GB/T 44495 & GB/T 44496 – Overview
GB/T 44495 and GB/T 44496 provide national guidance in China for road-vehicle cybersecurity and software update practices. They are broadly aligned with international expectations set by ISO/SAE 21434 and UNECE R155/R156, while reflecting local regulatory context and market needs. This page gives a non-normative, high-level introduction suitable for awareness and planning.
Purpose
- Promote a systematic approach to vehicle cybersecurity across the lifecycle.
- Ensure secure software updates with authenticity, integrity, and traceability.
- Support market access and regulatory conformity within China’s ecosystem.
Key Concepts
- Organizational capability: governance, roles, competence, processes, and records.
- Risk management: asset/threat analysis, feasibility/impact assessment, treatments.
- Secure updates: signing, eligibility, anti-rollback, post-update validation, records.
- Supply chain coverage: requirements flow-down, evidence exchange, assessments.
- Traceability: end-to-end links from risks/changes to verification and in-field results.
Relationship to Global Standards
Many organizations implement GB/T expectations by adapting their existing ISO/SAE 21434 (engineering) and UNECE R155/R156 (regulatory) practices, adding China-specific governance, documentation, and localization where needed.
What Authorities & Partners Typically Expect
- Documented processes and roles; competence and training evidence.
- Risk management artifacts (TARA-style) and security requirements/verification.
- Secure update process (package signing, eligibility, anti-rollback, validation).
- Supplier integration: clauses, assessments, SBOMs, exchanged evidence.
- Records & traceability aligned to local compliance and retention rules.