Certified cybersecurity system as basis for approval of new vehicle types
The principles laid down in UN Regulation 155 and the ISO/SAE 21434 standard apply in Germany as a prerequisite for type approval (homologation) by the Federal Motor Transport Authority (Kraftfahrtbundesamt) and by the corresponding bodies in all UNECE member states and recognizing third countries.
Four areas are described in the ISO/SAE 21434 standard:
- The management of cyber risks from the vehicle and its environment
- The inherent safeguarding of a vehicle and its value chain
- Establishing a cybersecurity incident response system to identify and address cybersecurity incidents
- Remote software updates for an up-to-date software status
In practice, this means that a management system for cybersecurity and remote software updates certified by independent auditors is a prerequisite for the approval of new vehicle types. Certification is relevant for OEMs and suppliers alike. The standard differentiates between a CSMS for the organization and the application of the CSMS at product level. In terms of content, companies can use the sections of the standard as a guide when creating a CSMS in the future: These address the creation of a (1) CSMS concept, its (2) management, (3) risk determination methods, the integration of cybersecurity aspects in (4) product development, and (5) production, operation, and maintenance.
Accordingly, a cybersecurity management system comprises various processes at organizational and project level. In detail, it is about the identification, assessment and treatment of cyber risks in an appropriate timeframe over the entire lifecycle of a vehicle. Ultimately, the entire CSMS must be validated alongside a SUMS by an independent third party for type approval clearance. The implementation of UN Regulation 155 covers several areas – from the concept phase, product development, cybersecurity systems management, risk determination methods, production, operation and maintenance, and supporting processes.