Skip to content
ISAREADY

The ISAREADY Toolkit

Build a structured, evidence-driven readiness program

Not thirty templates in a folder. A readiness system for turning requirements into implemented processes and traceable evidence — where the gap assessment feeds risk treatment, risk treatment feeds the implementation plan, implementation produces evidence, internal audit verifies it, and management review closes the loop.

Starter

Prepare

$49one-time

Assess where you stand in detail, and put the ISMS foundations in place.

  • Detailed readiness self-assessment workbook
  • Core information security policy set
  • ISMS scope document
  • Classification and handling guide
  • Information security awareness training pack
What is included

Best for: Smaller suppliers starting preparation, or teams that need a defensible document baseline before anything else.

One-time purchase — not a subscription. Your purchase includes the toolkit as it exists at the time of purchase. Future major editions are not automatically included.

Recommended

Professional

Assess & Implement

$119one-time

Add the operating layer: risk, actions, evidence, suppliers and ISO/IEC 27001 alignment.

  • Everything in Starter
  • Gap analysis workbook with remediation action plan and readiness dashboard
  • Information security risk register and treatment plan
  • Supplier assessment questionnaire and third-party NDA template
  • Management review template
  • ISO/IEC 27001 alignment layer with Statement of Applicability
  • Prototype protection and data protection covered within the assessment and SoA
What is included

Best for: Best fit for teams actively preparing for a TISAX assessment or customer information-security review.

One-time purchase — not a subscription. Your purchase includes the toolkit as it exists at the time of purchase. Future major editions are not automatically included.

Coming later

Enterprise

Govern & Scale

$249indicative price

Extend readiness across governance, reporting and multiple sites.

  • Multi-site governance model and scope mapping
  • CAPA tracker with ownership and verification
  • KPI / KRI dashboard structure
  • Third-party portfolio register
  • Training and competence matrix
  • Executive reporting pack
What is included

Best for: Groups running several sites or legal entities, and teams that must report readiness upward on a fixed cycle.

Not yet available for purchase. The capabilities above describe the intended scope of this tier.

One-time price per tier. No subscription, no countdown, no artificial scarcity.

Why teams come to us

The problems this is built for

None of these are unusual. All of them are structural rather than technical, which is why more documents do not fix them.

Scattered documentation

Policies in three places, none of them versioned, and nobody certain which copy is current.

Unclear ownership

Requirements everyone agrees are important and nobody is specifically accountable for.

Missing evidence

Controls that genuinely operate, with no record you could produce without a week of archaeology.

Unstructured gap assessments

A colour-coded spreadsheet that everyone agrees is accurate and nobody acts on.

Weak supplier follow-up

Questionnaires sent, returned, filed, and never followed through to closure.

Preparation under time pressure

A date in the calendar and four weeks of reconstruction ahead of you.

How it fits together

One system, six connected stages

Each stage produces the input the next one needs. That connection is the difference between a toolkit and a folder.
  1. 1

    Assess

    Establish scope and an honest baseline. What is actually in place, not what the documents claim.

  2. 2

    Identify Gaps

    Convert the baseline into findings with an owner, a priority and a target date.

  3. 3

    Implement

    Do the work: processes, controls and the decisions that make them stick in daily operation.

  4. 4

    Collect Evidence

    Produce the record as the activity happens. Decided in advance, not reconstructed later.

  5. 5

    Verify

    Check yourself against your own rules through internal audit before anyone else does.

  6. 6

    Improve

    Close findings at root cause and feed the outcome back into risk, controls and awareness.

Assessment layer

Gap assessment workbook and maturity grading with consistent level definitions, so two passes are actually comparable.

Implementation layer

Policy set, risk register and treatment plan, supplier assessment, and the ownership model that keeps them moving.

Verification layer

Internal audit programme, findings log with root cause, management review pack, and the evidence map underneath all of it.

Compare

What is included in each tier

Foundation

  • Core Policies

    Information security policy set with ownership and review cadence.

    Starter
    Included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • ISMS Scope Document

    Scope statement covering sites, entities, systems and information types.

    Starter
    Included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • Classification & Handling Guide

    Classification levels with storage, transfer and destruction rules.

    Starter
    Included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • Awareness Training

    Employee awareness deck with an acknowledgment sheet.

    Starter
    Included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

Assess & implement

  • Readiness Self-Assessment

    Detailed control-level self-assessment with baseline and advanced criteria per theme.

