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42

[See my fixed price](https://mr-cyber.com/quote?service=unsure&driver=tisax)

## Tests for suppliers.

-   [Automotive security testing ECUs, telematics and infotainment, with evidence for ISO/SAE 21434. Quoted per project.](https://mr-cyber.com/services/iot-hardware-penetration-testing#automotive)
-   [External network pentest Your internet-facing systems, from €1,900.](https://mr-cyber.com/services/external-network-penetration-testing)
-   [Web application pentest Portals and applications for OEMs and partners, from €2,900.](https://mr-cyber.com/services/web-application-penetration-testing)
-   [Internal network pentest Your on-site network and systems, from €3,800.](https://mr-cyber.com/services/internal-network-penetration-testing)

Source: [ENX: TISAX downloads (VDA ISA)](https://portal.enx.com/en-US/TISAX/downloads/)

## TISAX and penetration testing: FAQ

Is a penetration test mandatory for TISAX?

Not across the board. The VDA ISA catalogue names penetration tests as an example of technical checks at high and very high protection needs. At those points, the catalogue asks how you check critical systems technically, and a pentest report answers that question directly.

Do you award a TISAX label?

No. TISAX labels are issued by ENX after an assessment by an approved audit provider. Mr Cyber is not an audit provider and holds no TISAX label itself. We deliver the test results you present in your assessment.

Which protection need calls for a pentest?

At the points named above, only from high protection needs (usually assessment level 2): for critical IT systems and services. At very high protection needs (level 3), also for purpose-built or heavily customised software.

Do you test ECUs and vehicle components too?

Yes, as automotive security testing, quoted per project. Details: [Automotive security testing](https://mr-cyber.com/services/iot-hardware-penetration-testing#automotive).

How often should we test?

The catalogue names commissioning, significant changes and regular intervals. TISAX labels are valid for three years; testing critical systems at least once a year and after significant changes keeps your evidence current between assessments.

Also useful: [NIS2 & Compliance](https://mr-cyber.com/nis2-penetration-testing)  [Pentest or vulnerability scan?](https://mr-cyber.com/pentest-vs-vulnerability-scan)  [Pentest for ISO 27001](https://mr-cyber.com/iso-27001-penetration-testing)  [Pentest for cyber insurance](https://mr-cyber.com/cyber-insurance-penetration-testing)