Guide & Best Practices for Compliance with VDA® ISA

Determine the Definition of Each Maturity Level

The VDA® ISA questionnaire is scored based on an evaluation system consisting of six maturity levels (0-5). Depending on how well you’ve implemented each VDA® ISA requirement, you will be assigned a certain maturity level (for each requirement). You must achieve at least maturity level 3 to pass.

You should familiarize yourself with the evaluation system to better understand how to pass the assessment.Here are the different maturity levels for VDA® ISA:

• 0 (Incomplete): The process has not been implemented, or the process has not been implemented in a way that satisfies the requirements.

• 1 (Performed): The process has been implemented, but there is inadequate documentation and evidence.

• 2 (Managed): The implemented process has successfully achieved the intended goals. Detailed documentation and concrete evidence of the implementation are readily accessible.

• 3 (Established): A standard process has been followed and integrated into the information security system. Implementation and how it links to other processes have been well-documented. There’s evidence of the process being used consistently over a long period.

• 4 (Predictable): An established process has been implemented, with its effectiveness being regularly monitored using key performance metrics. Limit values are put in place, which indicate when the process is not meeting satisfactory standards and must be adjusted.

• 5 (Optimizing): A predictable process has been followed, with continuous monitoring and improvement as a main objective. Improvements are supported by dedicated resources.

Audit Objectives Depend on Confidentiality

Depending on the type of information you’re protecting, you may undergo a different level of assessment. For example, if you’re handling highly sensitive data, you’ll be assigned the top assessment level (3). Different levels involve different audit objectives and modules. You also need to consider the scope of your assessment.

Here are the three assessment levels:

• Assessment Level 1 (AL 1): A self-assessment based on the VDA® ISA test questions without any need for external auditors or evidence submissions.

• Assessment Level 2 (AL 2): A self-assessment based on VDA® ISA questions along with an official audit carried out by a VDA-approved auditor (done remotely except for prototype protection modules). You also need to undergo a plausibility check and have your evidence verified.

• Assessment Level 3 (AL 3): A self-assessment based on the VDA® ISA questionnaire, plausibility checks, evidence verifications, and on-site audits performed by VDA-accredited auditors. 

Hiring an Information Security Officer

Hire an information security officer to help you design and implement security policies that protect your data against various threats. They also enforce ISMS policies and procedures to ensure vulnerabilities in your system are resolved efficiently.

Skills to look out for in an information security officer include:

• Expert knowledge of ISMS and VDA® ISA

• Great communication skills

• Problem-solving and analytical skills

• Knowledge of security best practices

Always be Updated with the Latest Version of VDA® ISA

Always stay up-to-date with the latest VDA® ISA requirements to ensure you continue achieving compliance.