General Considerations about CSMS
The Cybersecurity Management System (CSMS) means “a systematic risk-based approach defining organizational processes, responsibilities and governance to treat risk associated with cyber threats to vehicles and protect them from cyber-attacks” (from UN Regulation 155).
Concretely, CSMS is a set of policies, processes and procedures demonstrating that a company covers all the most relevant cybersecurity implications across the organization and the product lifecycle.
The CSMS can be either:
1. Integrated inside an existing Company Management System (e.g., ISO 9001 certified Quality Management System, ISO 2700x certified Information Security Management System) or
2. Established as a separate Management System
If case 1 applies, existing evidence of compliance (i.e., certification) to these standard supports the compliance to R155 Regulation.
If case 2 applies, more details and evidence shall be provided to witness the compliance.
The common structure for a CSMS
Drivesec has supported a wide range of OEMs and Tier 1s in obtaining certification for the CSMS. Through this experience, Drivesec was able to define a common structure for an ISO/SAE 21434-compliant CSMS, characterised by 3 levels of granularity and 6 streams, as follows:
Thanks to the support experience collected this year by our experts in guiding OEMs and Tier 1s until the achievement of the vehicle type approval, the CSMS Document Framework can also respond to requests made by approval authorities and their technical services.
Reusability and Tailoring of CSMS documentation
Drivesec has prepared also a kit of documents, partially pre-filled and customizable, to develop the CSMS, as follow.
