Automotive Cybersecurity Buyer’s Guide
UN Regulation 155 requires every vehicle manufacturer selling into regulated markets to operate a certified cybersecurity management system, a CSMS, audited by a type approval authority before any vehicle type gets approved. For most OEMs and increasingly their suppliers, the practical question is not whether to comply but who helps.
This guide covers what a CSMS actually requires, who audits it, how ISO/SAE 21434 provides the engineering method, and what to verify in a partner before engaging one, with the structured RFP that makes the comparison possible.
What a CSMS is, and what it is not
A cybersecurity management system under UN R155 is the manufacturer’s organizational capability to manage vehicle cybersecurity across the whole lifecycle: risk assessment at development, monitoring in production and operation, and incident response for the fielded fleet, with documented processes for each.
It is not a tool purchase and not a one-time audit pass. The authority audits the system’s existence and operation, and the certificate has a limited validity, which means the CSMS has to keep running after the type approval the way a quality system does.
For suppliers the pressure arrives contractually: OEMs flow CSMS-derived requirements down their chains, so tier suppliers increasingly need credible ISO/SAE 21434 alignment even without holding the certificate themselves.
Who audits, and what that means for choosing help
Type approval authorities audit and certify the CSMS: KBA in Germany, RDW in the Netherlands, VCA in the UK, MLIT in Japan. Each authority works from the same UN regulation but brings its own audit practice and emphasis.
The practical consequence: a partner’s track record should be specific. How many CSMS certifications has the partner supported, with which authorities, and can they describe the audit experience. The RFP asks for authorities experience and the number of type approvals achieved as verification criteria, because a partner who has sat through KBA and VCA audits is worth more than one who has read the regulation.
ISO/SAE 21434 as the engineering method
UN R155 tells you what the management system must achieve. ISO/SAE 21434 is the standard that tells you how to engineer it: cybersecurity activities across the concept, development, production, operation, and decommissioning phases, with threat analysis and risk assessment (TARA) at the center.
Most CSMS implementations are 21434-shaped: the TARA feeds the risk management, the cybersecurity case accumulates the evidence, and the incident response plan for the fleet connects back to monitoring. A partner should be able to explain that chain, not just recite the standards.
The explainer on this site covers 21434 in depth; the buyer’s point is simpler: fluency in 21434 is the table stakes, and the differentiator is documented audit and type approval experience.
What to verify in a partner
Track record: certifications supported, authorities worked with, type approvals achieved. Engineering depth: TARA practitioners, ASPICE-aware process people, and tool competency that matches your environment, CANoe and CANalyzer for bus work, INCA for calibration, hardware-in-the-loop benches for testing.
Scope fit: a CSMS program for a full-vehicle OEM differs from a specific-ECU or specific-function scope, and from a supplier-side 21434 alignment engagement. The RFP captures the scope explicitly, including vehicle programs, target markets, and the regulatory mix (R155, R156 for software updates, FMVSS context for the US market).
Deliverables in phases: the useful proposals break the work into phases with durations and named outputs (TARA report, CSMS documentation, penetration test results, evidence pack), so progress is checkable rather than vibes.
What the structured RFP captures
The automotive RFP asks in comparable form: vehicle programs and target markets, the CSMS scope and maturity target, type approval authorities, TARA methodology, technical scope (buses, external interfaces, operating systems, supply chain), phases with deliverables, and verification criteria including minimum programs supported and tool competency.
Three firms answering that structure produce a comparison you can take to management, which is the difference between buying capability and buying a logo.
Frequently asked questions
What does UN R155 compliance cost?
It scales with scope: full-vehicle CSMS programs are materially larger than single-ECU or supplier-alignment engagements, and the phases (assessment, build, audit support) price separately. The honest route to a comparable number is the RFP with the same scope, authorities, and deliverables quoted by three or more firms.
Does one CSMS certificate cover all our vehicle types?
The CSMS is organizational, so one certified system covers the manufacturer’s vehicle types developed under it. Each vehicle type then still needs its type approval under the system. What the RFP asks (full vehicle, specific ECU, or specific function) is the scope of the system you are building, and that choice drives both cost and audit depth.
Do tier suppliers need their own CSMS?
The regulation binds the manufacturer seeking type approval, but OEMs flow cybersecurity requirements down contractually, and suppliers are expected to work within 21434 processes. Most tier suppliers need 21434 alignment and credible evidence rather than a CSMS certificate of their own, though the line keeps moving.
How long does the path to type approval take?
It depends on the starting point: a manufacturer with existing 21434-shaped engineering closes the CSMS gap in months; one building processes for the first time should expect a phased program across development cycles. Ask partners for phased durations in their proposals, which is what the RFP requires, rather than single-number estimates.
Related
Ready to buy?
Browse verified firms in this specialization or start a structured RFP.
Browse Automotive firms →