UN Regulation No. 155

Why does it matter?

UN R155 turned vehicle cybersecurity from an engineering preference into an approval condition: without a valid Certificate of Compliance for CSMS (paragraph 7.3.1) and an exhaustive risk assessment of the vehicle type (7.3.3), an Approval Authority shall refuse type approval (5.1.3), and the vehicle cannot carry the E-mark for the markets that apply the Regulation. The obligations continue after approval: continual monitoring that includes vehicles after first registration (7.2.2.4), a report to the Approval Authority at least once a year (7.4.1) and conformity of production checks (9). Suppliers are inside the perimeter, because the manufacturer must show how the CSMS manages dependencies on contracted suppliers and service providers (7.2.2.5).

Key benefits include:

• Approval depends on it

Paragraph 5.1.3 requires the Approval Authority to refuse type approval where the manufacturer has not performed the exhaustive risk assessment of 7.3.3, has not implemented proportionate mitigations or has not tested them before approval.

• One certificate, many vehicle types

The Certificate of Compliance for CSMS (paragraph 6, Annex 4) covers the manufacturer's processes and is valid for a maximum of three years (6.7); each vehicle type approval then references its number (Annex 1, item 9.3).

• A shared threat catalog

Annex 5, Part A lists the threats and attack methods every risk assessment must consider (7.2.2.2(b), 7.3.3), grouped from back-end servers to external connectivity and vehicle data and code.

• Lifecycle coverage

The CSMS must apply to the development, production and post-production phases (7.2.2.1), with post-production defined as lasting until no vehicles of the type remain in operation (2.7).

• Evidence that lasts

The approval documentation package and the material open for inspection must stay available for at least ten years after production of the type ends (3.3), and the manufacturer must provide data to support analysis of attempted or successful attacks (7.2.2.2(h), 7.3.7(c)).

How does it work?

The CSMS is assessed first. An Approval Authority appointed by the Contracting Party assesses the manufacturer and issues the Certificate of Compliance for CSMS (6.1); the manufacturer applies with documents describing the CSMS and a signed declaration in the form of Annex 1, Appendix 1 (6.2 to 6.4). The certificate is valid for a maximum of three years (6.7), can be verified at any time and withdrawn (6.8), and is renewed or extended after a positive re-assessment (6.10). Its expiry or withdrawal counts as a modification of the approvals of the vehicle types it covered (6.11).

Paragraph 7.2.2.2 lists the processes the CSMS must contain: managing cyber security in the organization (a), identifying risks to vehicle types including the Annex 5 Part A threats (b), assessing, categorizing and treating them (c), verifying they are managed (d), testing a vehicle type (e), keeping the risk assessment current (f), monitoring, detecting and responding to attacks, threats and vulnerabilities (g), and providing data to analyze attacks (h). The CSMS must cover development, production and post-production (7.2.2.1); mitigation must follow within a reasonable timeframe (7.2.2.3); monitoring must be continual and include vehicles after first registration (7.2.2.4); and dependencies on suppliers and service providers must be managed (7.2.2.5).

The vehicle type is approved second. Paragraph 7.3 requires a valid CSMS certificate (7.3.1), management of supplier-related risks (7.3.2), an exhaustive risk assessment of the critical elements, their interactions and external systems (7.3.3), proportionate mitigations drawn from Annex 5 Parts B and C or justified alternatives (7.3.4), secured aftermarket environments (7.3.5), sufficient testing before approval (7.3.6), detection, monitoring and forensic measures (7.3.7) and cryptographic modules in line with consensus standards (7.3.8). The Annex 1 information document records the certificate number, risk assessment, mitigations, tests and supply chain treatment (items 9.3 to 9.8); the Authority checks the documents (5.1.1) and tests a sample vehicle, focused on high risks (5.1.2).

Obligations then run for the life of the type. The manufacturer reports its monitoring results, new cyber-attacks and the continued effectiveness of its mitigations to the Approval Authority at least once a year (7.4.1). Modifications affecting cybersecurity must be notified (8.1), conformity of production is verified every three years (9.1.2) and approvals can be withdrawn for non-conformity (10.1). Annex 5 Part A indexes seven threat groups, from back-end servers and communication channels to update procedures, external connectivity, vehicle data and code and insufficiently hardened systems; Parts B and C give the matching mitigations, and paragraph 4 of the annex lists the attack impacts the analysis must consider.

