Documented Automotive Cybersecurity Consultancies
UN R155 made cybersecurity a condition of vehicle type approval across major markets. No CSMS certificate, no new vehicle type, and the certificate is only as strong as the management system behind it, which is why auditors ask for TARA evidence at program level, not slideware.
The consultancies below are verified on what gets programs through audit: type-approval authority track records (KBA, RDW, VCA, MLIT), ISO/SAE 21434 TARA methodology, ASPICE-aligned process evidence, and penetration testing that covers the interfaces assessors actually probe, telematics, V2X, OTA paths, diagnostics.
What renders on this page
- ▸Firm matrix filtered by type-approval authority experience, KBA (Germany), RDW (Netherlands), VCA (UK), MLIT (Japan)
- ▸Service-type filters, CSMS design, TARA production, UN R156 SUMS, vehicle penetration testing, security architecture
- ▸Buyer-type fit, OEM programs, Tier 1 supplier obligations, EV startup timelines
- ▸Certification verification, ISO/SAE 21434 Lead Assessors, TARA practitioners, ASPICE, TÜV-certified auditors
- ▸"Request Secure RFP" form pre-wired to the UN R155 RFP template
What UN R155 actually demands
A Cybersecurity Management System certified by an approval authority, plus evidence that it operated across the vehicle lifecycle. R156 adds the software-update half: a Software Update Management System with rollback and integrity guarantees. Firms here have taken programs through both.
TARA at program level
A TARA that lists threats without tracing attack paths to your actual architecture (domain controllers, gateways, zonal ECUs, CAN-FD and automotive Ethernet buses) fails audit. Verified firms produce Annex E-aligned analyses with risk acceptance criteria your program board can actually sign.
Supplier obligations cascade
OEM CSMS requirements cascade to Tier 1s and Tier 2s as contract terms. The directory flags firms that work supplier-side: gap remediation, evidence packages, and audit-day support without blowing the program budget.
How we vet automotive firms
Authority experience is documented per authority, not as a general claim. TARA methodology is checked against ISO/SAE 21434 Clause 15 and Annex E. Penetration testing case studies record the interfaces tested (V2X, telematics, OTA, OBD-II) and the R155/R156 evidence they produced.
Frequently asked questions
What is a CSMS audit, and why does my program need one?
UN R155 requires an OEM to hold a CSMS certificate of compliance from a type-approval authority before new vehicle types can be approved. The audit examines governance, risk management, testing, monitoring, and incident response across the lifecycle. Verified firms prepare the system and stand with you on audit day.
Which approval authority should we use?
It depends on your target markets. KBA (Germany) and RDW (Netherlands) are common for European programs, VCA for UK, MLIT for Japan. The directory filters firms by documented authority experience so you match the audit you will actually sit through.
Do EV startups need full CSMS, or can we phase it?
Type approval does not phase in for new market entrants, but a scoped CSMS build-out over two quarters is realistic with the right firm. Directory records show EV startup programs going from zero to audit-ready with fixed-fee engagements.
What does ISO/SAE 21434 TARA work cost?
Program-scoped TARAs for a single vehicle program typically run mid five figures USD at verified-firm rates ($300–$400+/hour senior staff). The RFP template captures program facts (vehicle type, automation level, external interfaces) so firms quote against real scope.