Audit-Ready - TISAX® ISA2027

Audit readiness is not a sprint. It is an operating condition. TISAX® has become the admission ticket to the automotive supply chain. With ISA2027, the catalog moves to an annual release cycle, strengthens supplier management, and raises the bar for operational maturity. Organizations that treat the assessment as a documentation exercise will feel that shift. Organizations that build governance maturity will barely notice it. Written by three practitioners who prepare automotive suppliers for assessments on both sides of the Atlantic, this guide covers the complete path: What actually changed: the ISA2027 delta at a glance, from the new Supplier SoA to the restructured Prototype Protection module, with a to-do for every change Scoping and protection needs: how to define an assessment scope that satisfies your customer without inflating your audit Evidence and maturity level 3: what auditors accept, what they reject, and why one defined process beats three historical variants The audit itself: assessment levels, the corrective action window of three, six, or nine months, and what happens in the closing meeting The three-year cycle: why there are no surveillance audits and no delta assessments, and what that means for your ISMS between assessments Planning parameters: readiness timelines from three to eighteen months depending on your starting position, and a 200-person-day effort model with a backward-planned schedule Throughout the book, "From the field" notes share what catalogs do not: how auditors actually test. Why the auditor verifies your supplier process against the consultant sitting next to you. Why the self-assessment you submit should show maturity level 3 on every control. Why finding counts cluster in a predictable corridor, and how to prepare the closing meeting accordingly. For organizations with multiple frameworks, dedicated annexes map TISAX® to ISO/IEC 27001, NIST CSF 2.0, and NIST SP 800-53, and a full comparison with CMMC 2. 0 addresses dual-exposure suppliers serving both automotive OEMs and the U.S. Defense Industrial Base, including a note on ITAR and EAR export controls. Whether you are preparing your first assessment or entering the next cycle with an established ISMS, every chapter closes with separate action lists for both starting positions. Audit-Ready: TISAX® ISA2027 is the first volume of the Audit-Ready series. Further volumes on CMMC 2.0, NIS-2, and ISO/IEC 27001 are planned. About the authors: Michael Kirsch (MLYK Consulting) has served as a TISAX® trainer at TÜV SÜD Academy and advises automotive suppliers on security governance. Daniel McLain (ICTS USA) supports North American organizations on TISAX® readiness and delivers ISO/IEC 27001 audit work. Wolfram von Schoen (Granite State InfoSec) helps manufacturers align overlapping security requirements, from TISAX® to CMMC, ITAR, and the EU Cyber Resilience Act. TISAX® is a registered trademark of the ENX Association. This book is an independent publication and is not affiliated with, endorsed by, or sponsored by the ENX Association or the VDA.