Presentation from Japan outlining a structure for the further development of provisions for ensuring adequate vehicle protection against unauthorized access to software and data systems.

Japanese revisions to the draft ToR.

Summary of discussions, including related to the International Whole Vehicle Type Approval, on issues raised by the prospects for automated vehicle software updates under the type approval system.

Procedures in relation to type approval, etc. concerning update of vehicle systems by wireless communication technology.

Table on CS threats prepared by Japan with extended CIA approach including mitigations from OICA, UK DfT principles and ITS-AD Guidelines.

Japan input for Annex 1 “List of threats and corresponding principles and mitigations” of the proposed paper on cybersecurity recommendations.

Discussion of structure for regulating vehicle-level software safety through a resolution on known threats and mitigations and compliance and testing provisions under one or more regulations.

Input for the annex on the “List of threats and corresponding principles and mitigations”.

Comments on the consolidated draft text after ahRCSP2 session.

Japan proposes the modification of the relevant parts (especially chapter 6.,7. and 9.) in the regulation annexes of the draft UN Regulations on cybersecurity and software updates to describe that both AA and TS can carry out the testing.

Text submitted by the expert from Japan proposing an amendment to document GRVA-05-05 from TF CS/OTA

Proposal to delete limitations regarding the choice of cryptographic modules.

Proposal agreed by interested Contracting Parties to resolve concerns regarding “peer review” of cybersecurity type approvals.

Comments concerning the implementation of the following paragraph:
7.3.7. The vehicle manufacturer shall implement measures for the vehicle type to:

1. detect and prevent cyber-attacks against vehicles of the vehicle type;
2. support the monitoring capability of the vehicle manufacturer with regards to detecting threats, vulnerabilities and cyber-attacks relevant to the vehicle type;
3. provide data forensic capability to enable analysis of attempted or successful cyberattacks.

Alternative proposal to clarify the text with regard to transitional provisions and extension of approvals in response to document GRVA-10-12.

Questions concerning cyber security amendments for approvals of STU submitted by the expert from Japan that address timing of working document submission to GRVA, whether Part II components may include certificated base vehicle equipment under UN R155 multi-stage categorization, whether STU definition includes ECUs within base vehicle E/E architecture, examination of use cases and implementation challenges, consistency of applicant terminology between Section 3.3.1 and Section 7.6, whether approval authorities for Parts I, II, and III must be identical, clarification of end of support period requirements in para. 2.7(b), installation agreement requirements in para. 5.1.2.1(d), and whether total Cyber Security Risk Assessment Process for whole vehicle with other equipment than ESAs is necessary after ESA installation under para. 7.4.10.