Key Elements

• Scope (paragraph 1.1, as amended by Supplement 3)

Vehicles of Categories L, M, N and O with regard to cyber security, if fitted with at least one electronic control unit; without prejudice to data-access, privacy and replacement-part legislation (1.2 and 1.3 as renumbered).

• Cyber Security Management System (2.3)

A systematic risk-based approach defining organizational processes, responsibilities and governance to treat risk associated with cyber threats to vehicles and protect them from cyber-attacks.

• Certificate of Compliance for CSMS (paragraph 6, Annex 4)

Issued by the Approval Authority after assessment and a signed declaration; valid for a maximum of three years; verifiable and withdrawable at any time; renewal after positive re-assessment.

• CSMS requirements (7.2.2.1 to 7.2.2.5)

Coverage of development, production and post-production; the eight process areas of 7.2.2.2(a) to (h); timely mitigation; continual monitoring including vehicles in the field; supplier dependencies.

• Vehicle type requirements (7.3.1 to 7.3.8)

Valid certificate; supplier risks; exhaustive risk assessment against Annex 5 Part A; proportionate mitigations from Parts B and C; secured aftermarket environments; pre-approval testing; detection, monitoring and forensics; consensus cryptography.

• Reporting and Annex 5 (7.4; Annex 5)

Annual reporting of monitoring results to the Approval Authority; the indexed threat list (Part A), vehicle mitigations (Part B) and off-vehicle mitigations (Part C) with the attack-impact list.

What does it cover?

As adopted, paragraph 1.1 covered vehicles of Categories M and N, Category O vehicles with at least one electronic control unit and (paragraph 1.2) L6 and L7 vehicles with automated driving from level 3; Supplement 3 (in force January 10, 2025) replaced this with Categories L, M, N and O fitted with at least one electronic control unit. The Regulation does not govern access to vehicle data, privacy law or replacement parts (renumbered 1.2 and 1.3). It applies in the Contracting Parties to the 1958 Agreement that apply it: ECE/TRANS/WP.29/343/Rev.33/Add.1 records a date of application of January 22, 2021 for the European Union, the United Kingdom, Japan, Australia, New Zealand, South Africa, the Republic of Korea and others.

What are its objectives?

Paragraph 5.1.1 states what the Approval Authority must verify the manufacturer has done for the vehicle type.

Collect and verify the information required through the supply chain, so that supplier-related risks are identified and managed (5.1.1(a)).

Document the risk assessment, test results and mitigations applied to the vehicle type, including the design information supporting the assessment (5.1.1(b)).

Implement appropriate cyber security measures in the design of the vehicle type (5.1.1(c)).

Detect and respond to possible cyber security attacks (5.1.1(d)).

Log data to support the detection of cyber-attacks and provide data forensic capability for analysis of attempted or successful attacks (5.1.1(e)).

Framework in Context

UN R155 is the regulatory instrument; ISO/SAE 21434 is the engineering standard manufacturers and suppliers most often use to build the processes a CSMS assessment examines. Its twin, UN Regulation No. 156 on software updates, was adopted at the same session and entered into force on the same day, January 22, 2021, so a manufacturer normally seeks both certificates. GRVA has also submitted to WP.29 interpretation documents for the Regulation (ECE/TRANS/WP.29/2021/59, March 2021) and recommendations on cyber security and software updates (ECE/TRANS/WP.29/2022/60, June 2022), and keeps an informal working group on cyber security and over-the-air software updates. Privacy and data-access rules sit outside the Regulation by its own terms.

Common Framework Mappings

Organizations map UN R155 to the frameworks below so that one risk assessment, one mitigation set and one body of evidence serve the CSMS assessment, the vehicle type approval and the engineering and information security programs around them.

Mapped frameworks include:

GDPR

ISO 26262

ISO 27001:2022

ISO/SAE 21434

MITRE ATT&CK

UN R156