[PPWR becomes enforceable in

13

:

23

:

46

:

3231302928

days.

Get ready with Certivo's PPWR Starter Package.](/content/ppwr-ready-package/index.html)

UN R155/R156 Vehicle Cybersecurity Compliance

Cybersecurity & Digital

UNECE Regulations on Vehicle Cybersecurity Management Systems (CSMS) and Software Update Management Systems (SUMS)

69 Attack Vectors. Multi-Tier Supply Chains. One CSMS to Prove It All. Is Your Cybersecurity Evidence Audit-Ready?

UN R155/R156 compliance requires organizational-level cybersecurity management and secure software update processes across your entire vehicle supply chain—with CSMS certification valid for only three years. Annex 5 defines 69 attack vectors that must be addressed in every threat analysis. Type approval in 60+ countries depends on dual CSMS and SUMS certification. Scope expansion to motorcycles takes effect December 2027.

Certivo automates supplier cybersecurity evidence collection from declaration through type approval documentation.

69

Attack vectors defined in Annex 5 requiring risk assessment

60+

Countries where UN R155/R156 compliance is mandatory for type approval

3 years

CSMS/SUMS certificate validity before mandatory recertification

RegulationOverview

Jurisdiction

54+ UNECE contracting parties (EU, UK, Japan, South Korea, Australia); parallel frameworks in China (GB 44495:2024) and emerging national regulations globally

Regulatory Body

United Nations Economic Commission for Europe (UNECE) — World Forum for Harmonization of Vehicle Regulations (WP.29)

Regulation Number

UN Regulation No. 155 (Cybersecurity/CSMS) and UN Regulation No. 156 (Software Updates/SUMS)

Effective Date

January 22, 2021 (entry into force); July 2022 (mandatory for new vehicle types in EU); July 2024 (mandatory for all new vehicles in EU)

Official Source

https://unece.org/transport/vehicle-regulations

Key Threshold

Dual certification required — CSMS Certificate of Compliance (R155) + SUMS Certificate of Compliance (R156) — for vehicle type approval

WhatIsUNR155/R156?

UN R155/R156 compliance is the first globally binding vehicle cybersecurity regulation and the cornerstone of automotive cybersecurity compliance. For supply chain teams, the primary obligation is managing cybersecurity evidence across multi-tier suppliers—demonstrating that organizational processes, vehicle architectures, and software update mechanisms are secure throughout the entire vehicle lifecycle.

UN R155 requires a certified Cybersecurity Management System (CSMS) covering development, production, and post-production phases. UN R156 requires a complementary Software Update Management System (SUMS) ensuring OTA and workshop updates are delivered securely and traceably. Together, they are prerequisites for vehicle type approval in 60+ countries. CSMS certification must be renewed every three years, and approval authorities can withdraw certificates if post-production monitoring or incident reporting is insufficient.

UN R155/R156 compliance requires documented cybersecurity evidence—threat analyses, risk assessments, mitigation plans, penetration test results, and supplier compliance attestations—from every tier. When scope expands or new threat vectors emerge, your entire supplier portfolio requires reassessment.

Key Components / Sub-Frameworks

Obligation

Mandatory CSMS Certificate of Compliance; valid for 3 years; prerequisite for type approval

CSMS (R155)

Cybersecurity Management System — organizational processes for risk management

Obligation

Mandatory SUMS Certificate of Compliance; required alongside CSMS for type approval

SUMS (R156)

Software Update Management System — secure update delivery and tracking

Obligation

Must be addressed in manufacturer's Threat Analysis and Risk Assessment (TARA)

Annex 5

69 attack vectors across 7 high-level threat categories

Obligation

Supporting framework for CSMS implementation; referenced in WP.29 interpretation documents

ISO/SAE 21434

Road Vehicles — Cybersecurity Engineering standard

Obligation

Supporting framework for SUMS implementation under R156

ISO 24089

Road Vehicles — Software Update Engineering standard

Obligation

Unique identifier tracking software versions affecting type approval parameters

RXSWIN

Regulation Software Identification Number

UNR155ScopeExpandstoAllCategoryLVehiclesinDecember2027—AndChina'sGB44495BecameMandatoryforNewVehicleTypesinJanuary2026.IsYourSupplyChainEvidenceCurrent?

