ISA20274 min read
ISA 6 to ISA2027: Preparing for the Transition
A catalogue change is disruptive in proportion to how tightly your programme is coupled to the previous version. How to decouple it, and how to run the transition when it comes.
Read
Independent readiness resources for automotive information security teams
Turn TISAX requirements into a readiness programme you can demonstrate
Assess gaps, assign actions, structure evidence, verify implementation and prepare management review — with practical tools built for automotive information security teams.
Around 10 minutes. No account required to start. Get your readiness score, priority gaps and downloadable report.
- TISAX readiness and ISA-aligned preparation
- ISO/IEC 27001 alignment layer
- Evidence-first methodology
- Built for Tier 1–3 automotive suppliers
The gap most teams discover late
A policy alone does not demonstrate operational readiness.
Documentation matters — it is where expectations become explicit. But an assessor, a customer or your own internal auditor is looking for something else: proof that the expectation is actually met, by someone, on a date, in a way that can be traced. Readiness is the distance between those two things.
Defined
Requirements
What is expected of your organisation. Necessary, and the easiest part to obtain — a requirement list is not a programme.
Operating
Processes
How the requirement is actually met in daily operation: who does it, when, and what happens when it is not done.
Demonstrable
Evidence
The dated, attributable record that the process ran. Decided in advance, produced as you go, retrievable on request.
Organisations that prepare well do not simply write more documents. They build the structure that connects the three: processes that implement the requirement, and evidence produced as a by-product of the work rather than assembled retroactively in the four weeks before an assessment.
The ISAREADY method
Assess → Identify Gaps → Implement → Collect Evidence → Verify → Improve
A loop, not a checklist. The first pass gets you ready; the loop is what keeps you ready after the team changes.
- 1
Assess
Establish scope and an honest baseline. What is actually in place, not what the documents claim.
- 2
Identify Gaps
Convert the baseline into findings with an owner, a priority and a target date.
- 3
Implement
Do the work: processes, controls and the decisions that make them stick in daily operation.
- 4
Collect Evidence
Produce the record as the activity happens. Decided in advance, not reconstructed later.
- 5
Verify
Check yourself against your own rules through internal audit before anyone else does.
- 6
Improve
Close findings at root cause and feed the outcome back into risk, controls and awareness.
Readiness capabilities
The eight areas a TISAX readiness programme has to cover
Each links to practical guidance. None of it is a substitute for the official framework documentation — it is how we structure the work of getting ready.
Gap Assessment
Compare where you are against where you need to be, and turn the difference into owned, dated actions.
Risk Management
A repeatable method, risks with owners, treatment plans, and residual risk accepted by someone with the authority to accept it.
Evidence Management
Define the record before the activity happens, so nothing has to be reconstructed under time pressure.
Internal Audit
A planned programme that checks you against your own rules and tracks findings to closure at root cause.
Supplier Security
Know which third parties touch information in scope, agree requirements in writing, and follow findings through.
Governance
Defined scope, assigned responsibilities, management objectives and the resources to meet them.
Maturity
Judge how consistently a practice operates, not just whether a document exists describing it.
Continual Improvement
Management review, corrective action and measurement, so readiness is maintained rather than rebuilt.
Free self-assessment
How ready is your organisation for a TISAX assessment?
32 original questions for most respondents, with 2 additional Prototype Protection questions when that scope applies, across governance, risk, access, suppliers, evidence, audit and management review. You get a readiness indicator per theme, your strongest areas, your priority gaps, and a specific list of what to do next.
This assessment provides an indicative ISAREADY readiness view. It is not an official TISAX assessment and does not predict or guarantee an assessment result.
What you receive
ISAREADY Readiness Indicator
An overall percentage plus a band — Strong, Developing, Attention Required or Priority Action.
Category breakdown
A score per theme, so effort goes where the gap actually is rather than where it feels productive.
Evidence readiness view
A separate score for whether you could produce the records, which is usually the weakest part.
Prioritised next steps
Concrete actions in sequence, and a downloadable PDF you can circulate internally.
Inside Professional
See what's inside the Professional Toolkit
More than policies. A connected set of working tools designed to help you assess gaps, assign actions, organize evidence and verify readiness.
