Germany’s type-approval authority (KBA) input on monitoring and assessing changes to vehicle software applications that impact criteria used in the type approval of vehicles and component systems. The presentation discusses the possibilities for type approval of software applications and for the use of periodic technical inspections to detect significant anomalies.

RAMA is a graphical representation to model vehicular information and communication technology of (connected) vehicles. It models the integration of vehicles in their environment as well as the whole vehicular life cycle from the beginning of the development till scrapping. RAMA is an adaptation of the Reference Architectural Model Industrie 4.0 (RAMI 4.0) of the VDI, VDE and ZVEI for the automotive domain ¹.

This document is based upon a CS/OTA task force document (TFCS-03-04) and is also available with tracked changes against this original task force draft in pdf format and docx format.

Proposal from Germany to introduce additional definitions, clarify the management system certification process, enable the withdrawal (revocation) of a vehicle type approval, to require the vehicle manufacturer to maintain an Information Security Operations Centre (ISOC) to handle servicing of its vehicle fleet, and to improve the processes for identification of risks and threats and their mitigation.

The proposal replaces the protection of critical elements with the protection of the vehicle type in general to ensure that a critical element can be secured by security mechanisms in other elements of the vehicle type. This clarifies that secure gateways can be used to shield parts of an E/E architecture which contain critical elements. Further, the proposal introduces a transitional period for the obligation to implement the mitigation measures of Annex 5, Part B and C. During this transitional period, the manufacturer can introduce alternative appropriate mitigation measures on the basis of technical feasibility.

Proposal agreed by interested Contracting Parties to resolve concerns regarding “peer review” of cybersecurity type approvals.

Proposal to prohibit the issuance of certificates by any entity other than the authority that granted the approval under UN R155.

Proposal to amend UN R155 and UN R156 to require that Certificates of Compliance for Cyber Security Management Systems and Software Update Management Systems be issued by the same approval authority that grants type approval. Germany reported a case where different authorities issued the certificate and type approval, creating assessment and enforcement issues. The proposal aims to ensure holistic cyber security evaluation and align both regulations.

Proposal to amend UN R155 and UN R156 regarding approval authority requirements:

• Add a refusal ground to para. 5.1.3. of UN R155 where the Certificate of Compliance for the Cyber Security Management System has not been issued by the same approval authority granting type approval
• Insert new para. 5.4. into UN R156 to provide that approval authorities shall not grant any type approval if the Certificate of Compliance for the Software Update Management System has not been issued by the same approval authority granting type approval.

The document requests guidance on the legal basis for provisions within UN Regulations extending beyond the End-of-Production date and which authority such provisions address. Examples include UN R171 requirements for manufacturers to demonstrate safety management systems to the Type Approval Authority every three years and report annually on Driven Coded Auxiliary System operation until production is discontinued, and UN R155 requirements for Cyber Security Management Systems to apply to the post-production phase when vehicles remain operational but are no longer produced. The document poses an additional question regarding vehicle safety when manufacturers cease operations and cannot fulfill post-deployment safety provisions.

Proposal to amend UN R155 by inserting new para. 5.1.3.(e) establishing that the Certificate of Compliance for the Cyber Security Management System shall not be issued by a different Approval Authority than the one granting type approval, and amend UN R156 by inserting new para. 5.4. establishing that Approval Authorities shall not grant type approval if the Certificate of Compliance for the Software Update Management System has not been issued by the same Approval Authority granting type approval. Justification includes ensuring holistic cybersecurity assessment, clarifying reporting obligations under para. 7.2.2.2.(g), addressing unharmonized mutual recognition of management system certificates, maintaining consistency between regulations, and upholding the fundamental principle that approval authorities retain responsibility for all aspects of type approval.