The scope of UN R155/R156 compliance now extends to motorcycles, scooters, and electric bicycles. New vehicle type approvals for Category L require full CSMS evidence from December 2027; existing types must comply by June 2029. China's parallel GB 44495:2024 standard adds technical verification requirements beyond UN R155. OEMs selling into both UNECE and Chinese markets face dual-track compliance obligations. Supplier cybersecurity evidence from prior audit cycles may no longer reflect current threat landscapes or regulatory requirements.

KeyComplianceRequirements

Who Must Comply

• Vehicle manufacturers (OEMs) seeking type approval in any UNECE contracting party

• Tier 1 suppliers providing ECUs, software modules, and connected components

• Tier 2 and Tier 3 suppliers contributing cybersecurity-relevant hardware or software

• Manufacturers of passenger cars (M), commercial vehicles (N), and trailers with ECUs (O)

• Motorcycle, scooter, and quadricycle OEMs (from December 2027 for new types)

• Non-UNECE manufacturers exporting to EU, UK, Japan, South Korea, or Australia

Key Thresholds

CSMS Certification

Mandatory prerequisite before any vehicle type approval application

SUMS Certification

Mandatory alongside CSMS; no type approval without both certificates

3-Year Recertification

CSMS and SUMS certificates expire and must be renewed every 3 years

69 Attack Vectors

All Annex 5 threat categories must be assessed in manufacturer's TARA

CoreObligations

1

CSMS Certification (R155)

Demonstrate organizational cybersecurity processes, risk management, incident response, and supply chain governance to an Approval Authority

DEADLINE

Before type approval application

2

SUMS Certification (R156)

Demonstrate secure software update processes, OTA integrity, version tracking, and campaign management

DEADLINE

Before type approval application

3

Vehicle Type Approval

Submit cybersecurity case with E/E architecture description, TARA, mitigations, and testing evidence

DEADLINE

Before any vehicle sale in UNECE markets

4

Supplier Evidence Collection

Collect and validate cybersecurity compliance documentation from all contributing tiers

DEADLINE

Ongoing; required for CSMS audit evidence

5

Post-Production Monitoring

Continuous threat monitoring, vulnerability management, and incident detection across the vehicle fleet

DEADLINE

Throughout vehicle service life (12–25 years)

UNR155/R156-SpecificPainPoints

The Multi-Tier Evidence Scramble

UN R155/R156 compliance demands cybersecurity evidence from every supplier contributing cybersecurity-relevant components. Your Tier 1 sends a security concept document in one format. Your Tier 2 provides a penetration test report in another. Your Tier 3 doesn't understand the request. Without multi-tier supply chain transparency, CSMS auditors find a folder of disconnected PDFs instead of a traceable evidence chain. Your team spends months chasing responses that arrive incomplete, inconsistent, or in the wrong language.

The 3-Year Recertification Clock

Your CSMS certificate expires in six months. Since the last audit, you've onboarded 40 new suppliers, introduced three new ECU platforms, and updated your OTA infrastructure. Every change requires updated documentation—TARA revisions, test results, supplier assessments. Your compliance team is rebuilding the evidence package from scratch because nothing was centralized. Without continuous compliance monitoring and audit readiness, recertification becomes a recurring crisis.

The 69 Attack Vector Coverage Gap

Annex 5 defines 69 attack vectors across seven threat categories—from back-end servers to physical vehicle access. Your TARA must address each relevant vector with specific mitigations mapped to supplier evidence. But your BOM contains 150+ ECUs from 60 suppliers. Without BOM-level compliance intelligence linking components to threat vectors and supplier documentation, you cannot demonstrate complete coverage. A single unmapped vector can delay type approval.

The Supplier Cascade Problem

While OEMs bear type approval responsibility, automotive supply chain security depends entirely on supplier cooperation. A Tier 2 ECU manufacturer claims cybersecurity compliance but provides no supporting documentation. A Tier 1 integrator passes through declarations without validation. A software supplier's vulnerability disclosure process is undocumented. Without supplier risk scoring and due diligence, evidence gaps persist through audit—and become the OEM's liability when the approval authority reviews the CSMS package.

