top of page
ISO 27001, B3S, KRITIS, IT-SiKat, TISAX®, VAIT, VDA ISA, §8a BSIG, KritisV, ISO 27002, IT security catalog, ISO 27019, §11 1a EnWG, §11 1b EnWG
Angebot_EN.png
IMG_1102_edited_edited.png
Search

VDA ISA QuickCheck

Anyone who has ever filled out a VDA ISA knows the problem: despite the greatest care, it is easy to overlook an important requirement. To solve exactly this issue, I have developed a small but very helpful Excel formula that I would like to share with you today.



Why this formula is helpful

The formula shows at a glance whether you have copied all necessary requirements (marked with a “+”) correctly into your documentation. No tedious counting or repeated checking – you immediately see whether your description is complete or whether something is still missing.



The correct way to fill out the VDA ISA

For the formulas to work, the following is essential:


  • Copy the requirements (“+ must”, “+ should”, “+ high”, “+ very high”, “+ SGA”) exactly as they appear in the VDA ISA into the Implementation Description column and in accordance with the assessment objective defined in your Scope Excerpt.

  • In the row below, describe the implementation and name the evidence. To ensure plausibility, this text must always clearly answer “how” and “where”.

  • Do not add any additional plus signs.

  • Empty cells in columns D, E, and F are not permitted.



One Example:

+ A non-disclosure obligation is in effect.
Standard clause in the employment contracts (see §5 and §14 in WContract-Mr-Mayer-pdf).
#TISAX, #VDAISA, #AL2, #AL3, #SGA, #Assessment, #Audit, #Compliance, #Cybersecurity, #ExcelTips, #ITSecurity, #DataProtection, #Productivity
Source: German Association of the Automotive Industry (VDA), VDA ISA Version 6.0.2, licence: CC BY‑ND 4.0, https://creativecommons.org/licenses/by-nd/4.0/

The OK/NOK formulas for your check

Depending on the assessment objective, use one of these formulas in cell G5 of the VDA ISA Version 6.0 sheet:


  • AL2 with objectives 3 (Confidential) and 5 (High availability)

=IF((LEN(E5)-LEN(SUBSTITUTE(E5,"+","")))-(LEN(J5)-LEN(SUBSTITUTE(J5,"+",""))+LEN(K5)-LEN(SUBSTITUTE(K5,"+",""))+LEN(L5)-LEN(SUBSTITUTE(L5,"+","")))=0,"OK","NOK")

  • AL3 with objectives 4 (Strictly confidential) and 6 (Very high availability)

=IF((LEN(E5)-LEN(SUBSTITUTE(E5,"+","")))-(LEN(J5)-LEN(SUBSTITUTE(J5,"+",""))+LEN(K5)-LEN(SUBSTITUTE(K5,"+",""))+LEN(L5)-LEN(SUBSTITUTE(L5,"+",""))+LEN(M5)-LEN(SUBSTITUTE(M5,"+","")))=0,"OK","NOK")

  • SGA mit Prüfziel 4 (Strictly confidential) und 6 (Very high availability)

=IF((LEN(E5)-LEN(SUBSTITUTE(E5,"+","")))-(LEN(J5)-LEN(SUBSTITUTE(J5,"+",""))+LEN(K5)-LEN(SUBSTITUTE(K5,"+",""))+LEN(L5)-LEN(SUBSTITUTE(L5,"+",""))+LEN(M5)-LEN(SUBSTITUTE(M5,"+",""))+LEN(N5)-LEN(SUBSTITUTE(N5,"+","")))=0,"OK","NOK")

See Table 8 “Applicability of requirements to assessment objectives”:



How to apply the formula in practice

  1. Copy the appropriate formula into cell G5.

  2. Drag the formula with the mouse from G5 down to G66. Excel automatically adjusts the row references.


And that’s it – at a glance you can see where further action is required.


Even though a result now appears in the Findings / Audit Results column, this QuickCheck does not replace an internal audit! You can book the internal audit here: INTERNAL AUDIT

Working this way saves you not only follow‑up questions from the auditor but also ensures the coffee at the next audit meeting can be enjoyed in a more relaxed atmosphere – after all, who wants to make the participants sweat unnecessarily?


 
 
Telephone2trans.png

You have questions?

Sometimes a direct conversation is simply unbeatable. Please do not hesitate to arrange a free initial conversation via our telephone calendar!

IMG_1092.png

Imprint           Privacy Policy

 

© 2024 AUDIT

MANUFAKTUR

 

TISAX® is a registered trademark of the ENX Association. AUDIT MANUFAKTUR has no business relationship with ENX. The mention of the TISAX® trademark does not constitute a statement by the trademark owner regarding the suitability of the services advertised here. TISAX® assessments to obtain labels are only carried out by the testing service providers listed on the ENX homepage. In our function as auditors for certification bodies, we are prohibited for several years from certifying companies that we have previously supported in the field of information security. This regulation ensures the impartiality and integrity of the certification process.

bottom of page