Free tool, self-assessment
UN R155 TARA/CSMS readiness calculator
Five questions across the requirement set: CSMS state, the TARA and its attack-vector mapping, fleet monitoring, incident response, and the supply chain. Scored transparently from your own answers.
This is a self-assessment heuristic to focus preparation, not an audit — only an approval authority can certify a CSMS or grant type approval. Runs in your browser, nothing stored.
Where does your organization stand on the Cybersecurity Management System (CSMS)?
Is a Threat Analysis and Risk Assessment (TARA) in place for the vehicle type?
0 of 5 answered. Runs in your browser, nothing stored.
Where the calculator comes from
The questions map to UN R155's structure: the CSMS requirements in Annex 5 (governance, risk assessment and management, monitoring, incident response, dependency management), the vehicle-type capability requirements in the regulation's core text, and the attack vectors listed in Annex 5 Part B. The TARA question references ISO/SAE 21434 clause 15 because that is the standard the regulation's risk assessment work runs through, and the software-update question references UN R156 / ISO 24089 because the required updates ride on that system. The ISO/SAE 21434 explainer and the automotive buyer's guide walk both in depth.
Frequently asked questions
What does UN R155 require?
Two things, in order. First, a certified Cybersecurity Management System (CSMS): the approval authority assesses the manufacturer's organizational processes — governance, risk assessment and management, monitoring, incident response, and dependency management, the Annex 5 requirement set. Second, the vehicle type itself must demonstrate cybersecurity capability: detection, prevention, containment and response to attacks, mitigations for the attack vectors the regulation lists in Annex 5 Part B, secure key storage, and forensics data. Type approval requires a valid CSMS certificate.
Can a Tier 1 supplier be certified under UN R155?
No. The CSMS and vehicle type approval belong to the vehicle manufacturer. What suppliers demonstrate is their part inside a customer's CSMS: documented cybersecurity processes, evidence for the items they supply, and the interfaces the manufacturer's audit will reach. That is why the calculator scores a supplier with real documented processes the same as a manufacturer whose certification audit has not happened yet — both are credible postures at different points in the chain.
What is a TARA, and why do the attack vectors matter?
The Threat Analysis and Risk Assessment is ISO/SAE 21434's risk method — asset identification, threat scenarios, attack paths, feasibility ratings, and risk treatment decisions. UN R155 leans on it: the regulation's Annex 5 Part B lists the attack vectors a vehicle type must address, and the assessment work shows which apply, how they are mitigated, and why any excluded vector does not apply to the vehicle type.
Is this score an audit or a certification?
No. The score is a self-assessment heuristic derived entirely from your own answers — it names which of the requirement set your answers say is missing. Only an approval authority can certify a CSMS or grant UN R155 type approval, and only a technical service's assessment counts toward the vehicle type.
Is anything I enter stored or shared?
No. The calculator runs entirely in your browser, the answers never leave your device, there is no account, no log, and nothing retained.