1. Purpose and scope
The cybersecurity case is the argument, backed by evidence, that the item is adequately secure. It links the goals and claims to the work products that show they are met: the TARA, the concept, specifications, verification and validation reports, and the residual risk acceptance. An independent cybersecurity assessment then judges whether the work and the result are good enough.
For a vehicle maker, type approval of a vehicle type for cybersecurity under UN R155 requires a valid certificate of compliance for the CSMS and a documentation package showing how the vehicle type was assessed and protected, including how the threats and mitigations listed in the regulation were considered and how suppliers' risks were managed. The technical service reviews and may test the vehicle. For a supplier, this stage produces the evidence the customer asked for in the interface agreement.
In scope: the cybersecurity case, the assessment, the type approval documentation package, interaction with the technical service or customer and the approval record. Out of scope: production controls, which follow in Production & Release for Post-Development.
12 more sections for registered members.