UNECE WP.29 R155

Per UNECE WP.29 R155: Cyber Security Management System (CSMS) + manufacturer demonstrates processes + manage cyber threats across vehicle lifecycle + audit + CSMS Certificate.

• R155 evidence for UNECER155-1

• CSMS + type approval + threats partial

The manufacturer shall ensure that personnel involved in cybersecurity-related activities are competent and that competence is maintained through training and qualification.

• Cybersecurity role descriptions with required skills
• Training plan and completion records
• Competence assessment outcomes for cybersecurity-critical roles
• Supplier personnel competence assurance

• No formal competence assessment for security testers
• Training records held by HR but not linked to cybersecurity roles
• Contractor competence not verified before granting access

Where cybersecurity-related processes are outsourced or shared with partners, the manufacturer remains responsible for compliance with R155 and shall demonstrate control over those processes.

• Contractual clauses assigning R155 obligations
• Right-to-audit provisions and audit reports
• Joint development governance documents
• Process maps showing handoffs and accountability

• Joint venture lacks a single accountable manufacturer of record
• Right-to-audit clauses never exercised
• Process handoffs not documented end to end

The vehicle manufacturer shall establish, implement, and maintain a Cyber Security Management System covering processes within the manufacturer's organisation, processes used during development, production, and post-production, and demonstrate it through a valid Certificate of Compliance for the CSMS.

• CSMS scope statement and policy approved at senior management level
• Organisation chart showing cybersecurity roles and reporting lines
• Certificate of Compliance for CSMS issued by an approval authority or technical service
• Lifecycle process map covering development, production, and post-production

• CSMS covers only development phase, missing production and post-production
• Senior management approval missing or outdated
• No internal traceability between policy and operating procedures

The manufacturer shall report at least once per year, or upon request, to the approval authority on the outcome of the monitoring activities, including information on new attacks. Incidents affecting vehicle type cybersecurity shall be analysed and managed.

• Documented incident response procedure including severity classification
• Annual cybersecurity monitoring report submitted to approval authority
• Sample post-incident analyses with corrective actions
• Communication templates for approval authority notifications

• Annual report missed or filed with insufficient detail
• No template for ad-hoc reporting to the approval authority
• Corrective actions logged but not verified for completion

The manufacturer shall demonstrate processes to monitor for, detect, and respond to cyber attacks, cyber threats, and vulnerabilities on vehicle types, including the capacity to analyse and respond to information from the field.

• Vehicle SOC playbooks and tooling inventory
• Threat intelligence feed subscriptions and triage records
• Field event log showing detection, analysis, and disposition
• Vulnerability watch list tied to in-service vehicle types

• Monitoring limited to IT network with no in-vehicle telemetry
• Threat intel collected but not correlated to specific vehicle types
• No documented analyst rotations or escalation matrix

The manufacturer shall demonstrate that dependencies on contracted suppliers and service providers are considered, including cybersecurity activities and outputs delivered by suppliers being managed by the manufacturer.

• Supplier cybersecurity assurance level criteria
• Cybersecurity Interface Agreements with Tier 1 and key Tier 2 suppliers
• Evidence of supplier deliverables review and acceptance
• Supplier audit or assessment reports

• Cybersecurity interface agreement absent or generic
• Supplier deliverables accepted without independent review
• No tiering of suppliers by criticality

Per R155 + R156: software updates management + secure update mechanism + RxSWIN + change management.

• R155 evidence for UNECER155-4

• CSMS + type approval + threats partial

Per R155 Annex 5: threats including back-end servers + vehicle data and code + external connectivity + update process + supply chain + insider + privacy + maintain mitigations.

• R155 evidence for UNECER155-3

• CSMS + type approval + threats partial

Per R155: vehicle type approval + cyber security demonstration + Type Approval Authority cooperation + maintain throughout production.

• R155 evidence for UNECER155-2

• CSMS + type approval + threats partial

The manufacturer shall present evidence to the approval authority or technical service to support the vehicle type approval. The approval authority verifies that processes are implemented and risks identified are addressed.

• Document register with versioning and approval authority access controls
• Pre-submission readiness checklist
• Records of approval authority queries and responses
• Internal audit reports on CSMS

• Evidence delivered in inconsistent formats and versions
• Internal audit performed by the team that owns the process
• No central register of approval authority interactions

The manufacturer shall implement mitigations proportionate to the identified risks. Mitigations shall be selected to address the threats listed in Annex 5 Part B and any additional threats identified.

• Mitigation matrix mapping Annex 5 Part B threats to controls
• Penetration test and fuzzing reports for in-scope ECUs
• Secure boot, key management, and message authentication design documents
• Network segmentation and gateway configuration evidence

• Mapping to Annex 5 Part B incomplete
• Pen test scope narrower than the vehicle type approval boundary
• No regression testing after software updates

The manufacturer shall demonstrate that it has the capability to detect and respond to cybersecurity attacks, threats, and vulnerabilities on vehicle types throughout their operational life, and to support forensic analysis of successful or attempted attacks.

• End-of-production handover document to monitoring and response teams
• Forensic readiness procedure including data preservation
• Records of in-life vulnerability handling decisions
• Sunset plan for vehicle types reaching end of support

• No forensic data retention policy for in-vehicle logs
• Handover from development to operations informal or undocumented
• End of support communicated to dealers but not to customers

For the vehicle type, the manufacturer shall identify the critical elements and perform an exhaustive risk assessment, including consideration of interactions among elements, the operating environment, and interactions with external systems.

• Architecture diagram identifying critical electronic control elements
• TARA artefacts mapped to the vehicle type
• Interaction analysis with external systems including backend and OTA
• List of assumptions of use and operating environment

• External system interactions not modelled (backend, charging, V2X)
• Assumptions of use not documented or tested
• Critical element list inconsistent across teams

The manufacturer shall test the cybersecurity of the vehicle type and provide evidence that the implemented measures are effective against the identified risks. Testing shall cover the vehicle as integrated and include relevant interfaces.

• Cybersecurity verification and validation plan for the vehicle type
• Test reports with pass and fail outcomes and re-test evidence
• Independence evidence where required (separate teams or third party)
• Tool qualification evidence for security test tooling

• Tests run only on bench, not on integrated vehicle
• Failed tests closed without root cause analysis
• No independence between developers and verifiers