Cybersecurity management and regulation

Security in automotive changed character around 2022, and not because the technology changed. It changed because it became a condition of being allowed to sell.

What R155 and R156 actually do#

What a CSMS requires in practice#

The regulation is about process, so it lands as obligations on how you work.

Requirement	What it means day to day
Risk assessment	A threat analysis (TARA) per system, kept current
Risk treatment	Mitigations traced to identified threats
Verification	Evidence that mitigations work — testing, pen testing
Monitoring	Watching for new vulnerabilities affecting the fleet
Incident response	A defined path from report to fix to deployment
Supplier management	Suppliers held to the same standard, contractually
Lifecycle coverage	From concept through production to end of support

Why the SBOM is the load-bearing artefact#

A vulnerability lands on a Friday afternoon

A critical remote-code-execution vulnerability is announced in a widely used compression library.

Without an SBOM. Email every supplier. Wait. Some reply within a day, some within three weeks, some ask what version they shipped and go looking. Meanwhile nobody can say whether the fleet is exposed. Six weeks later a partial answer exists, and confidence in it is low.

With an SBOM. Query the build artefacts:

# which shipped images contain the affected library, at an affected version?
sbom-query --component "libcompress" --version-range "<2.4.1" \
           --releases "2023-*,2024-*,2025-*"

Answer in minutes: four images, two model years, roughly 180,000 vehicles. Response planning starts the same afternoon.

The difference is not diligence. It is having built the inventory automatically at the time the software was made, when it cost nothing, rather than trying to reconstruct it under pressure when it costs everything.

Gotcha

An SBOM covering only your own build is incomplete. Supplier binaries are the majority of a vehicle's software, and the components inside them are exactly where unpatched libraries hide.

Getting SBOMs from suppliers is a contractual and commercial problem more than a technical one, and it is the part programmes underestimate.

From report to fixed fleet#

The path a vulnerability takes, and where it gets stuck.

  report arrives                     (researcher, supplier, CVE feed,
        │                             internal testing, bug bounty)
        ▼
  triage: are we affected?           ← SBOM makes this minutes, not weeks
        │
        ▼
  assess: exploitable here?          ← reachable? behind the gateway?
        │                              what does exploitation achieve?
        ▼
  fix + verify                       ← including a regression test
        │
        ▼
  safety impact analysis             ← does this touch the safety case?
        │
        ▼
  release + staged rollout           ← R156 evidence produced here
        │
        ▼
  confirm fleet coverage             ← who has not updated, and why?

Coordinated disclosure#

The end-of-support question#

What this means for you#

Your dependencies are a long-term commitment. Adding a library is signing up to track its vulnerabilities for the life of every vehicle it ships in. Prefer fewer, well-maintained dependencies. This is a much stronger argument in automotive than in web development.

Your build must produce an inventory. If your component's dependencies are not in the SBOM, your component is a blind spot during the next incident.

Write down what your component trusts. During assessment, someone will ask whether a vulnerable parser can be reached by untrusted input. A design note answering that saves days.

Report suspicious behaviour. A crash on malformed input, an unexpected network connection, a permission that seems too broad. Engineers noticing things is a real part of the monitoring obligation.

Expect security work to be scheduled, not heroic. Patch cycles, dependency updates and pen-test remediation are now planned work with regulatory deadlines. A team treating them as interruptions will miss them.

What to remember

R155 (cybersecurity) and R156 (software updates) are type-approval requirements — without a certified management system, the vehicle cannot be sold.
A CSMS requires risk assessment, treatment, verification, monitoring, incident response, supplier management, and full lifecycle coverage.
The SBOM is the load-bearing artefact: it turns "are we affected?" from weeks of archaeology into a query.
Supplier binaries dominate a vehicle's software, so supplier SBOMs are essential and are mostly a contractual problem.
The response path stalls at assessment (is it exploitable here?) and at fleet coverage (who still has not updated?).
Coordinated disclosure is now normal, and reports arrive with a clock.
End of support is unresolved — assume it will become a defined obligation and avoid open-ended cloud dependencies.
For you: dependencies are long-term commitments, your build must emit an inventory, document what your component trusts, report anomalies, and expect security work on the schedule.

Next#

Everything assembled — one feature built end to end.