Cybersecurity in Vehicles UNECE/R155-ESTP

The cybersecurity solution for vehicles allows you to know if a vehicle is cyber-secure: it protects the data and lives of the people on board.

Certify the cybersecurity of your vehicles: protect the data and lives of those on board

 Since July 2024, the European cybersecurity regulation for vehicles UNECE/R155 obliges manufacturers to sell and manufacture vehicles that comply with the cybersecurity requirements required by the standard, to minimize the possibility that they could be cyberattacked with the aim of stealing it, spying on the driver or taking control of it remotely to cause an accident.

How do we verify the cybersecurity of a vehicle?

AENOR's "Cybersecurity in Vehicles-UNECE/R155-ESTP" certification demonstrates that the vehicle minimises the risk of suffering a cyberattack that affects the privacy and lives of its occupants, as well as the integrity of the vehicle's systems, in accordance with the requirements of UNECE/R155.

With the aim of demonstrating the level of compliance with this regulation, AENOR and EUROCYBCAR have jointly developed the certification scheme "Cybersecurity in Vehicles-UNECE/R155-ESTP". Within this new certification process, ESTP Technology plays a prominent role: an innovative modular platform, created by EUROCYBCAR – an international benchmark in the field of Cybersecurity applied to Automotive/Mobility – which carries out a standardised, objective and automated process of analysis and evaluation of the level of cybersecurity of vehicles – in which three types of tests are carried out: remote access, physical access and applications-, applying the ESTP Methodology -EUROCYBCAR's own and with a patent in the US since November 2019- and according to the requirements established by the UNECE/R155 and ISO 21434 standards.

Thanks to the Cyber Safe Vehicle Certificate, the buyer and/or user of a vehicle will be able to know, firstly, the degree of compliance of said vehicle with respect to the European cybersecurity regulations for vehicles - UNECE/R155 - and, in addition, will be able to compare the level of cybersecurity with other vehicles and, therefore, make purchase and/or use decisions based on criteria such as road safety protection. the control of access to private data or the susceptibility to theft.

Cybersecurity in Vehicles UNECE/R155-ESTP

Once the Audit process has been passed, the organization obtains:

  • The AENOR Certificate for "Cybersecurity in vehicles-UNECE/R155-ESTP"

  • Licence to use the AENOR Mark of "Cybersecurity in Vehicles-UNECE/R155-ESTP"

Benefits/Advantages

Key benefits for vehicle manufacturers and companies and institutions with vehicle fleets:

  • Strategic:

  • Having cyber-secure vehicles in accordance with internationally recognised regulations represents a guarantee of trust for consumers and users.

  • To offer the plus of cybersecurity in a market that needs to have differentiating elements.

  • Operations:

  • It allows you to anticipate the exploitation of risks and vulnerabilities in vehicles by third parties that would put the data and lives of the people on board at risk.

  • Economic:

  • It helps to avoid or reduce the costs associated with the paralysis of the vehicle fleet after a cyberattack.

  • It helps to avoid or reduce the costs derived from possible complaints from users or buyers affected by a cyberattack on vehicles.

  • It facilitates the reduction of revenue losses caused by the mistrust of consumers and users after having suffered a cyberattack.

Industries, Expertise and Certification Benefits

Sectors

  • Vehicle manufacturers: -cars, trucks, buses, vans, motorhomes, motorcycles, scooters, electric bicycles, skateboards.

  • Vehicle bodybuilders and transformers

  • Companies with vehicle fleets

  • Intermodal logistics and urban distribution companies

  • Dangerous and high-value goods transport companies

  • Public institutions with vehicle fleets

  • Ride-hailing companies

Integration

In addition to the ISO 21434, as it is a certification based on ISO 21424, information security systems can be integrated ISO 27001 and it can be used as a Reference Certificate during the approval process of the "Cybersecurity in UNECE/R155-ESTP vehicles".

In addition, this Certification is related in different aspects to certifications and regulations that affect the Automotive and Transport and Logistics sectors, such as ISO 39001 -Road Safety-, ISO 22320 -Emergency Management-, the ISO 28000 -Security Management for the supply chain- or the AENOR N mark for motorcyclist protection systems, for example.

Documentation

General Regulations BOE: UNECE/R155

 Experience

As a result of the collaboration between EUROCYBCAR and AENOR, in April 2022, a Spanish motorcycle was the first vehicle in the world to obtain the certificate of 'Cybersecurity in Vehicles-UNECE/R155-ESTP’. It was won by an electric motorcycle: the NUUK CargoPro, positioning the Basque Country and Spain as international benchmarks in the field of cybersecurity applied to Mobility.

Following this international milestone, EUROCYBCAR promoted the modification of the UNECE/R155 standard which, in principle, excluded motorcycles and, in September 2024, UNECE announced the decision to incorporate motorcycles, scooters and electric bicycles that exceed 25 km/h into the UNECE/R155 standard, as it has been demonstrated that they have the same level of connectivity as the rest of the vehicles that, From the beginning, they had been included in said regulations.