    Starter
    Included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • Gap Analysis Workbook

    Chapter-level gap analysis with remediation action plan and calculated readiness dashboard.

    Starter
    Not included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • Risk Management

    Risk register, criteria, treatment plan and residual risk acceptance.

    Starter
    Not included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • Supplier Assessment

    Third-party security questionnaire and follow-up tracking.

    Starter
    Not included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • Management Review Template

    Agenda, structured inputs and decision record aligned to management system practice.

    Starter
    Not included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

Alignment & scope extensions

  • ISO/IEC 27001 Alignment Layer

    Mapping view and Statement of Applicability structure.

    Starter
    Not included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • Prototype Protection Readiness

    Prototype protection controls covered within the self-assessment and the Statement of Applicability.

    Starter
    Not included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

  • Data Protection Readiness

    Data protection controls covered within the self-assessment and the Statement of Applicability.

    Starter
    Not included in Starter
    Professional
    Included in Professional
    Enterprise
    Included in Enterprise

Govern & scale

  • Multi-Site Governance

    Scope map, site ownership model and consolidated oversight.

    Starter
    Not included in Starter
    Professional
    Not included in Professional
    Enterprise
    Included in Enterprise

  • CAPA Tracker

    Corrective and preventive actions with root cause and verification.

    Starter
    Not included in Starter
    Professional
    Not included in Professional
    Enterprise
    Included in Enterprise

  • KPI / KRI Dashboard

    Measurement structure for security performance and risk indicators.

    Starter
    Not included in Starter
    Professional
    Not included in Professional
    Enterprise
    Included in Enterprise

  • Third-Party Portfolio

    Portfolio register with criticality tiering and review cycle.

    Starter
    Not included in Starter
    Professional
    Not included in Professional
    Enterprise
    Included in Enterprise

  • Training Matrix

    Role-based competence and awareness tracking.

    Starter
    Not included in Starter
    Professional
    Not included in Professional
    Enterprise
    Included in Enterprise

  • Executive Reporting

    Board-level readiness summary with trend view.

    Starter
    Not included in Starter
    Professional
    Not included in Professional
    Enterprise
    Included in Enterprise

Before you buy

Is ISAREADY an official TISAX or ENX product?
No. ISAREADY is an independent readiness toolkit and is not affiliated with, endorsed by, or an official product of ENX Association, VDA or ISO.
Is ISAREADY a subscription?
No. Each toolkit is a one-time purchase.
Are future major versions included?
One-time purchase — not a subscription. Your purchase includes the toolkit as it exists at the time of purchase. Future major editions are not automatically included.
Does ISAREADY reproduce the official VDA ISA questionnaire?
No. ISAREADY provides independently developed readiness tools and does not reproduce the official VDA ISA questionnaire. Control identifiers are used as references only, and official requirements should be verified against the applicable official source material.
What format is the toolkit in?
Working documents and workbooks you can edit and adopt — policies, registers, programmes, workbooks and reporting structures. It is designed to be used and modified inside your organisation, not read once.
Does buying the toolkit guarantee a successful assessment?
No. No toolkit can guarantee a TISAX assessment result, a TISAX label, an ISO certification or regulatory compliance, and you should treat any vendor who claims otherwise with suspicion. What it provides is the structure — the work of implementing it remains yours.
Which tier should we choose?
Starter establishes the foundations. Professional is the broadest tier for teams actively assessing gaps, implementing controls and preparing evidence. Enterprise extends the approach to multi-site governance and is not yet available for purchase. The free self-assessment ends with a recommendation based on your answers.
Is it aligned to a specific catalogue version?
It is organised around themes and activities rather than around catalogue question numbers, which is deliberate: a catalogue version change then costs you a mapping update rather than a rebuild. Control identifiers refer to the VDA ISA catalogue and are used as references only.
Do you offer support or consulting?
The toolkits are self-service. If you have questions about scope, tiers or a multi-site rollout, get in touch and we will answer them directly.
ISAREADY provides independent assessment-readiness resources and practical information security tools. ISAREADY is not affiliated with, endorsed by, or acting on behalf of ENX Association, VDA, ISO or any TISAX audit provider. Use of ISAREADY resources does not guarantee a TISAX assessment result, TISAX label, ISO certification or regulatory compliance.

Not sure which tier fits?

Take the free self-assessment. It ends with a recommendation based on your readiness indicator and organisation profile, along with the reasoning behind it.

Start the Free Readiness AssessmentAsk us a question