Knowledge Center
Analysis written by the engineers who run type-approval assessments and vehicle penetration tests. Regulation explained without the marketing gloss, and method described precisely enough to apply.
The standard is often summarised as “do a TARA”. It is considerably more than that — a lifecycle obligation that reaches from concept through decommissioning, and touches every supplier interface along the way.
The library
Filter by format or topic. Everything here is written for practitioners — no gated summaries of the standard text.
Showing 10 resources
The standard is often summarised as “do a TARA”. It is considerably more than that — a lifecycle obligation that reaches from concept through decommissioning, and touches every supplier interface along the way.
R155 governs cybersecurity, R156 governs software updates. They are routinely conflated, and the conflation produces management systems that satisfy neither.
A practitioner whitepaper on running Threat Analysis and Risk Assessment so the result survives independent review — including the four failure modes we see most often.
Secure boot, HSM-backed key hierarchies and SecOC are individually well documented. Getting them to work together, inside an automotive timing budget, is where teams struggle.
India’s automotive cybersecurity standard follows the structure established by UNECE R155. Global platform teams should understand where it aligns and where local process obligations differ.
The Indian counterpart to UNECE R156. If your update process cannot say what software is on a given vehicle, this is the requirement that will expose it.
Electrification extends the vehicle attack surface past the vehicle. Charging communication is a genuine trust boundary, and it is now inside regulatory scope.
A recorded practitioner session on turning ad-hoc security testing into a repeatable validation programme with evidence a type-approval assessor will accept.
Patterns from offensive engagements against vehicle systems. The findings are rarely exotic — they are the same handful of implementation gaps, repeated across programmes.
A representative account of how a CSMS readiness engagement runs — the sequence, the artefacts produced and where the effort actually concentrates.
Everything in the Knowledge Center comes out of the same work that shapes our programs — type-approval assessments, secure development and offensive testing on real vehicles.