EV Charging Cybersecurity: UN R155, ISO 21434, and Where the Rules Split at the Plug

Key takeaways

• UN R155 governs the vehicle, not the charger. It requires a certified Cybersecurity Management System (CSMS) and vehicle type approval with respect to cybersecurity. In the EU it applies to new vehicle types from July 2022 and all new vehicles from July 2024.
• ISO/SAE 21434 is the engineering standard the work runs on. R155 says what must be certified; 21434, "Road vehicles, Cybersecurity engineering," is how the industry builds the CSMS, the TARA, and the evidence. Charging-side component makers increasingly follow it too.
• UN R156 rides along. Charging behavior ships in software, and software updates require a Software Update Management System (SUMS) under R156.
• The charger itself is a connected product, not a vehicle. It is not covered by R155. In the EU, the Cyber Resilience Act brings cybersecurity obligations to connected products with digital elements, a category that reaches charging hardware.
• The interesting attacks live at the boundary. The vehicle-to-charger communication defined by ISO 15118, including certificate-based Plug and Charge, is a classic TARA surface: identity, payment data, and firmware update paths, crossing from your car into someone else's cabinet.

Which rule applies to which side of the plug

The confusion in most "which standard applies" questions is that people are asking about two different products. The split is clean once you see the boundary:

• The vehicle OEM answers to the approval authority. UN R155 type approval requires a CSMS certificate first, then a vehicle type assessment against the regulation's requirements, including the attack vectors its Annex 5 Part B lists. UN R156 adds the software-update regime. The charging interface is in scope of the vehicle's cybersecurity case, because a compromised charging session is a compromised vehicle system.
• The charge point manufacturer and operator answer to product security regimes instead. The station is a connected device handling payment, identity, and remote management. In the EU the Cyber Resilience Act's obligations for products with digital elements apply, with its timeline phasing in after the regulation entered into force in December 2024. Industry practice leans on the Open Charge Point Protocol (OCPP) with its published security extensions for the operator-to-station link, and on IEC 61851 as the base charging standard.

The vehicle side: R155, R156, and the 21434 backbone

R155's structure is two gates. First, the manufacturer's Cybersecurity Management System is assessed and certified by the approval authority, the organizational capability to manage cybersecurity across the vehicle lifecycle: governance, TARA, monitoring, incident response, and dependency management. Second, the vehicle type itself must demonstrate detection, prevention, containment, and response capability against the regulation's listed attack vectors, with mitigations documented and keys stored securely.

The engineering work behind both gates is ISO/SAE 21434: asset identification, threat analysis and risk assessment per clause 15, risk treatment decisions, and validation evidence. Our ISO 21434 explainer covers the standard in depth, and the UN R155 readiness calculator turns the requirement set into a scored self-assessment.

The charger side: a connected product

A charge point is a small industrial computer in a cabinet: payment terminal, network uplink, remote management, and a high-power relay. Its security practice borrows from industrial automation as much as automotive: zone-and-conduit style segmentation between the charging controller and the payment path, protected management channels, and signed firmware. The OCPP security profiles for the station-to-central-system link are published industry practice, and the EU's product-security regime raises the floor over time.

The honest statement about the charger side is that it is younger than the vehicle side: the regimes are newer, the audit structures are thinner, and a charger OEM adopting 21434-style engineering today is ahead of the minimum most places require. Buyers specifying charging infrastructure should treat security documentation, signed updates, and management-channel protections as procurement requirements, not features.

Where the two meet: ISO 15118

ISO 15118, "Road vehicles, Vehicle-to-grid communication interface," defines how the vehicle and the charger talk, including the certificate-based Plug and Charge flow that lets the car authenticate and pay without a card. That makes it the most interesting TARA territory in the stack: a protocol crossing trust boundaries between two products owned by different companies, carrying identity and payment, and designed to run for a decade in the field.

For the vehicle's type approval case, charging-session attacks are among the scenarios the TARA must reason about. For the charger OEM, the same interface is the attack surface their product faces from every vehicle that plugs in, trusted or not. Both sides end up modeling the same session, from opposite ends.