Home/Resources/Regulation Library/R-155
ECE R-155
Cyber Security and Cyber Security Management System
Uniform provisions for the approval of vehicles with regard to cyber security and their cyber security management system (CSMS).
Applies to
M, N, O
Topic
Cyber & software
Framework
UN ECE · EU
Velocert services
Series · Individual
Overview
UN Regulation No. 155 sets requirements for how vehicle manufacturers manage cyber security risk across the whole vehicle lifecycle, from development through production and post-production.
Approval has two parts: a Cyber Security Management System (CSMS) certificate for the manufacturer's organisation and processes, and a vehicle type approval demonstrating that the CSMS has been applied to the specific vehicle type.
Scope
The regulation applies to the following vehicle categories:
M
Passenger vehicles
N
Goods vehicles
O
Trailers and semi-trailers
Key requirements
Cyber Security Management System
Processes to identify, assess, mitigate and monitor cyber risk across development, production and post-production.
Risk assessment
Identification of vehicle type specific threats and vulnerabilities, with risks assessed against the threats listed in Annex 5.
Mitigation
Appropriate measures implemented to protect the vehicle type against identified risks, verified by testing.
Monitoring and response
Capability to detect and respond to cyber attacks and threats affecting vehicles in the field, with periodic reporting.
Timeline
June 2020
Regulation adopted by UNECE WP.29
July 2022
Mandatory in the EU for new vehicle types
July 2024
Mandatory in the EU for all new vehicles
Approval with Velocert
As an STB appointed technical service (E37), Velocert assesses R-155 within series modification and individual approval projects, coordinating evidence from the manufacturer and its suppliers.
This page is a summary for orientation only. Always refer to the official UNECE text and its amendments for legal requirements.