Maturity & Gap Assessment
A workbook covering every theme, with current and target maturity, the resulting gap, an owner and a due date per line.
Risk Register & Treatment
Risks scored on likelihood and impact, with the treatment decision, the owner and the residual position recorded.
Supplier Assessment
A third-party information security questionnaire and the structure to follow responses through to closure.
Management Review
An agenda, an input pack and a decision record aligned to management system practice.
Evidence Structure
An evidence reference against each requirement, so the record is decided in advance rather than reconstructed later.
ISO/IEC 27001 Alignment
A mapping view and a Statement of Applicability structure. An alignment layer, not a certification.
The toolkit
A structured readiness system, not a folder of templates
Three tiers, depending on whether you need a defensible baseline, a working programme, or governance across several sites.
Starter
Prepare
$49one-time
Assess where you stand in detail, and put the ISMS foundations in place.
- Detailed readiness self-assessment workbook
- Core information security policy set
- ISMS scope document
- Classification and handling guide
- Information security awareness training pack
Best for: Smaller suppliers starting preparation, or teams that need a defensible document baseline before anything else.
One-time purchase — not a subscription. Your purchase includes the toolkit as it exists at the time of purchase. Future major editions are not automatically included.
Recommended
Professional
Assess & Implement
$119one-time
Add the operating layer: risk, actions, evidence, suppliers and ISO/IEC 27001 alignment.
- Everything in Starter
- Gap analysis workbook with remediation action plan and readiness dashboard
- Information security risk register and treatment plan
- Supplier assessment questionnaire and third-party NDA template
- Management review template
- ISO/IEC 27001 alignment layer with Statement of Applicability
- Prototype protection and data protection covered within the assessment and SoA
Best for: Best fit for teams actively preparing for a TISAX assessment or customer information-security review.
One-time purchase — not a subscription. Your purchase includes the toolkit as it exists at the time of purchase. Future major editions are not automatically included.
Coming later
Enterprise
Govern & Scale
$249indicative price
Extend readiness across governance, reporting and multiple sites.
- Multi-site governance model and scope mapping
- CAPA tracker with ownership and verification
- KPI / KRI dashboard structure
- Third-party portfolio register
- Training and competence matrix
- Executive reporting pack
Best for: Groups running several sites or legal entities, and teams that must report readiness upward on a fixed cycle.
Not yet available for purchase. The capabilities above describe the intended scope of this tier.
Resources
All articlesPractical guidance from readiness work
Written for people who have to do this, not for search engines.
ISO/IEC 270014 min read
TISAX vs ISO/IEC 27001: What Actually Transfers
The two are often discussed as alternatives. They are different kinds of thing. Here is what each one is, which work transfers between them, and where preparation still differs.
Read
TISAX Readiness7 min read
How to Prepare for a TISAX Assessment
A practical sequence for preparing an automotive supplier for a TISAX assessment — what to do first, what takes longest, and the mistakes that cost the most time.
Read
The ISAREADY approach
Built for practical assessment preparation
Structured around evidence, ownership and continual improvement — because those are the three things that hold up when someone external starts asking questions.
We separate official requirements from our own opinion
Every substantive statement in our guidance is labelled as official framework information, industry good practice, or an ISAREADY recommendation. You should always verify official requirements against the current source documentation.
We do not promise outcomes we cannot control
No toolkit, ours included, guarantees a TISAX label, an ISO certification or a specific assessment result. What preparation changes is whether you can demonstrate what you do — which is the part you control.
We do not publish claims we cannot back
No invented success rates, no fabricated testimonials, no customer logos we do not have. A capability appears on this site only once there is a deliverable behind it — which is why some of what we intend to build is not listed for sale yet.
We publish what we would use ourselves
The structure in the toolkit is the structure we would apply to run a readiness programme: scope, gap assessment, risk treatment, implementation, evidence, internal audit, management review.
Questions about scope, tiers or an enterprise rollout? Talk to us.
Get started
Start your readiness journey
Begin with an indicative view of where you stand. Ten minutes, no account, and a report you can share with management.
Your answers stay in your browser until you request the report.