- ClassificationCategoryAutomotive SecurityDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeRegulationLegal InstrumentRegulationSectorTransportation SectorIndustryAutomotive
- Region / PublisherRegionGlobalRegion DetailUnited Nations Economic Commission for Europe (UNECE)PublisherUnited Nations Economic Commission for Europe (UNECE)
- VersioningVersion2020Effective Date22 January 2021Issue Date24 June 2020
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
UN Regulation No. 155 is published by the UNECE/WP.29 and is publicly available on the UNECE website. License included with platform
Framework text is licensed by its publisher and is included only where stated above.
Overview
UNECE WP.29 — Vehicle Cybersecurity Regulation (R155) is an international automotive cybersecurity regulation that requires vehicle manufacturers to implement and maintain cybersecurity management systems to ensure the security of vehicles throughout their lifecycle. Its primary goal is to mitigate cybersecurity risks that could impact road safety, vehicle operations, and data protection.
Published by the United Nations Economic Commission for Europe (UNECE), this regulation is mandatory for automotive manufacturers selling vehicles in markets governed by UNECE member states, including much of Europe and parts of Asia. R155 provides requirements related to risk management, secure software updates, and the protection of vehicle electronic systems from cyber threats, supporting organizations in establishing effective cybersecurity controls and compliance practices.
To comply with UNECE R155, organizations integrate cybersecurity risk assessments, develop and enforce technical security controls, and maintain ongoing incident response capabilities as part of their product development and management processes. The regulation also aligns with established information security frameworks, supporting automotive cybersecurity governance and audit readiness within broader compliance programs.
Why it Matters
UNECE WP.29 R155establishes vehicle cybersecurity management, ensuring automotive manufacturers safeguard vehicles and their data throughout the entire lifecycle.
Key benefits include:
- Strengthen cybersecurity governance
Promote a structured, organization-wide approach to managing vehicle cybersecurity risks and enforcing security accountability across product teams.
- Enhance regulatory alignment
Enable compliance with international requirements, supporting lawful vehicle market access and aligning automotive practices with global regulatory expectations.
- Improve incident response readiness
Mandate development of processes for timely detection of, and effective response to, cyber threats affecting vehicle safety or operational integrity.
- Protect sensitive vehicle data
Support safeguards for in-car data and critical vehicle functions, minimizing the risk of unauthorized access or data breaches.
- Increase audit and compliance readiness
Require systematic documentation and process validation, simplifying internal and external audits for regulatory and customer compliance.
How it Works
The UNECE WP.29R155 Vehicle Cybersecurity Regulation establishes a structured set of regulatory requirements that span the vehicle lifecycle, focusing on risk-based management and continuous improvement. The framework covers governance, risk assessment, technical and organizational security controls, incident detection, and response, all mapped to key lifecycle phases such as development, production, post-production, and end-of-life management. These requirements are formalized in terms of processes and controls that must be implemented and demonstrated by automotive manufacturers and their supply chains.
In practice, organizations integrate UNECE WP.29 R155 by developing and maintaining a Cybersecurity Management System (CSMS) that governs security policies, conducts periodic risk assessments, implements appropriate security controls, and ensures ongoing monitoring and reporting. Compliance activities include mapping controls to organizational processes, supporting regulatory audits, managing incident response procedures, and producing evidence of regulatory adherence. Risk management and governance processes are continuously reviewed and updated to address emerging threats and vulnerabilities throughout the vehicle’s lifecycle.
SmartSuite enables operationalization of UNECE WP.29 R155 by providing control libraries mapped to regulatory requirements, risk registers for tracking cyber risks, and centralized policy governance tools. Organizations use compliance tracking, evidence collection modules, audit readiness features, and reporting dashboards to manage the regulatory lifecycle and demonstrate continuous compliance withR155 mandates throughout their automotive security programs.
Key Elements
- Cybersecurity Management System Structure
Establishes organizational processes and responsibilities for managing vehicle cybersecurity across the development lifecycle.
- Risk Assessment and Treatment Process
Describes systematic approaches for identifying, evaluating, and addressing cyber risks to vehicle systems.
- Cybersecurity Controls for Vehicle Systems
Specifies technical and organizational measures to safeguard vehicle electronic systems from cybersecurity threats.
- Incident Response and Notification
Outlines procedures for detecting, reporting, and responding to cybersecurity incidents affecting vehicles.
- Secure Software Update Processes
Defines requirements for authentication, integrity, and delivery of software and firmware updates to vehicles.
- Continuous Monitoring and Review
Provides mechanisms for ongoing assessment and improvement of cybersecurity measures throughout the vehicle’s operational life.
Framework Scope
UNECE WP.29 —Vehicle Cybersecurity Regulation (R155) is adopted by automotive manufacturers producing vehicles for regulated markets, encompassing electronic systems, software, and connectivity features within vehicles. It typically governs environments during product development and vehicle lifecycle management, supporting ongoing risk management, cybersecurity controls, and compliance oversight for regulatory and operational requirements.
Framework Objectives
UNECE WP.29 —Vehicle Cybersecurity Regulation (R155) sets requirements for managing automotive cybersecurity risks and ensuring compliance throughout the vehicle lifecycle.
