ISO 15765-2 is the transport layer part of the CAN protocol used for diagnostic communication between vehicle ECUs. It defines segmentation, reassembly and flow control for messages that exceed a single CAN frame, allowing larger diagnostic payloads to pass across the in-vehicle network.
What ISO 15765-2 Does in the CAN Diagnostics Stack
ISO 15765-2 is not the whole diagnostic protocol, it is the transport layer that makes larger diagnostic exchanges possible over CAN. Its job is to split bigger payloads into frames, move them across the in-vehicle network, and reassemble them at the destination ECU.
That matters because many vehicle diagnostics, firmware interactions, and maintenance functions need more data than one CAN frame can carry. The standard adds structure and pacing so diagnostic traffic can traverse a constrained bus without collapsing into message loss or uncontrolled congestion.
Why Segmentation and Flow Control Matter
CAN is efficient but capacity limited, so transport-layer handling is essential when diagnostic messages exceed a single frame. ISO 15765-2 defines how a sender begins a multi-frame transfer, how the receiver signals readiness, and how flow control keeps message exchange orderly.
This makes the standard especially important in environments where multiple ECUs share the same network and timing is tightly constrained. Without segmentation and flow control, a large diagnostic request could be truncated, misinterpreted, or interfere with normal vehicle communication.
How ISO 15765-2 Supports Vehicle Diagnostics
In practice, ISO 15765-2 sits underneath higher-level diagnostic applications, providing the transport behaviour those applications depend on. It is designed to be transparent to the diagnostic payload while still enforcing the mechanics needed for delivery across CAN.
That separation of concerns is useful in automotive systems because it lets diagnostic tools focus on what they need to ask or retrieve, while the transport layer handles the mechanics of moving the data reliably. The result is a more predictable diagnostic channel across ECUs with different roles and capacities.
Where ISO 15765-2 Fits in the In-Vehicle Network
ISO 15765-2 is best understood as part of the communications foundation for in-vehicle service operations. It bridges the gap between compact CAN frames and the larger data exchanges required for troubleshooting, calibration, and other ECU interactions.
Because it operates at the transport layer, its design choices affect interoperability, timing behaviour, and how diagnostic tools behave across different vehicle platforms. A correct implementation preserves the expected diagnostic conversation; a weak one can make the same network look unreliable even when the underlying CAN bus is functioning normally.
Risk and Threat Considerations
Diagnostic transport on CAN is security-sensitive because it can carry commands or data that affect ECU behaviour, not just read-only status information. If segmentation, pacing, or receiver handling is weak, an attacker or faulty tool can abuse the diagnostic path to overload the bus, disrupt legitimate service operations, or increase the chance of malformed-message handling.
Failure mechanism: An adversary or misconfigured device can exploit the trust placed in diagnostic traffic, especially where larger multi-frame exchanges are accepted without strong authentication, message validation, or strict network isolation.
Impact: The result can be diagnostic denial of service, unreliable ECU communication, or a broader pathway for unauthorized vehicle function manipulation if higher-layer controls are absent.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | Vehicle diagnostics may traverse external service access paths that require strong peer authentication. |
| SC-7 — Boundary Protection | ISO 15765-2 operates across a network boundary where diagnostic traffic must be constrained and segmented. | |
| Recommendation — Require strong authentication for external diagnostic channels and verify every non-organizational endpoint. Segment diagnostic access and enforce boundary filtering around vehicle network interfaces. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | The standard depends on controlled network behaviour, segmentation, and managed communication paths. |
| Recommendation — Inventory and manage vehicle network paths so diagnostic transport remains controlled and observable. | ||
| MITRE ATT&CK | T0866 — Remote Services: Vehicle Diagnostic Interface | Diagnostic transport on CAN is a common access path that attackers may abuse through vehicle service interfaces. |
| Recommendation — Monitor and restrict diagnostic interface use to reduce abuse of vehicle service access paths. | ||
Practitioner Guidance
Why practitioners should care: ISO 15765-2 is often treated as a purely transport concern, but its behaviour shapes how diagnostic trust is established and how much abuse the in-vehicle network can absorb. If diagnostic tooling is exposed through service ports, telematics paths, or maintenance interfaces, the transport layer becomes part of the attack surface.
What to watch for: Review how multi-frame diagnostic sessions are authorised, rate-limited, segmented, and monitored, especially where external tools or remote service channels can reach the vehicle network. Validate that the implementation handles abnormal frame sequences and does not grant undue trust to any source that can speak the diagnostic transport format.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org