UN Regulation No 155: cybersecurity and cybersecurity management system

The vehicle manufacturer or its duly accredited representative applies to the approval authority designated by the Contracting Party for a CSMS assessment. On satisfactory completion and receipt of a signed declaration in the Annex 1 Appendix 1 model, a CSMS certificate of compliance in the Annex 4 model is granted. It is valid for a maximum of three years from issue unless withdrawn. The manufacturer must apply for a new or extended certificate in due time before expiry and must inform the approval authority or its technical service of any change affecting the relevance of the certificate, which then decides whether new checks are needed.

Applies when

Vehicle manufacturers applying for cybersecurity type approval; multi-brand groups must confirm the certificate scope matches the applicant entity.

Evidence to retain

• · CSMS certificate of compliance (Annex 4 model) and a validity tracker
• · Signed manufacturer declaration in the Annex 1 Appendix 1 model
• · CSMS assessment report and non-conformity closure records
• · Lead-time management record for renewal or extension applications
• · Notifications of changes affecting certificate relevance and the authority responses

Estimated first-time effort: 60–180 person-days (estimate, not a commitment)

The manufacturer must identify the critical elements of the vehicle type, perform an exhaustive risk assessment for that type and treat or manage the identified risks appropriately. The assessment must consider the individual elements of the vehicle type and their interactions, and must further consider interactions with any external systems; it must cover all the threats listed in Annex 5 Part A as well as any other relevant risk. Failure to perform the exhaustive assessment, including failure to consider all Annex 5 Part A threats, is a ground for the approval authority to refuse approval.

Applies when

Every vehicle type seeking cybersecurity type approval; platform-derived types must justify differences and the boundaries of reuse.

Evidence to retain

• · Inventory of critical elements and definition of system boundaries for the vehicle type
• · TARA report with an item-by-item mapping to the Annex 5 Part A threats
• · Risk analysis for interactions with external systems (cloud platform, charging infrastructure, mobile app, V2X)
• · Risk treatment decisions and residual risk acceptance records
• · Process and re-assessment records keeping the risk assessment current

Estimated first-time effort: 30–90 person-days (estimate, not a commitment)

The manufacturer must protect the vehicle type against the risks identified in its risk assessment by implementing proportionate mitigations, which must include all mitigations referred to in Annex 5 Parts B and C that are relevant to the identified risks. Where such a mitigation is not relevant or not sufficient, another appropriate mitigation must be implemented. For type approvals prior to 1 July 2024 an alternative mitigation could be used where the Annex 5 measure was technically not feasible, with the feasibility assessment provided to the approval authority.

Applies when

Vehicle manufacturers, cascaded through supply contracts to Chinese suppliers of the affected ECUs, communication modules and software.

Evidence to retain

• · Traceability matrix mapping Annex 5 Part B and C mitigations to the implementation in the vehicle type
• · Justification where a mitigation is not relevant or not sufficient and description of the substitute
• · Verification and penetration test reports for the mitigations
• · Where applicable, the technical feasibility assessment and the record of its submission to the approval authority

Estimated first-time effort: 25–80 person-days (estimate, not a commitment)

The manufacturer must demonstrate that its CSMS has processes to monitor for, detect and respond to cyberattacks, cyber threats and vulnerabilities on its vehicle types, and to assess whether the implemented measures remain effective against newly identified threats. Monitoring must be continual, must include vehicles after first registration, and must include the capability to analyse and detect threats, vulnerabilities and attacks from vehicle data and vehicle logs while respecting the privacy rights of owners and drivers, particularly regarding consent. Threats and vulnerabilities requiring a response must be mitigated within a reasonable timeframe, and the manufacturer must have processes to provide relevant data to support the analysis of attempted or successful attacks.

Applies when

Vehicle manufacturers and the Chinese teams operating their connected-vehicle security monitoring; where logs are transferred from vehicles in the EU, local personal data law applies in parallel.

Evidence to retain

• · Vehicle security operations centre (VSOC) design and on-duty procedures
• · Threat intelligence source list, vulnerability severity scheme and response time targets
• · Documentation of vehicle log collection scope, minimisation and consent mechanisms
• · Sample monitoring alerts, response tickets and closure records
• · Retention and provisioning process for data supporting attack analysis

Estimated first-time effort: 40–120 person-days (estimate, not a commitment)

The manufacturer must demonstrate how its CSMS manages dependencies that may exist with contracted suppliers, service providers or its own sub-organisations in respect of the requirements of paragraph 7.2.2.2 (risk identification, verification of risk management, cybersecurity testing, keeping the risk assessment current, monitoring, detection and response). In practice this means embedding cybersecurity requirements in purchasing specifications and contracts, auditing suppliers, and agreeing vulnerability notification and investigation cooperation duties.

Applies when

Vehicle manufacturers; equally it determines whether Chinese Tier 1 and Tier 2 suppliers pass their customers CSMS supplier audits and keep their nominations.

Evidence to retain

• · Supplier cybersecurity requirement set (cybersecurity interface agreement or equivalent)
• · Supplier audit plan, audit reports and non-conformity closure records
• · Vulnerability and incident notification clauses, response deadlines and exercise records
• · Documented responsibility split and interface definitions for sub-organisations

Estimated first-time effort: 15–45 person-days (estimate, not a commitment)