Insights · Technical briefs
Practical writing from Agnile on automotive cybersecurity, ISO/SAE 21434, UNECE R155/R156, functional safety, AUTOSAR, embedded software, avionics, and verification.
A 12-step NIS2UmsuCG checklist for German automotive suppliers — scope, BSI registration, §30 measures, §32 reporting, management duties — with the legal hook and evidence for each, plus what ISO 27001 and a CSMS cover.
What German and EU OEMs commonly request from suppliers under ISO/SAE 21434 Clause 7 and UNECE R155 — TARA extracts, CAL, pentest reports, SBOM, end of support, TISAX — and what to deliver for each.
What ISO/SAE 21434 is, who it applies to, Clauses 5–15 in one table, what assessors read first, and the common misreadings — certification, R155, R156 and AIS 189.
What an ISO/SAE 21434 engagement delivers, the eight drivers behind the quote, typical durations from gap analysis to assessment readiness, what a quote should itemise, and red flags.
How KBA and its technical services assess UNECE R155 and R156: CSMS and SUMS certificates, vehicle-type evidence, what KBA says about testing, how Tier-1 evidence flows in, and an OEM checklist.
TISAX for automotive suppliers: ENX and the VDA ISA, assessment levels AL1–AL3, every current label and its level, validity and ISA2027, the process, and how it differs from ISO/IEC 27001 and ISO/SAE 21434.
R155 reaches two- and three-wheelers in the EU from 11 December 2027. What changes for L-category OEMs and exporters, where these platforms differ from cars, and a back-planned roadmap to the first submission.
The seven drivers behind every automotive pentest quote, typical durations from component to vehicle level, what a fixed-price quote should itemise, and the levers that cut cost without cutting evidence.
How penetration testing fits an AIS 189 submission: what the CMVR test agencies look for, how the evidence mirrors UNECE R155, what Indian Tier-1s owe global OEM customers, and how to write one report for both.
A practical checklist mapping the seven Annex 5 threat categories to penetration-test cases, evidence artefacts and ISO/SAE 21434 clauses — so the test report reads as type-approval evidence.
CSMS stands for Cybersecurity Management System — the organizational capability UNECE R155 requires before any Vehicle Type Approval. What auditors examine, how long the certificate lasts, and how it maps to ISO/SAE 21434 Work Products.
Where System Integration Testing sits in the automotive V-model — the MIL/SIL/PIL/HIL fidelity ladder, integration strategies, entry and exit criteria, and how ISO 26262 and ISO/SAE 21434 shape the work.
Germany’s NIS2 law puts automotive suppliers under BSI supervision — who must register, the lapsed deadlines, §30 and §32 duties, and how much of an ISO/SAE 21434 CSMS can be reused.
Type-approved vehicles are exempt from the EU Cyber Resilience Act — a precise read of Article 2(2)(c), the six automotive product groups still in scope, and why the same component can be exempt in one sales channel and regulated in another.
ISO/SAE 8475 turns the CAL concept from ISO/SAE 21434 Annex E into a prescriptive scheme — three assurance levels plus Targeted Attack Feasibility as a design target, and how CAL assignment flows from TARA outputs.
ISO/SAE 21434 entered systematic review in 2026, and in October 2026 ISO registered the second-edition project (ISO/SAE AWI 21434). What is known about scope and timing — and why your CSMS cannot wait.
A practical 12–18 month UNECE R155 compliance roadmap for vehicle programmes — CSMS audit, Annex 5 threats, Type Approval, and post-2024 enforcement reality.
A practical model for the 3-year TCO of manual versus automated TARA, payback-period sensitivity by program count, and where automation actually changes programme economics.
An architect-grade penetration testing methodology for ECUs, gateways, and V2X — scope pyramid, tool categories, and the test patterns that catch real vulnerabilities.
How to size, integrate, and verify a Hardware Security Module for automotive ECUs — EVITA Light/Medium/Full, host-HSM interaction, and rollout patterns.
Designing a verifiable chain of trust from BootROM through bootloader to application — signature schemes, rollback protection, and recovery patterns.
Secure Onboard Communication in AUTOSAR Classic — frame format, freshness counters, MAC truncation tradeoffs, and integration patterns at bus level.
Architecture and integration patterns for the AUTOSAR Crypto Stack — Csm, CryIf, Crypto Driver, and KeyM — with the job-API call sequence and pitfalls to avoid.
How to draft and negotiate a Cybersecurity Interface Agreement under ISO/SAE 21434 Clause 7 — RASIC matrix, clause checklist, and the patterns that hold up under audit.
Cybersecurity patterns for MCAL and Complex Device Driver development — the ISR security checklist, requirements by driver layer, and the integration tradeoffs.
ISO/SAE 21434 defines work products across the cybersecurity engineering lifecycle (Clauses 5–15). The complete checklist with review priorities and UNECE R155 mapping.
ISO 26262:2018 is the 12-part automotive functional safety standard. Complete breakdown of HARA, ASIL derivation, decomposition, and the FuSa + Cyber convergence.
Engineering standard vs regulation — understanding how ISO/SAE 21434 and UNECE R155 work together for Automotive Cybersecurity compliance.
India’s AIS 189/190 regulations, Bengaluru’s emerging cybersecurity hub, and the opportunity for Indian automotive companies.
Understanding Automotive Safety Integrity Levels — how ASIL is determined and what each level means for development.
Choosing between AUTOSAR Classic (OSEK-based, static) and Adaptive (POSIX-based, dynamic) for your next ECU project.
The systematic Cybersecurity analysis methodology defined in ISO/SAE 21434 Clause 15 — from Threat Identification to Risk Treatment.
Adapting Microsoft’s STRIDE framework for vehicle architectures — ECUs, CAN buses, V2X interfaces, and data flows.
Why spreadsheet TARA struggles to scale, and how structured TARA tooling keeps Risk Scoring consistent and Work Products traceable.
A strategic partnership to advance Cybersecurity research for the mobility sector.
Explore next
Beyond the articles — the compliance hubs, the ISO/SAE 21434 references, and the penetration testing services that put this into practice.
ISO/SAE 21434
Agnile supports safety, security, and mission critical engineering programmes across automotive, aerospace, embedded, IoT, enterprise software, cybersecurity, safety, V&V, and digital engineering.