logo
stripes
logo
stripes

Supplier & External Interfaces

Under UNECE R155, the manufacturer’s Cybersecurity Management System (CSMS) must cover the entire supply chain. This includes clear allocation of responsibilities, requirements flow-down, evidence exchange, and proportionate assessment of suppliers and external service providers whose products or services affect the vehicle’s cybersecurity posture.

Objectives

  • Define and document responsibilities for cybersecurity activities across parties.
  • Flow down cybersecurity requirements into contracts, specifications, and SOWs.
  • Establish evidence exchange and acceptance criteria for delivered items.
  • Perform risk-based supplier assessments and audits where appropriate.
  • Coordinate monitoring, vulnerability handling, and incident response with suppliers.

Responsibility Split & Governance

  • RACI/Roles: Define who is Responsible, Accountable, Consulted, Informed for each interface.
  • Design authority: Clarify who approves security-relevant design decisions and changes.
  • Escalation: Set up decision forums for risk acceptance, exceptions, and waivers.

Requirements Flow-Down

Contracts and technical specifications should embed cybersecurity requirements derived from risk analysis:

  • Product requirements: secure boot, authenticated updates, secure communications, partitioning, logging.
  • Process requirements: secure development lifecycle, vulnerability management, SBOM and change control.
  • Evidence requirements: test reports, penetration testing summaries, traceability, conformity statements.
  • Acceptance criteria: measurable conditions to approve deliveries (incl. remediation SLAs).

Evidence Exchange & Acceptance

  • Artifact packages: TARA excerpts, requirements coverage, V&V reports, update procedures, SBOMs.
  • Secure channels: controlled portals or encrypted transfer with access control and retention policy.
  • Verification: independent checks, spot testing, and issue tracking linked to deliverables.
  • Versioning: stable IDs for documents, builds, keys/certs, and calibration/config items.

Supplier Assessment & Audits

Apply a risk-based approach to evaluate supplier capability and product risk:

  • Capability assessment: CSMS/SDLC maturity, incident response, competence and training.
  • Product assessment: threat exposure, criticality, interfaces, dependency on backend services.
  • Audit scope: proportional to risk; focus on controls that mitigate top threats.
  • Follow-up: corrective actions with deadlines and re-test/reaudit triggers.

Interface Security & Operations

  • Key & credential management: provisioning, storage, rotation; custody during production and service.
  • Update process coordination: package signing, eligibility, anti-rollback (align with R156/ISO 24089).
  • Monitoring & PSIRT linkage: vuln intake, advisories, incident escalation, shared timelines.
  • Service tool controls: authenticated access, audit logs, tamper-resistance, revocation capability.
  • Third-party cloud/backends: security expectations for interfaces that impact the vehicle.

Open-Source & Third-Party Components

  • Maintain SBOM for software stacks and track vulnerabilities against it.
  • Define patch SLAs and backport strategy for critical components.
  • Require licensing compliance and provenance (supply chain integrity).

Practical Do / Don’t

Do

  • Use standard templates for requirements and evidence requests.
  • Bind security SLAs (e.g., vuln triage/patch timelines) into contracts.
  • Request SBOMs and update them at every release.
  • Run joint incident drills with key suppliers and service partners.
  • Track supplier risks in the same register as internal risks.

Don’t

  • Rely solely on certificates—ask for evidence tied to your threats.
  • Accept deliveries without versioned artifacts and acceptance criteria.
  • Ignore backend/service dependencies that affect in-vehicle risk.
  • Leave key/credential handling ambiguous between parties.

Typical Outputs / Evidence

  • Responsibility matrices (RACI), interface specifications, and security clauses in contracts/SOWs.
  • Supplier assessment/audit records with corrective actions and re-test results.
  • Evidence packages: TARA excerpts, requirements coverage, test reports, SBOMs, update/signing procedures.
  • Operational coordination artifacts: PSIRT contacts, intake policy, incident timelines, advisories.
  • Key/credential custody records; secure provisioning and revocation procedures.
Disclaimer: This page summarizes supplier and external interface expectations under UNECE R155. For authoritative requirements, consult the regulation text and your approval authority’s guidance.