A cybersecurity management system, or CSMS, is the set of processes, responsibilities and governance a vehicle manufacturer uses to manage cyber risk across the life of its vehicles. It is not a tool you buy. UN R155 expects one to exist, to work, and to be certified as part of vehicle type approval.
Definition and scope
UL describes a CSMS as a systematic, risk based approach that defines processes, responsibilities and governance for treating cyber threats. It coordinates work at the corporate, business and project levels, with detail that depends on the risk involved. It covers development, production and post production until the vehicle series reaches the end of its service life.
Core elements
UL lists these as the core: cybersecurity culture, organizational structure, documented development processes, monitoring of process and product security, the necessary infrastructure, and the required skills.
What this looks like as evidence
These are practical suggestions based on those elements, not an audit checklist from the regulation.
| Element | Evidence worth preparing |
|---|---|
| Culture and governance | A security policy, named roles, management review records |
| Organization | Who owns risk decisions for each vehicle program |
| Development process | Documented steps for threat analysis, design, testing and release |
| Monitoring | How you learn about new vulnerabilities and who acts on them |
| Infrastructure | Tooling for tracking components, issues and fixes |
| Skills | Training records and role descriptions |
The standard behind it
UL says ISO/SAE 21434, published in 2021, identifies the engineering requirements for a CSMS. Synopsys describes a cybersecurity plan as the starting point, with defined assurance levels, goals and measurable metrics, plus continuous monitoring and top down investment.
Certification and approval
UL states that a manufacturer must have a CSMS and that it requires certification, and that this is a key factor in vehicle type approval. For R156 the regulation also requires an audited update management system. The details of how a certificate is issued differ by approval authority, so ask yours.
Mistakes to avoid
- Writing process documents that nobody follows. An auditor can sample real projects and compare them with the paper.
- Treating suppliers as someone else's problem. Suppliers fall under the obligations as well, so keep contracts and records.
- Skipping the post production phase. Monitoring and response continue until the end of service life, so staff and budget must too.
- No link between vulnerability news and risk records. Show that a new report leads to a decision.
A small supplier does not need a huge program on day one. Write the policy, name an owner, run a threat analysis on your highest risk product, set up component tracking and define how you respond to a vulnerability report. Then record each of those as it happens. Real records from a small process beat a large unused manual.
Quick check
Can software alone give us a CSMS?
No. Tools help with tracking and monitoring, but the CSMS is the organization's processes and governance.
Sources
Last reviewed: 19 October 2026.
