How does UN R155 work?

What UN R155 actually requires

un r155 is not a one-time certification exercise. It requires a manufacturer to run a cybersecurity management system that covers the vehicle lifecycle, from design and development through production, operations, and post-production support. The regulation is about proving that cybersecurity is governed as an ongoing process, not treated as a single technical feature.

That means the core question is less “is the vehicle secure today?” and more “can the organisation continuously identify, assess, respond to, and evidence cyber risk across its products and supply chain?” The answer depends on process discipline, traceability, and the ability to show that controls are maintained as the vehicle and its environment change.

For a practical overview of how this maps to automotive security, the Automotive Cybersecurity Guide is the most directly relevant starting point.

How the cybersecurity management system is used in practice

In practice, UN R155 works by making cybersecurity part of the manufacturer’s management system and type-approval evidence. Teams need defined ownership, repeatable processes, and a way to connect engineering decisions to cyber risk decisions. The regulation expects security to be embedded in product governance, supplier management, monitoring, and incident handling rather than handled ad hoc by individual engineers.

That is why documentation matters so much. Authorities are not only looking for technical safeguards, but also for evidence that the organisation can identify relevant threats, assess their impact, assign responsibility, and act on findings over time. Vulnerability intake, escalation paths, software update handling, and supplier obligations all become part of the compliance story.

The system also has to work across organisational boundaries. Vehicle programmes often depend on tiers of suppliers, shared components, connected services, and update channels, so the management system has to account for inherited risk as well as internally controlled risk. If the governance model does not reach the supply chain, it will usually fail the intent of the regulation even if individual controls look strong on paper.

What regulators and assessors expect you to evidence

Assessors generally want to see that cybersecurity is maintained throughout the lifecycle and not only at launch. They will look for a coherent process for threat assessment, control selection, change management, incident response, and vulnerability remediation. They will also expect evidence that the organisation reviews security-relevant changes and keeps the cybersecurity case current as products, software, suppliers, and attack surfaces evolve.

Evidence quality is often the deciding factor. A process that exists only in policy language is weak; a process supported by traceable records, review artefacts, and operational ownership is much stronger. In other words, the organisation has to show that cybersecurity decisions are repeatable, reviewable, and linked to actual product behaviour.

That is also where lifecycle scope matters. Post-production support is not optional housekeeping, because connected vehicles continue to receive updates, new dependencies, and new exposure after release. UN R155 therefore rewards organisations that can demonstrate sustained operational control, not just a successful development review.

Risk and Threat Considerations

UN R155 is designed around the fact that vehicle cyber risk does not stop at design approval. If suppliers, software updates, incident response, or vulnerability handling are weak, the manufacturer can lose visibility into exposures that only appear after production, when remediation is more difficult and the blast radius is larger.

Failure mechanism: Weak governance, incomplete supplier oversight, or poor vulnerability handling can leave critical attack paths untracked, unmitigated, or unrecoverable across the vehicle lifecycle.

Impact: The result can be unsafe cyber exposure in production vehicles, failed type-approval readiness, delayed remediation, and loss of confidence in the manufacturer’s ability to maintain security over time.

Practitioner Guidance

What to prioritise: Treat the cybersecurity management system as an operating model, not a document set. The highest-value work is usually the join between engineering, supplier management, vulnerability handling, and incident response, because that is where control gaps tend to appear.

What to verify: Make sure you can trace each major cyber risk to an owner, a control decision, and an evidence record. If a control exists but no one can show how it is maintained after release, it is not yet mature enough for R155 scrutiny.

Common mistake: Teams often over-focus on design-time technical security and under-invest in post-production governance. That is a problem because UN R155 is fundamentally about sustained management of cyber risk across the full lifecycle, not just secure engineering at launch.

Practitioner takeaway: If you cannot demonstrate continuous control over suppliers, vulnerabilities, and post-production changes, you do not really have an R155-compliant cybersecurity management system, only a partial security programme.

Related resources from NHI Mgmt Group

• UN R155
• What is an SVID and how does it work?
• How does OAuth 2.0 work for NHIs and what are its limitations?
• What is identity spoofing in Agentic AI and how does it work?