Submitted by UN TFCSOTA TFCS14 12 Replies by

Submitted by UN TF-CS/OTA TFCS-14 -12 Replies by the Task Force to the comments provided by GRVA members 1

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by Switzerland (TFCS-14 -03) 1) Type approval process not the right approach for addressing Cyber Security „at any time“ => CH in favour of Self-Certification approach Comments by the Task Force: • Inovative approach was taken in the boundaries given by the existing framework. It was decided to work on a draft UN Regulation under the 58 A in order to be directly applied by the signatory Contracting Parties. • The test phase will evaluate the effectiveness and robustness of the approach taken • Task Force noted concerns that the self-certification scheme proposed by Switzerland would not be efficient or effective and be more burdensome The Task Force confirmed the original approach taken. 2

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by Switzerland (TFCS-14 -03) 2) Type approval process would not be flexible enough to address Cyber Security in emerging situations => CH in favour of Self-Certification approach Comments by the Task Force: • Flexibility is given, especially with the S/W update process Regulation • The Software Update Regulation provides controls to ensure safety and quality of updates, no need for a selfceriffication approach • It is unclear how self-certification would work for software updates that would affect existing system approvals The Task Force confirmed the original approach taken 3

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by Switzerland (TFCS-14 -03) 3) Post production phase only addressed in recommendation but not in the regulatory text Comments by the Task Force: • 7. 2. 2. 2. and 7. 2. 2. 3. of the Regulation requires that monitoring and response procedures are implemented => to be checked at the point of approval • Limits of the 58 A prevent requirements for post production being introduced • National/regional legislation covers the issue of post production, e. g. product liability and recall legislation, UNECE may wish to consider extending the convention The Task Force confirmed the original approach taken 4

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by Germany (TFCS-14 -07 rev 1) 1) Risk Assessment Unclear how to conduct the risk assessment and what the critical elements are to be protected Comments by the Task Force: • Critical elements were not identified in the Regulation as this would be dependent on the vehicle design • The critical elements should be identified during the risk assessment • The Interpretation Document/ test phase will help resolving this issue • ISO/SAE 21434 can be used to identify the critical elements The Task Force confirmed the original approach taken 5

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by Germany (TFCS-14 -07 rev 1) 2) Cyber Security Managment System Unclear how to assess it Comments by the Task Force: • The Interpretation Document/ test phase will help resolving this issue • ISO/SAE 21434 can be used to identify the critical elements The Task Force confirmed the original approach taken 6

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by Germany (TFCS-14 -07 rev 1) 3) Software updates Lifetime issue Comments by the Task Force: • Limits of the 58 A prevent requirements for post production being introduced • National/regional legislation covers the issue of post production, e. g. product liability and recall legislation, UNECE may wish to consider extending the convention The Task Force confirmed the original approach taken 7

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by Germany (TFCS-14 -07 rev 1) 4) Standardized gateway Need for implementation of a standardized gateway for communication into the vehicle Comments by the Task Force: • Describes a specific technical solution and is therefore not technology neutral • The approach was extensively discussed with the Task Force on several occasions The Task Force confirmed the original approach taken 8

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by FIA (TFCS-14 -06) 1) Hardware updates Need for software and hardware updates Comments by the Task Force: • Hardware updates had been identified to be outside remit of the Task Force on Cyber Security and Over-the-Air issues The Task Force confirmed the original approach taken 9

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by FIA (TFCS-14 -06) 2) Updates over vehicle lifetime Lifetime issue and transferrance of IP rights to 3 rd parties Comments by the Task Force: • Limits of the 58 A prevent requirements for post production being introduced • National/regional legislation covers the issue of post production, e. g. product liability and recall legislation, UNECE may wish to consider extending the convention • The Task Force noted the legal difficulties in mandating the transferrance of intellectual properties to 3 rd parties The Task Force confirmed the original approach taken 10

Submitted by UN TF-CS/OTA TFCS-14 -12 Comments provided by FIA (TFCS-14 -06) 3) Reference model („Standardized Gateway“) Need for implementation of a standardized gateway for communication into the vehicle Comments by the Task Force: • Describes a specific technical solution and is therefore not technology neutral • The approach was extensively discussed with the Task Force on several occasions The Task Force confirmed the original approach taken 11