R155 and R156 Keep Cybersecurity Inside the Type-Approval Chain

The certificate is part of a larger approval system

At GRVA’s 26th session, the agenda included a proposal from the IWG on Cyber Security and Software Updates for a supplement to UN Regulation No. 155 and a separate multi-country proposal to amend UN Regulations Nos. 155 and 156. The existence of these proposals is a useful reminder that CSMS and SUMS evidence sits inside an evolving type-approval framework.

For engineering organisations, the important point is not to predict the final wording. It is to preserve the relationship between management-system evidence, the authority relying on it, the vehicle type being approved and the software configuration that the evidence is intended to cover.

Configuration identity is where governance becomes technical

UN R155 requires cybersecurity risk management across the vehicle lifecycle. UN R156 adds software-update management and software-identification controls. In practice, those governance systems meet at configuration identity: which approved vehicle type is running which software, under which update history, and with which evidence.

If CSMS evidence is maintained separately from software configuration and type-approval records, an organisation can have individually valid artefacts while losing the ability to demonstrate that they describe the same approved state. The control is therefore traceability across the chain, not the existence of each certificate or record in isolation.

GRVA proposals should be monitored as proposals until adopted. But the engineering response does not need to wait: keep approval authority, management-system scope, vehicle type, software identity and change evidence connected.

Related context. Keeping cybersecurity evidence connected to approval authority also depends on controlled vehicle provisioning and software identity and on supplier evidence that remains traceable across the lifecycle.