ISA2027 Explained: Understanding the New TISAX® Annual Versioning System
Learn why TISAX® moved to the new ISA2027 naming convention, how the annual release cycle works, and what it means for future assessments.
ISA2027 SERIES
ISA2027 Explained: Understanding TISAX®'s New Annual Versioning System
Opening Hook
One of the first things many people noticed about the latest TISAX® catalogue was its name.
Instead of ISA 6.1 or ISA 7, the new catalogue is called ISA2027.
At first glance, this may look like a simple naming change.
In reality, it introduces a new, predictable release model that makes it easier for organizations to understand which catalogue applies to their assessment and when future versions will become effective.
The good news is that while the naming convention has changed, the overall TISAX® assessment lifecycle remains familiar.
Why Did the Versioning Change?
Until now, the Information Security Assessment catalogue followed sequential version numbers such as ISA 5 and ISA 6.0.3.
Although technically correct, these version numbers did not immediately tell organizations when a catalogue became mandatory, ISA2027 changes that.
Future catalogues will now be named after the year in which they become mandatory for newly ordered TISAX® assessments.
For example:
ISA2027 applies to assessments ordered from January 1, 2027
ISA2028 will apply to assessments ordered from January 1, 2028
This approach provides greater transparency for suppliers, assessors, and customers alike.
How the New Annual Release Cycle Works
The ENX Association has also introduced a predictable annual publication cycle.
The general process will be:
A new ISA catalogue is published during the summer
It becomes mandatory for newly ordered TISAX® assessments on January 1 of the following year
This gives organizations several months to review changes and prepare before the new catalogue takes effect.
Rather than large changes every few years, companies can now expect smaller, more predictable updates.
Does This Mean Annual TISAX® Assessments?
This is one of the biggest misconceptions surrounding ISA2027.
The answer is simple: No
The introduction of annual catalogue releases does not change the validity of a TISAX® label. TISAX® labels remain valid for up to three years, just as they do today.
That means an organization assessed under ISA2027 will not suddenly need another assessment simply because ISA2028 or ISA2029 has been published.
In practice, many organizations will continue to skip multiple ISA generations between reassessments.
Why This Matters in the Americas
Many suppliers in the United States, Canada, and Mexico are only now becoming familiar with TISAX®.
Seeing a catalogue called ISA2027 may naturally raise questions such as:
Is my current assessment outdated?
Should I wait before starting?
Will I need annual reassessments?
Understanding the new versioning system helps answer these questions early and allows organizations to plan their TISAX® projects with greater confidence.
For companies supporting global automotive customers, predictable release cycles also make long-term planning easier.
What the Official Change Actually Means
According to the ENX Association, the new versioning model was introduced to improve transparency and predictability for all TISAX® participants.
Annual catalogue releases allow the framework to evolve in smaller, more manageable steps while maintaining the established three-year validity period for TISAX® labels.
This means organizations can continue planning assessments much as they do today while benefiting from a more predictable update cycle.
Common Misunderstandings
"Will I need a new assessment every year?" No, the validity of TISAX® labels remains unchanged.
"Will my label become invalid when ISA2028 is published?" No, your label remains valid for its normal validity period.
"Should I delay my assessment until the next catalogue?" Not necessarily, assessment planning should be driven by customer requirements, business needs, and project readiness rather than waiting for the next annual release.
Practical Steps for Organizations
As ISA2027 approaches, organizations should:
Understand which catalogue applies to their planned assessment.
Monitor future annual catalogue releases.
Review changes early rather than waiting until the last minute.
Continue preparing evidence and strengthening operational maturity.
Base assessment timing on business requirements, not catalogue numbering.
Key Takeaways
ISA2027 introduces a new year-based naming convention.
New catalogues will generally be published each summer.
They become mandatory for newly ordered assessments on January 1 of the following year.
TISAX® labels remain valid for up to three years.
Annual catalogue releases improve predictability without increasing reassessment frequency.
Call to Action
If the new ISA2027 versioning system raised questions about your organization's TISAX® journey, you're not alone.
tisaxusa.com continues to provide practical, plain-English guidance to help organizations in the Americas understand TISAX® and prepare with confidence.
You'll also find Free- TISAX®- Tools that have already been updated to align with ISA2027, helping you evaluate your readiness using the latest published catalogue.