Requirements for TDs UNECE Taskforce Cyber Security and

Requirements for TD’s UN/ECE Taskforce Cyber Security and Software Updates TF-CS/OTA-16 -xxx_requirements_TS RDW

Items � Competence & Qualifications � Dilemma of requirements intention is to discuss 2

Technical services: Two main domains are applicable for Technical Services 1. [Competence]Qualification requirements for Technical Service. Requirements based on best practices/ known standards, split into: o Organization (ISMS in place, track-record) à 27001/ 9001/ 17020/17021/17025 o Process à 27001/ 170 xx o People (qualification, ISO 21434, experience, expertise, CS-regulation) à CV’s, reference projects o Technology (encryption, secure storage, etc. ) 2. [Scope]UNECE Regulation and Interpretation Document should be clear and concrete: o To use for audit/ testing by Technical Service o To use by OEMS to define how to implement and comply o To be used by accreditation bodies to Automotive experience seems important to keep focus on the vehicle 3

Technical services: Competence under 1 could be different on the various applicable levels, being: - - CSMS level o Audit on organization, process, documentation (ISO 27001/21434) Vehicle type level o Evaluation TARA (ISO 21434) o Evaluation of mitigations o Architecture review o Test integration Component level (not in scope of regulation) o Validate component suppliers (tier-1 and tier-2) o CC method could be used o Selection of a EAL that fits the maturity of the market o 17025 for organization and scope 4

Technical services can be designated by authorities based on: - Certifications/ qualifications (eg ISO 9001 & 27001 &/ 17025) Validate projects (first intensive, after that spot checks) Validate people (CV’s, experience, 21434) Quality check on reports 5

Dilemma of requirements in CS-regulation � Methods are not prescribed � Criteria are not defined à Different results by Technical Services One important requirement to add to the regulation could be: � A risks level that is not allowed and needs to be mitigated � i. o. w, could a cyber security goal be a minimum requirement? 6

Next steps � Small working group to prepare an additional paragraph for requirements on TS-s � Determine participants in this group › RDW › CITA ? � Proposal will be shared with the Chair before the end of November 7