UN R155

What is UN R155?

UN R155 is the regulation of the UNECE World Forum for Harmonization of Vehicle Regulations (WP.29) that makes cybersecurity a condition for vehicle type approval. It has two parts. The manufacturer needs a Certificate of Compliance for its Cybersecurity Management System (paragraph 7.2), which shows that the organisation has processes to manage cybersecurity over the vehicle lifecycle. And each vehicle type needs an approval (paragraph 7.3), which shows that the manufacturer has identified the risks for that type, implemented proportionate mitigations, tested them and set up detection and response for the field.

The regulation came into force in January 2021 under the UNECE 1958 Agreement. Contracting parties include the EU member states, the UK, Japan and South Korea. The USA, Canada and China are not contracting parties and have their own approaches.

Where is it defined?

The text is published by UNECE and, for the EU, in the Official Journal (OJ L 82 of 9 March 2021). Regulation (EU) 2019/2144, the General Safety Regulation, makes it mandatory for EU type approval. The important paragraphs: 7.2 for the CSMS requirements, 7.3 for the vehicle type, 7.4 for the reporting duties of the manufacturer towards the approval authority (at least once a year on monitoring results), and Annex 5 with Part A (a list of threats and vulnerabilities), Part B (mitigations inside the vehicle) and Part C (mitigations outside the vehicle, such as back-end servers). Annex 5 is the checklist authorities use to see whether the TARA has considered everything the regulation expects.

What it means in practice

For OEMs, R155 means that cybersecurity documentation is part of the homologation file and that a technical service will read it. For suppliers it means the OEM asks for evidence that it can hand on: a TARA that covers the Annex 5 threats relevant to the component, cybersecurity requirements and their verification, penetration test and fuzzing reports, and a commitment to field monitoring.

In the complete-vehicle penetration test we did for an OEM, the test plan was derived directly from the vehicle TARA and Annex 5: external interfaces (cellular, Wi-Fi, Bluetooth, charging), diagnostic access over OBD and DoIP, in-vehicle networks and gateway filtering, and the back end. That is what paragraph 7.3.6 means by “appropriate and sufficient testing”: you test the mitigations the TARA claims, with evidence per claim.

Common misunderstandings

UN R155 is not a product standard with a security level you can “pass”. It is a process and evidence regulation; the actual security measures are what the manufacturer’s own risk analysis says they should be. It does not certify suppliers and it does not certify ECUs, only the manufacturer’s CSMS and the vehicle type. And it does not end at start of production: the monitoring, detection and reporting duties of paragraphs 7.2.2.2 (g) and 7.4 run as long as the vehicle type is supported.