Procedures in relation to type approval, etc. concerning update of vehicle systems by wireless communication technology.

Table on CS threats prepared by Japan with extended CIA approach including mitigations from OICA, UK DfT principles and ITS-AD Guidelines.

Discussion of structure for regulating vehicle-level software safety through a resolution on known threats and mitigations and compliance and testing provisions under one or more regulations.

Input for the annex on the “List of threats and corresponding principles and mitigations”.

Comments on the consolidated draft text after ahRCSP2 session.

Japan proposes the modification of the relevant parts (especially chapter 6.,7. and 9.) in the regulation annexes of the draft UN Regulations on cybersecurity and software updates to describe that both AA and TS can carry out the testing.

Questions concerning cyber security amendments for approvals of STU submitted by the expert from Japan that address timing of working document submission to GRVA, whether Part II components may include certificated base vehicle equipment under UN R155 multi-stage categorization, whether STU definition includes ECUs within base vehicle E/E architecture, examination of use cases and implementation challenges, consistency of applicant terminology between Section 3.3.1 and Section 7.6, whether approval authorities for Parts I, II, and III must be identical, clarification of end of support period requirements in para. 2.7(b), installation agreement requirements in para. 5.1.2.1(d), and whether total Cyber Security Risk Assessment Process for whole vehicle with other equipment than ESAs is necessary after ESA installation under para. 7.4.10.

Proposal to amend para. 7.2.1.2.2. to delete, in cases where RXSWINs are not held on the vehicle, the requirement that the manufacturer shall declare the software version(s) of the vehicle or single ECUs with the connection to the relevant type approvals to the Approval Authority and that this declaration shall be updated each time the declared software version(s) is updated, and add that the link between the software version(s) and the RXSWINs shall be declared.

Japan submitted comments on RXSWIN assignment at the 38th CS/OTA IWG. Q.1 asks whether, when a type approval is extended from UN R156-00 to UN R156-01, RXSWIN may be assigned at extension time, and if a UN Regulation refers to RE.3 Annex 7 through a supplementary amendment after UN R156-01 transitional provisions become applicable, whether RXSWIN is assigned at that time. Q.2 asks whether Approval Authorities other than the Authority granting approval are expected to have access to the OEM’s Auditable Register, as access information appears provided only to the Approval Authority concerned through paragraph 9.5.2. Q.3 asks whether software updates affecting type approval can be performed under Regulations that do not reference RE.3 Annex 7.

Comments concerning the implementation of the following paragraph:
7.3.7. The vehicle manufacturer shall implement measures for the vehicle type to:

1. detect and prevent cyber-attacks against vehicles of the vehicle type;
2. support the monitoring capability of the vehicle manufacturer with regards to detecting threats, vulnerabilities and cyber-attacks relevant to the vehicle type;
3. provide data forensic capability to enable analysis of attempted or successful cyberattacks.

Japan input for Annex 1 “List of threats and corresponding principles and mitigations” of the proposed paper on cybersecurity recommendations.