To assess CSMS compliance, compare your organization's cybersecurity processes and evidence against the work products of ISO/SAE 21434, score each gap, and close the biggest ones before an auditor or customer finds them. A Cybersecurity Management System (CSMS) is the set of organization-wide processes that UN Regulation No. 155 requires a vehicle manufacturer to have certified before a vehicle type can be approved. Suppliers feel the same pressure through their customers' contracts.
The big deadline is behind us. In the EU, UN R155 has applied to existing type approvals of cars, vans, trucks and buses built in unlimited series since July 7, 2024. That makes CSMS compliance an ongoing job: the certificate has to be renewed, the monitoring has to be reported, and the processes have to keep working. Below is the four-step self-assessment we use to find out where an organization stands.
What CSMS compliance means under UN R155
UN Regulation No. 155 (UN R155) is a vehicle type-approval rule from the United Nations Economic Commission for Europe (UNECE), applied by the EU, the UK, Japan and other parties to the UNECE 1958 Agreement that adopt it. Only vehicle manufacturers can obtain R155 approval, and to get it they need a Certificate of Compliance for their CSMS from an approval authority.
That certificate is not a one-time event. Under R155:
- The certificate is valid for a maximum of three years, and the manufacturer applies for a new one or an extension before it expires.
- The approval authority can check at any time that the requirements are still met, and withdraws the certificate if they are not.
- The manufacturer reports at least once a year on the outcome of its monitoring, including new cyber-attacks, and confirms its mitigations are still effective.
The CSMS has to cover development, production and post-production, with processes to manage cybersecurity in the organization, identify and treat risks, test vehicle types, keep the risk assessment current, monitor for and respond to attacks, and manage dependencies on suppliers. R155 does not mandate ISO/SAE 21434, the international standard for road vehicle cybersecurity engineering; it mentions it only in a footnote as an example. In practice, 21434 is how most of the industry builds and evidences a CSMS, which is why we assess against it.
For suppliers, the obligation arrives through the manufacturer. The UK Vehicle Certification Agency (VCA) notes that requirements can differ between manufacturers and points to ISO/SAE 21434 Clause 7 for aligning responsibilities between customer and supplier. We cover that side in supplier management and ISO/SAE 21434.
How to assess CSMS compliance in four steps
Every organization's process is a bit different, but an internal assessment comes down to the same four steps.
1. Gather the information
ISO/SAE 21434 has 15 clauses, and different people own different parts of it across the organization and the product lifecycle. Start by naming the owner of each work product, because they know the area best and can answer the questions. For example:
- WP-05-01, cybersecurity policy, rules and processes: owned at the organization level, often by the Chief Information Security Officer (CISO), IT security managers and a policy analyst.
- WP-05-03, evidence of the organization's management systems: organization and quality, often quality assurance managers, a compliance officer and a management system analyst.
- WP-06-01, cybersecurity plan: project management, often with the secure engineering process owner, cybersecurity managers and security architects.
Next, interview each owner with a structured questionnaire built on the 21434 requirements behind their work products. Record the answers, and whenever someone says a requirement is met, ask for the document that shows it.
2. Analyze what you collected
Review the policies, procedures, project plans, risk assessments and incident response plans against the 21434 requirements. Annex A of the standard lists every activity next to the work product it produces, which makes a good checklist. Look for documents that are missing, and for documents that exist but contradict each other.
3. Score the gaps
Compare each piece of existing material with the work product it should satisfy, and give it a score so the severity is visible at a glance. We use this scale:
- 0, no evidence: no process or supporting document for the requirement.
- 1, major gaps: processes or documents exist but do not meet 21434.
- 2, needs adjusting: existing processes and documents partly meet 21434.
- 3, sufficient: processes and documents are mature and meet 21434.
4. Remediate
Turn the scores into a plan. Some gaps need a new work product written from scratch; others only need an existing document adjusted. In our experience, an organization that already works to ISO 26262 for functional safety can reuse much of that documentation and process structure for cybersecurity, which saves real time.
Remediation includes the parts that are hard to show on paper. Clause 5 of 21434 asks for a strong cybersecurity culture, competence and continuous improvement; our piece on cybersecurity culture within the CSMS covers what that looks like.
What auditors look for in a CSMS audit
For R155, the approval authority or its technical service checks that the CSMS is in place and meets the regulation. The UK Vehicle Certification Agency describes R155 as audit-based: manufacturers submit their management system for assessment and VCA interviews stakeholders. The approach is systematic and risk-based and covers organizational processes, responsibilities and governance. It also expects evidence that the manufacturer understands its supply chain risks and passes security requirements down to suppliers.
ISO/SAE 21434 adds an audit of its own. It requires an independent cybersecurity audit to judge whether the organization's processes achieve the standard's objectives. The auditors can be internal or external, and the audit can be combined with a quality management audit such as IATF 16949.
Guidance for running these audits is in ISO/PAS 5112, "Road vehicles: Guidelines for auditing cybersecurity engineering." It covers managing a CSMS audit program, conducting organizational audits, auditor competence and audit evidence, and it does not cover product cybersecurity assessments. A second edition, ISO/DTS 5112 (a draft Technical Specification), is in the approval phase and will replace it.
The post-production side gets real scrutiny too, because the yearly report depends on it. If monitoring and incident response are your weak spots, start with continual automotive cybersecurity activities.
How Block Harbor helps close CSMS gaps
Our CSMS team runs this assessment with your key stakeholders, then helps close what it finds. We recommend starting with the gap assessment before any remediation, so the work is scoped by the evidence instead of by guesswork. We bring our own ISO/SAE 21434 work product templates for both steps, which shortens the path for teams writing these documents for the first time.
If a certificate renewal, a customer audit or a new program is coming up, tell us where you are and we will talk through which gaps are worth closing first. To build your team's footing in the standard in the meantime, our courses are on VSEC Learn.
References
- ISO/SAE 21434:2021, Road vehicles: Cybersecurity engineering
- UN Regulation No. 155, Cyber security and cyber security management system
- ISO/PAS 5112:2022, Road vehicles: Guidelines for auditing cybersecurity engineering
Subject expert
Dustin Mills is Director of Product Cybersecurity Engineering & Operations at Block Harbor, where he leads end-to-end engagements with OEMs and suppliers that secure connected vehicles across their lifecycle. He's at his best when working on ambiguous problems that span multiple teams.
%201.svg){kind=logo}
