Security Updates
Like a computer or smartphone, a vehicle needs regular updates to close known and potential vulnerabilities.
Key Vehicle Cybersecurity Standards and Regulations
ISO/SAE 21434
the international standard for managing cybersecurity risk across a vehicle’s life cycle
AIS 189 (CSMS)
India’s requirements for a Cyber Security Management System
AIS 190 (SUMS)
India’s requirements for a Software Update Management System
UNECE R155
the UN regulation on vehicle cybersecurity and cybersecurity management systems
UNECE R156
the UN regulation on software updates and software update management systems
Automotive Cybersecurity: Regulations and Protective Measures
ATS Poland can support you with gap assessments, process and documentation readiness, and certification guidance, helping you meet these requirements and bring your vehicles to market with confidence. Contact Us to discuss your cybersecurity compliance needs.
A Tightening Regulatory Landscape
As vehicles become more connected, the risk of cyberattacks grows with them. To respond, the United Nations Economic Commission for Europe (UNECE) introduced R155 and R156 under the 1958 Agreement. Together they require cybersecurity to be built into motor vehicles across their whole life cycle and throughout the supply chain.
Alongside these rules, ISO/SAE 21434 (Road Vehicles: Cybersecurity Engineering) was published in August 2021. It gives organisations a practical way to put the regulatory requirements into practice and, for the first time, gives manufacturers one consistent framework to work from. Because the audit reaches the entire supply chain, suppliers must meet these expectations too, not only vehicle makers.
TISAX®: Information Security Across the Industry
TISAX® (Trusted Information Security Assessment Exchange) is an assessment and data-sharing mechanism for information security in the automotive sector, created by the German Association of the Automotive Industry (VDA). It is built on the VDA ISA catalogue, which itself draws on ISO/IEC 27001.
In practice, TISAX® is often a precondition for doing business with automotive partners, especially when sensitive information is exchanged. Its purpose is to avoid repeated audits and to establish a common security baseline across the industry.
Quick Reference
| Item | Purpose |
|---|---|
| UNECE R155 | Cybersecurity and cybersecurity management systems |
| UNECE R156 | Software updates and software update management systems |
| ISO/SAE 21434 | Cybersecurity engineering across the vehicle life cycle |
| TISAX® | Information security assessment for the automotive supply chain |
Scope
Protective Measures to Put in Place
Meeting these requirements can have far-reaching effects on a vehicle’s safety concept and its electrical/electronic (E/E) architecture. The goal is to apply the rules across the supply chain, make new vehicle generations more secure, and update outdated processes to match today’s threats. The following measures are recommended throughout the vehicle life cycle:
Network Segmentation
Keeping critical functions separate from less critical ones limits how far an attack can spread.
Hardware Security
Hardware-based firewalls or dedicated security chips can ensure that only signed, trusted software runs on the vehicle.
Penetration Testing
Regular testing by security specialists uncovers weaknesses in vehicle systems so they can be fixed before attackers find them.
OEMs Face Cybersecurity Pressure Across Design, Launch, And Operations
Evolving Threat Landscape
- Increased attack surfaces with connected systems, ADAS, and OTA updates
- Emerging threats like AI-driven attacks
Regulatory Compliance
- Dynamic and region-specific regulations (UNECE WP.29, ISO/SAE 21434)
- High costs for testing and certification
Security & Cost Trade Offs
- High costs and extended development time
- Balancing security with performance KPIs
Ecosystem & Supply Chain Complexity
- Diverse suppliers with inconsistent cybersecurity practices
- Complex supply chains with Tier-1/Tier-2 suppliers
- Vulnerabilities from third-party components
Security Gaps in Development
- Incomplete Threat Analysis and Risk Assessment (TARA)
- Post-development cybersecurity implementation
Organizational and Resource Challenges
- Lack of coordination across teams
- Shortage of skilled professionals
- Resistance to change within the organization
Data Protection & User privacy
- Handling of personal and driving behavior data.
- Data protection and User Privacy
Cybersecurity Is Now A Lifecycle Evidence Requirement
01 · MARKET & GOVERNANCE
 Europe |  USA |  Japan |  China |  Korea |  UK |  India | |
|---|---|---|---|---|---|---|---|
| Automotive Cybersecurity Regulations | UNECE R 155/ 156 | Self Certification** | UNECE R 155/ 156 | GB 44495 - 2024 | UNECE R 155/ 156 | UNECE R 155/ 156 | AIS189/190 |
| New Models Target Date | July 2022 | NA | Jan 2024 | NA | July 2022 | July 2022 | Oct 2027 |
| All Models Target Date | July 2024 | NA | May 2026 | Jan 2026 | July 2024 | July 2024 | Oct 2028 |
| Data Privacy | GDPR | CCPA | Personal Information Protection | Jan 2026 | Personal Information Protection | GDPR | PDPB |
- GDPR- General Data protection Regulation; POPIA- Protection of Personal Information Act
- PDPB- Personal Data Protection Bill ; PDPL- Personal Data Protection Law
- R155/R156 and ISO/SAE 21434 practices support a defensible cybersecurity engineering process, while local market requirementsmust be assessed separately.
R155 Makes OEMs Responsible
Across The Vehicle Lifecycle
CSMS Process Definition
Full vehicle TARA
Vehicle level security requirements
Cybersecurity Implementation (Network+ Components Owned)
Cybersecurity Infrastructure & Integration(KMS)
Fuzz & Penetration Testing
Homologation
Vulnerability Management
Cybersecurity Validation Must Become Homologation Evidence
- Complete Homologation Responsibility
- Vehicle Program Homologation readiness
- External Audits
Homologation Support Converts Engineering Work Into Approval Evidence
07 · HOMOLOGATION & SUMS
Following process shows ATS involvement in Homologation process.
- ATS prepares definition of CSMS / SUMS
- ATS prepares compliance application
- Client sign and apply for certification to approval authority
- ATS shall coordinate with approval authorities
- Client personnel shall only be involved based on authorities' request (if any)
- Client receives approval
- Client signs declaration of compliance
- Client CSMS Approved with every 3 years renewal
- ATS prepare every vehicle model approval
- Client apply vehicle model approval
- Client vehicle certification issued
Automotive Cyber Security R155Automotive Software updates and management system R156
Cybersecurity and Software Update Management
Cybersecurity and Software Update Management System to enable protection throughout the whole product lifecycle against attacks from outside and avoid potential weaknesses and vulnerabilities of the system.
To achieve this, implementation spans four disciplines:
- Managing vehicle cyber risks.
- Securing vehicles by design to mitigate risks along the value chain.
- Detecting and responding to security incidents across the vehicle fleet.
- Providing safe and secure Software Updates and ensuring vehicle safety is not compromised, introducing a legal basis for so-called over-the-air updates to onboard vehicle software.
How We Can Help
ATS Poland supports manufacturers and suppliers with cybersecurity readiness, from gap assessments and documentation to testing and certification guidance. to discuss your compliance needs.