Strengthen cybersecurity governance and oversight for connected vehicle systems
Establish risk management processes specific to automotive security threats
Enhance data protection by safeguarding personal and operational vehicle information
Support regulatory compliance with evolving vehicle cybersecurity and privacy standards
Improve operational resilience against cyber threats affecting vehicle safety and performance
Demonstrate audit readiness through effective documentation of security controls and processes UNECE WP.29 R155 mandates vehicle cybersecurity requirements and is commonly implemented alongside ISO/SAE 21434 (cybersecurity engineering), ISO 26262 (functional safety), and UNECE R156 (software update management). Organizations adopt R155 for regulatory type-approval, demonstrating compliance, strengthening security governance, and aligning engineering and update processes with certification requirements.
Framework in Context
UNECE WP.29 R155 mandates vehicle cybersecurity requirements and is commonly implemented alongside ISO/SAE 21434 (cybersecurity engineering), ISO 26262 (functional safety), and UNECE R156 (software update management). Organizations adopt R155 for regulatory type-approval, demonstrating compliance, strengthening security governance, and aligning engineering and update processes with certification requirements.
Common Framework Mappings
Organizations commonly map R155 to related automotive safety, privacy, and cybersecurity standards to ensure cohesive risk management, regulatory compliance, and secure vehicle software lifecycle practices.
Mapped frameworks include:
EU General Data Protection Regulation (GDPR)
ISO 26262 —Road vehicles — Functional safety
ISO/IEC 27001 —Information security management
ISO/SAE 21434 —Road vehicles — Cybersecurity engineering
MITRE ATT&CK
UNECE WP.29 —Vehicle Software Update Regulation (R156)
How SmartSuite Supports UNECE WP.29 (R155)
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Manage UNECE WP.29 (R155) requirements by structuring cybersecurity management systems (CSMS), tracking vehicle risks, and maintaining evidence supporting regulatory approval and lifecycle compliance.
Cybersecurity Management System (CSMS)
Organize policies, governance, and processes required for vehicle cybersecurity certification.
Vehicle Risk Assessment and TARA Tracking
Manage threat analysis and risk assessments across vehicle platforms and components.
Control Implementation and Traceability
Link cybersecurity controls to risks, systems, and lifecycle requirements.
Vehicle Vulnerability and Incident Management
Track vulnerability disclosures, incident investigations, and remediation activities affecting vehicle systems.
Supplier and Supply Chain Security Oversight
Manage supplier requirements, assurance evidence, and third-party cybersecurity risks.
Regulatory Compliance and Type Approval Reporting
Provide dashboards supporting CSMS compliance, audit readiness, and regulatory submissions.
Related frameworks
GDPR is an EU regulation that protects individuals' personal data and strengthens organizations' accountability for privacy.
ISO/IEC 27001:2022 is an international ISMS standard that helps organizations manage information security risks and protect data.
ISO/SAE 21434 is a cybersecurity engineering standard that defines processes to manage cyber risks across vehicle lifecycles and supply chains.
Frequently Asked Questions For UNECE WP.29 — Vehicle Cybersecurity Regulation (R155)
UN Regulation No. 155 establishes mandatory requirements for automotive cybersecurity management systems (CSMS) to ensure vehicles are protected against cyber threats throughout their lifecycle. Its primary goal is to address cybersecurity risks in the design, development, production, and post-production of vehicles.
Yes, compliance with UN Regulation No. 155 is mandatory for vehicle manufacturers seeking type approval in many jurisdictions, including the European Union. Without demonstrating compliance, manufacturers cannot market new vehicle types in these regions.
UN Regulation No. 155 applies to passenger vehicles, light commercial vehicles, heavy-duty vehicles, and buses. It also covers electronic components and systems related to cybersecurity, throughout their supply chain.
A CSMS is a formal set of processes, policies, and procedures required by UN Regulation No. 155 to manage and mitigate cybersecurity risks throughout a vehicle's lifecycle. Key artifacts include documented risk assessments, incident response plans, and security testing evidence.
Implementation involves developing and maintaining a CSMS, performing vehicle and component risk assessments, defining and applying cybersecurity controls, and preparing for incident detection and response. Organizations must also ensure traceability, accountability, and continuous improvement within their cybersecurity management processes.
UN Regulation No. 155 complements existing cybersecurity standards such as ISO/SAE 21434 by embedding similar risk management principles and controls into regulatory requirements. While ISO/SAE 21434 provides technical guidance, UN R155 is legally enforced and necessary for type approval.
Organizations must regularly update their CSMS, conduct continuous risk monitoring, log and respond to incidents, and document all activities for audit and regulatory review. Periodic reviews and evidence-based reporting are required to demonstrate ongoing compliance for type-approved vehicles.
SmartSuite enables organizations to manage UN Regulation No. 155 compliance by facilitating cybersecurity risk tracking, control implementation, and ongoing evidence collection. It provides tools for documentation, workflow management, audit readiness, and streamlined reporting, supporting continuous oversight and regulatory alignment.
UNECE WP.29 Regulation R155 is used to establish minimum cybersecurity requirements for vehicles, ensuring that manufacturers manage cyber risks throughout a vehicle’s lifecycle. It provides a regulatory basis for addressing threats to vehicle systems and road safety through structured cybersecurity controls and processes.
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.