Bind the claim to a vehicle state
Keep the vehicle type, electrical/electronic architecture, external interfaces and released configuration identifiable. A process-level record cannot answer every vehicle-specific exposure question.
Framework guide · UN R155
UN R155: connect the CSMS to vehicle evidence.
A cybersecurity management system is useful only when its processes reach the vehicle decision. Follow the evidence from supplier inputs and product configuration to monitoring, response and the approval boundary.
Vehicle cybersecurity, homologation, PSIRT and supplier-assurance teams.
Start with the scope
Two approval questions, one connected evidence chain.
UN Regulation No. 155 addresses vehicle cybersecurity and the Cybersecurity Management System (CSMS). The regulation distinguishes assessment of the manufacturer's CSMS from cybersecurity approval of a vehicle type. Its published text addresses supply-chain risk, vehicle risk assessment, mitigation, testing, monitoring and response.
Use the official text applicable to the approval concerned, including the relevant amendments and jurisdiction. This page is an engineering reading guide, not an applicability determination or a substitute for the approval authority's assessment. A proposal discussed at GRVA is not an adopted requirement.
CUP engineering interpretation
Turn the framework into a reviewable decision.
Make supplier evidence usable
Record who owns the technical justification, which product versions it covers and what the manufacturer needs when a supplier cannot deliver a fix or test result.
Connect detection to a response owner
Translate a report or alert into affected scope, a named decision owner, containment options and a review trigger. Retain the uncertainty as well as the conclusion.
Review changes across the lifecycle
Carry risk decisions into production, provisioning and operation. Where updates are involved, examine the related R156 question separately rather than treating a valid signature as the complete security argument.
Where the assurance argument loses its evidence.
- A CSMS certificate is presented as the complete evidence for a particular vehicle configuration.
- Supplier evidence has no version boundary, accountable owner or reassessment trigger.
- An authenticated API or signed software package is assumed to authorise every resulting vehicle action.
- Monitoring produces alerts, but the organisation cannot turn them into a bounded product response.
6 selected analyses · newest first
R155 engineering questions in real cases.
These are CUP applications of assurance questions. They do not establish a manufacturer's conformity or nonconformity with R155.
12 Oct 2026 · Automotive · Connected Vehicle Security
The BYD Shark 6 Case Shows Why Remote Authority Needs Explicit Boundaries
Ask what each demonstrated remote path actually proves about starting conditions, access and vehicle authority.
9 Oct 2026 · Automotive · Regulation
R155 and R156 Keep Cybersecurity Inside the Type-Approval Chain
Connect CSMS and software-update evidence to vehicle type, software identity and change history; keep proposed regulatory changes distinct from adopted text.
12 Aug 2026 · Automotive · Product Security · Supply Chain
A Valid Signature Does Not Make Vulnerable Firmware Safe
Separate a signature's authenticity claim from the vulnerability state and remediation responsibilities behind the released firmware.
9 Aug 2026 · Automotive · Product Security · Supply Chain · OT & ICS
How a Software-Defined Vehicle Could Inherit Compromise Before Delivery
Identify who can bind device identity, code and operational authority before vehicle delivery, and what record supports that decision.
31 Jul 2026 · Automotive
An IDPS Alert Is Not an Incident Response Capability
Check how a detection result becomes affected-product scope, containment and an accountable response decision.
30 Jul 2026 · Automotive · Supply Chain
The Next Production Delay May Be Missing Cybersecurity Evidence
Examine the evidence handoff when release and production decisions depend on a supplier's cybersecurity record.
Apply the evidence
Take one decision into a working sheet.
Start with scope and authority →
Record the approval question and evidence owner before mapping the remaining checkpoints.
Review supplier evidence →
Identify the evidence that must cross the supplier boundary and its version limits.
Review an SBOM / VEX claim →
Tie the component and product version to a scoped vulnerability claim, supporting evidence and an owned response decision.
Follow the Automotive Decisions reading path
Notes in the working sheets stay in your browser. You can export them without registering. The sheets organise evidence; they do not determine conformity.