Automotive cybersecurity covers intelligent connected vehicles and their components, in-vehicle software and vehicle-cloud services. Centred on ISO/SAE 21434 (road vehicles — cybersecurity engineering) and UN R155 (vehicle cybersecurity type approval), we help companies establish, verify and demonstrate vehicle cybersecurity capability, supporting the OEM and regulatory demand for supply-chain security evidence.

Why Automotive Cybersecurity

UN R155 links the cybersecurity management system (CSMS) to vehicle type approval: new vehicle models exported to the EU may only be placed on the market after obtaining cybersecurity type approval. ISO/SAE 21434 embeds cybersecurity requirements across the full lifecycle from concept, development and production through operation to decommissioning. OEMs commonly cascade these requirements to Tier 1 suppliers and software vendors, so supply-chain companies must provide auditable cybersecurity evidence.

Service Scope

• CSMS cybersecurity management system development and audit preparation
• Security assessment of components such as ECUs, T-Boxes, gateways and domain controllers
• Security testing of connected-vehicle apps, mini programs and TSP cloud platforms
• Security analysis of in-vehicle buses and communication links (CAN, automotive Ethernet, Bluetooth, Wi-Fi)
• Verification of OTA update mechanisms and intrusion detection capabilities

Service Process

1. Gap analysis — map the company’s existing processes and product evidence against ISO/SAE 21434 and UN R155, and produce a gap list and implementation roadmap.

2. Risk assessment — carry out threat analysis and risk assessment (TARA) on the target system to identify critical assets and attack scenarios.

3. Testing and verification — conduct security testing on components, communication links and companion cloud services to verify the effectiveness of protective measures.

4. Remediation support — support risk treatment, process additions and evidence remediation.

5. Audit support — compile technical documentation and test evidence to support certification body audits and type approval applications.

Deliverables

• Gap analysis report — item-by-item comparison between the current state and the standard’s requirements, with implementation advice
• Risk assessment record — TARA report and analysis of critical attack scenarios
• Security test report — vulnerability list, risk ratings, reproduction steps and remediation advice
• Certification support documents — technical evidence package supporting CSMS audits and type approval applications

Why Choose Star River Quality

• Accredited qualifications — CMA and CNAS accredited, with a traceable testing process and results
• Standards coverage — covers ISO/SAE 21434, UN R155 and the related regulations, with defensible test methods
• One-stop coordination — can be combined with penetration testing and EN 18031 services to cover both in-vehicle and external attack surfaces
• Full-lifecycle support — follow-up from system development and product testing through to certification application

If your vehicle programme or automotive components need cybersecurity assessment, system audit preparation or type approval support, contact us for a service plan and recommendations.