Relevant standards and norms for automotive cybersecurity: ISO/SAE 21434 and UNECE WP.29

Several standards and norms for automotive cyber security are currently being implemented. These will become relevant for OEMs and suppliers from 2020 and 2021. These include, in particular, ISO/SAE 21434 (Road vehicles - Cybersecurity Engineering) and UNECE / WP.29 (Regulation on Cybersecurity). In this article, we look at the current status and highlight further developments and their relevance for the automotive industry.

Initial situation

The development of vehicles is characterized by three key trends: digitalization, connectivity and the development of autonomous vehicles. In addition to safety, cybersecurity for vehicles is becoming increasingly important in this context.

ISO/SAE 21434

The standard is being developed in collaboration between ISO and SAE and therefore has a broad international basis. In addition to Europe and the USA, countries such as South Korea, Japan and China are also actively involved in the development.

Objectives of ISO/SAE 21434

ISO/SAE 21434 (Road vehicles - Cybersecurity Engineering) pursues several objectives. In particular, the standard for the automotive industry

• create a uniform terminology for cybersecurity engineering,
• define minimal requirements for processes and activities in cybersecurity engineering
• cooperation between parties involved in the value chain
• describe the "state of the art" of cybersecurity engineering overall.

The ISO/SAE Joint Working Group (JWG) is divided into individual project groups (PG) that deal with the topics of "Risk Management", "Product Development", "Operations and Maintenance" and "Overview and Interdependencies".

ISO/SAE 21434 is applicable to vehicles and their subsystems, components, connections and data. It considers hardware and software. The aim is to establish a structured process for all participants in the value creation process and to firmly anchor the topic of security in the design process.

What the standard does not specify are explicit recommendations for specific encryption technologies or implementation approaches.

Motivated by the goal of establishing "security by design", the security risk analysis plays a significant role in ISO/SAE 21434. To this end, security risk levels are determined at the level of the vehicle and the individual components. The manufacturers must prove that they manage appropriate risk levels.

You can find more information on ISO/SAE 21434, in particular on safety risk, in our blog article "Relevance of ISO 21434 for the automotive development process"

The publication of the Draft International Standard (DIS) of ISO/SAE 21434 is expected at the beginning of 2020, with the final publication of the standard a few months later.

UNECE WP.29

The Inland Transport Committee (ITC) of the United Nations Economic Commission for Europe (UNECE) aims to establish a standardized regulatory system. This is intended to facilitate international trade. In this context, the WP.29 working group deals with aspects of vehicle safety, environmental protection, energy efficiency and theft protection.

In contrast to ISO/SAE 21434, compliance with the UNECE WP.29 regulations is mandatory for vehicle manufacturers and a prerequisite for the international approval of vehicles as part of type approval.

The World Forum for Harmonization of Vehicle Regulations is working on vehicle cybersecurity regulations in the WP.29 working group.

Working Party for Automated/Autonomous and Connected Vehicles

The Working Party for Automated/Autonomous and Connected Vehicles (GRVA) deals specifically with the aspect of "Cyber Security and Software Updates" in the sub-area of "Safety and Security of Vehicle Automation and Connectivity".

Source: Informal document GRVA-02-37: 2nd GRVA session, January 28 - February 1, 2019 Agenda item 5(b)

The need to carry out threat analysis arises not only from cyber security, but also from the security aspects of data protection and software updates.

Principles for mitigation can be derived from the threat analysis, which then form the basis for recommendations for cyber security.

The GRVA proposes two levels for the cyber security assessment.

• The level of organizational structures and processes (Cybersecurity Management System Requirements) and
• the level of vehicle architecture design, including risk assessment and implementation of countermeasures (Vehicle Requirements).

The new cyber security regulations of UNECE WP.29 are expected to come into force in early/mid-2020; they will become binding after a transition phase of six months.

A concrete process specification or vehicle architecture specification is not made by UNECE WP.29. However, reference is made to ISO/SAE 21434 as a possible specification.

This closes the circle between ISO/SAE 21434 and UNECE WP.29. The importance of both standards in the context of future vehicle approvals becomes clear.

Relevance for car manufacturers and suppliers

Manufacturers who wish to register new vehicle types on the market in 2021 must comply with ISO/SAE 21434 and UNECE WP.29.

The fact that both the necessary processes and management systems as well as the requirements for the vehicle affect the entire life cycle of the vehicle poses a particular challenge.

In the area of safety, market participants have successfully managed this in the past - however, the establishment of the processes and tools took place over a period of 20 years or more. However, only 1 - 2 years remain for the implementation of the corresponding requirements for security.

The highly dynamic nature of the security domain presents participants with even greater challenges compared to safety. Adjustments to systems in the lifecycle will be the rule and no longer the exception. Processes and tools must be prepared for this dynamic.

A model-based approach is recommended for the area of risk analysis and documentation, which are central to ISO/SAE 21434 and UNECE WP.29. In this way, the effects of changes over time, including all dependencies (tracing and impact analysis), can be carried out and documented automatically.

Would you also like to analyze the cybersecurity risks of technical systems?