How to comply with the UNECE regulations on Automotive Cybersecurity
Are you wondering what you need to do in order to comply with the UNECE regulations on cybersecurity? Here, you'll find the necessary information including a free whitepaper and an informative video clip.
Back to Automotive Cybersecurity
Interested in a summary of the UNECE compliance? Our free white paper provides you with all key information, including figures showing the talked about management systems for both cybersecurity and software updates.
Until now, the connected car has been like the Wild West: the manufacturer claims that his vehicle is secured against cyber-attacks. If a few white hat hackers were lucky enough to realize an attack path, it was silently and secretly reworked. With the UNECE regulations this is over now. Because now the manufacturer must establish management systems and have them audited, for cybersecurity and software updates. The proof that management systems are in place becomes just as relevant for approval as vehicle technology.
So as not to be misunderstood: The regulation clearly calls for coordinated cybersecurity activities at the organizational level. This is different from cybersecurity in the project, where we talk about encryption and the like.
Organizational level requirements
- processes,
- responsibilities, and
- measures.
Who does what and when, so that the connected car remains secure.
Threat Analysis and Risk Assessment is a good example of this: a structured procedure for systematically identifying and assessing risks. With the instruction to carry out Risk Assessments on a regular basis – even when the vehicles are already on the road.
Need support with a key project? We’re your first port of call when it comes to management consulting and improvement programmes in electronics development.
Steffen Herrmann and the sales team
UNECE, this is the United Nations harmonization body for vehicle type approvals in Europe. In the summer of 2020, this body resolved that vehicle manufacturers would be required to have a management system for both cybersecurity and software updates. Independent third parties must check and confirm the validity of these systems. The domestic registration authorities for vehicles expect this certification. The EU states as well as Japan and South Korea have decided to apply these UNECE regulations to most road vehicles. Cybersecurity is thus entering the field of homologation in an economic area where one in three cars rolls off the assembly line.
We outline the main characteristics of the UNECE regulations in the form of a diagram.
On the very left, we start with the UNECE regulations. Formally there are two regulations, with similar requirements. The upper strand describes the regulatory requirements for a cybersecurity management system of the manufacturer. The lower strand refers to the software update management system.
Both lines come together if components or the entire vehicle type are to be approved by the responsible authority if possible before you start the production.
In future, this procedure to be in line with a whole stack of certificates will be required for the OEMs as well as for all supplier.
To obtain these certificates, vehicle manufacturers will have to introduce the corresponding management systems. This means some massive changes in their R&D as well in their entire organization. So, there is homework to be done.
We’re proud that we have been one of the pioneers of functional safety since 2008 and that this has given us the opportunity to leverage our experience in developing the ISO 26262 safety standard.
Functional safety in automotive electronics? We’re the experts!
We have a wealth of experience in functional safety according to ISO 26262, having conducted over 700 projects with more than 100 clients worldwide.
Functional safety in automotive electronics? We’re the experts!
To date, we have trained more than 100 specialists under the TÜV Rheinland Functional Safety (Automotive) certification scheme.
Functional safety in automotive electronics? We’re the experts!
We already have 18 experts certified under the TÜV Rheinland Functional Safety (Automotive) scheme, or privately approved as official trainers.
Functional safety in automotive electronics? We’re the experts!
If we add up the experience of our experts in the field of functional safety, it comes to no less than 250 years.
Functional safety in automotive electronics? We’re the experts!
Who wrote the classic manual on Functional Safety in Practice, or Functional Safety Essentials? We did.
Functional safety in automotive electronics? We’re the experts!
Fortunately, we are not out in the rain with this task: A good link on how to set up a cybersecurity management system can be found in a new ISO standard: ISO/SAE 21434. A standard dealing with software update management systems is also in preparation: ISO AWI 24089.
With the knowledge from the ISO/SAE 21434 standard we can set up a cybersecurity management system, our CSMS. How this works exactly is the topic for another video. The point here is that the CSMS must cover the entire vehicle lifecycle. Really the entire one.
In addition to the project phase in product development, there is also
- production,
- the operating phase by the buyer and finally
- the scrapping of the vehicle.
The junkyard is particularly sensitive for privacy reasons, because the connected car contains a large amount of personal data.
Cybersecurity, I would like to emphasize once again, is much more than just the encryption of a system. It affects almost everything you do.
When you are finished with your cybersecurity management system, an independent auditor comes to your site. It checks whether the management system complies with the requirements resulting from the UNECE regulation. For example, is TARA conducted regularly or do the goals from the cybersecurity concept feed into product development? If so, you will receive a certificate.
The basis for the audit will be the UNECE Regulation R155. This regulation has not yet been adopted in all details.
With the software update management system, it is a bit more complicated. There will also be a UNECE regulation, the R156. This is also under development. The software update management system can be guided by ISO AWI 24089, for example.
The first step corresponds to the procedure for CSMS: The auditor checks whether the processes of software update management system meet the objectives. Software updates are ultimately the key to keeping the connected car permanently secure. If everything fits, you will also receive a certificate for the SUMS, which is valid for three years.
An important component of the SUMS are processes, how the RXSWIN are assigned and managed. An RXSWIN is a Regulation Software Identification Number. The manufacturer has to keep an account of his activity and set up a register. RXSWIN are part of a software identification scheme and are assigned for each component. With RXSWIN, the manufacturer always knows the current software configuration of a vehicle system.
In addition to the car manufacturer's management system, its technical software update systems must also be approved, the SW handlers both on the back-end systems and on the vehicle side. Both Software Update Management System and SW Update System declarations of conformity are a precondition for all type approvals of the vehicle's subsystems.
Need support with a key project? We’re your first port of call when it comes to management consulting and improvement programmes in electronics development.
Steffen Herrmann and the sales team
If we merge both strands, we have three systems that an independent auditor must confirm: A cybersecurity management system, a software update management system, and all software update systems both within and outside the vehicle.
As you have certainly seen by now, in cybersecurity, project concerns and the organization's backup go hand in hand.
When your development team has completed the system, you call the independent auditor again. He checks the release candidate together with the compliance statements for the management and update systems.
Now it goes to your national registration authority. This agency expects numerous certificates from the manufacturer – regarding the cybersecurity management system and the system validation report from the software update strand. And of course, the RXSWIN of your system.
Based on all system approvals, the manufacturer finally receives a type approval for the vehicle. Now the earnings can come.
With your cybersecurity management system, you ensure that all necessary cybersecurity activities before, during and after product development are carried out diligently. Until the last vehicle is due for scrapping. Cybersecurity, let me emphasize this once again, is not an afterthought. Rather, it has to be considered from the very beginning and maintained throughout the lifecycle.
Therefore, software updates are so important. Because they ensure that the connected car always stays secure.
WE CAN SUPPORT YOU WITH
- Fostering awareness for the need for comprehensive end-to-end safeguards
- Detailed assessments of any threats posed
- Matching your cybersecurity policies to processes, products and IT requirements; managing involved specialists
- Assessing and improving your development processes with respect to security issues
- Adapting existing workflows and procedures to address key cybersecurity issues
- Ensuring systems conform to UNECE homologation guidelines
- Definition and introduction of new development processes in keeping with the requirements of ISO/SAE 21434
- Evaluation, development and implementation of cybersecurity management systems
- Selection of relevant security technology and industry standards according to your requirements
