Build a UN R155 cyber security management system with less effort

UN R155 is a United Nations vehicle regulation, adopted under the 1958 Agreement by UNECE WP.29, that makes cyber security a condition of type approval. It requires manufacturers to hold a Certificate of Compliance for their cyber security management system (CSMS) and to show that each vehicle type has been risk assessed, protected, tested and monitored against cyber attacks.

Vehicle manufacturers seeking type approval in countries that apply UN R155 must comply. It covers passenger cars, vans, buses and trucks, and certain trailers fitted with electronic control units. Suppliers are not approved directly, but manufacturers must manage supplier risk, so suppliers are expected to show their own cyber security practices and provide evidence through contracts.

UN R155 entered into force on 22 January 2021. In the European Union it became mandatory for new vehicle types from July 2022 and for all newly registered vehicles from July 2024. Other contracting parties to the 1958 Agreement decide their own application dates, so manufacturers should check the timetable in each market they sell into.

A CSMS is the organisational framework of processes, responsibilities and governance a manufacturer uses to manage cyber risk to vehicles across development, production and post-production. Under UN R155 it must cover risk identification, assessment and treatment, testing, monitoring for attacks, timely mitigation of vulnerabilities and management of dependencies on suppliers and service providers.

Without UN R155 approval a manufacturer cannot obtain type approval for affected vehicles in markets that apply the regulation, so those vehicles cannot be sold or registered there. Approval can also be withdrawn if production no longer conforms to the approved type, and manufacturers must keep reporting monitoring results to the approval authority.

UN R155 sets the legal requirements, while ISO/SAE 21434 is the automotive engineering standard most manufacturers use to show how they meet them for vehicles and components. ISO 27001 covers organisational information security and overlaps with CSMS governance, risk management and supplier controls, so an existing ISO 27001 programme gives a useful head start but is not sufficient on its own.

Compliance has two steps. First, the manufacturer has its CSMS assessed by an Approval Authority or Technical Service to obtain a Certificate of Compliance. Second, each vehicle type is assessed for risk analysis, mitigations, testing and monitoring capability before type approval is granted. Manufacturers must then report monitoring activity to the approval authority on an ongoing basis.

UN R155 is mapped in OneClickComply's control library and is available on request rather than as a live framework today. It helps with the organisational side of a CSMS, such as risk registers, supplier risk, policies and continuous monitoring of IT systems. Vehicle engineering, testing and type approval itself remain with your teams, Technical Service and Approval Authority.