1. Purpose and scope
A vehicle cybersecurity programme cannot be run project by project. The policy, the processes for risk management, development, production and post-development work, the competence of the people and the way records are kept must exist before any one project depends on them. This stage builds that cybersecurity management system and proves it in an organisational audit.
For a vehicle maker the system is what the approval authority or its technical service assesses before it issues a certificate of compliance under UN R155, and the certificate is a precondition for type approval of any vehicle type. For a tier one supplier, a chip maker or an IP provider, the system is what customers audit and what the cybersecurity interface agreement will refer to. ISO/SAE 21434 describes the organisational requirements in its own words, and ISO/PAS 5112 gives guidance on how such a system is audited.
In scope: the cybersecurity policy and governance, roles and the authority to accept risk, the documented and deployed processes, competence and awareness, the cybersecurity culture, information sharing rules, tool and information security management, supplier management rules and the first organisational audit. Out of scope: the cybersecurity work of any particular item, which starts in Item Definition, Cybersecurity Plan & Interface Agreements.
12 more sections for registered members.