Certivo In Action

CertivoinAction—UNR155/R156Workflow

GET EVIDENCE IN

Collect Cybersecurity Declarations from Every Supplier Tier—Without the Chasing

CORA launches targeted campaigns to collect cybersecurity compliance evidence from multi-tier automotive suppliers, follows up automatically, and accepts responses in any format through automated supplier data collection and portals.

• Launch cybersecurity evidence campaigns to hundreds of suppliers with one click

• CORA-powered outreach in suppliers' native languages

• Accept any format: security concepts, TARA reports, pen test results, ISO/SAE 21434 work products, self-assessments

• Track response rates and escalate non-responders automatically

MAKE SENSE OF IT

Know Instantly Which Suppliers Have Gaps in Cybersecurity Evidence

CORA extracts cybersecurity compliance data from every supplier document, validates against UN R155/R156 requirements and Annex 5 threat categories, and flags evidence gaps automatically through AI document parsing and certificate validation.

• CORA parses security concept documents, TARA reports, and test evidence in any format

• Automatic validation against all 69 Annex 5 attack vectors

• Real-time alerts when supplier certificates expire or evidence gaps emerge

• Supplier risk scoring based on evidence completeness and documentation quality

⚠️

PROVE COMPLIANCE OUT

Generate CSMS Audit Packages in Hours, Not Months

Compile complete type approval documentation instantly from validated supplier evidence with full traceability and audit-ready formatting.

• One-click CSMS audit evidence packages with complete supplier chain traceability

• Pre-structured documentation aligned with Technical Service audit requirements

• Annex 5 coverage reports mapping threat vectors to mitigations and supplier evidence

• Complete audit trail for every validation, supplier response, and evidence update

OneSupplierSubmission.ValidationAgainstAll69AttackVectors.Audit-ReadyinHours.

Certivo reads supplier cybersecurity documents, extracts compliance evidence through AI-native compliance automation, validates against UN R155/R156 requirements and Annex 5 categories, and generates audit-ready documentation automatically. When CSMS recertification approaches or scope changes occur, Certivo reassesses your supplier evidence portfolio and alerts you—before auditors ask.

AI Document Parsing

Supplier Risk Scoring

Annex 5 Mapping

CSMS Audit Packages

Certificate Expiration Alerts

See How to Automate Compliance

FeaturesTabs

Evidence Collection

Cybersecurity Evidence Extraction

Regulatory Monitoring

Audit Documentation

BOM-Level Mapping

Evidence Collection

Certivo's automated campaigns achieve 95% response rates vs. 20–30% with manual outreach.

• Targeted campaigns by supplier tier, component type, or cybersecurity relevance category

• Multi-language outreach in suppliers' native languages

• Intelligent follow-up sequences adapting to supplier behavior

• Format-agnostic: security concepts, TARA documents, pen test reports, ISO/SAE 21434 work products, freeform responses

95%

Supplier Response Rate

Cybersecurity Evidence Extraction

Every supplier declaration parsed to control-level detail automatically—no manual data entry.

• Deep extraction of cybersecurity controls, vulnerability assessments, test results, and compliance attestations

• Parses ISO/SAE 21434 work products, OEM-proprietary templates, and self-assessments

• Multi-language document processing

• Anomaly detection for inconsistent or incomplete cybersecurity declarations

99.2%

Extraction Accuracy

Regulatory Monitoring

Always validated against current UN R155/R156 requirements—not your last audit cycle.

• Automatic sync with UNECE WP.29 regulatory updates and scope expansions

• Certificate expiration tracking with proactive recertification alerts

• Proactive alerts when scope changes or parallel regulations affect your portfolio

• Historical tracking of supplier cybersecurity compliance status changes

Real-Time

Regulatory Intelligence Sync

Audit Documentation

Generate CSMS evidence packages in hours instead of 4–6 months of manual compilation.

• One-click CSMS audit packages with full supplier evidence traceability

• Annex 5 coverage reports mapping threat vectors to mitigations and evidence

• Supplier evidence chain with complete traceability

• Response tracking for recertification deadline management

4 hours

To Audit-Ready Package

BOM-Level Mapping

Map every ECU and connected component to cybersecurity requirements and supplier evidence.

• BOM-level compliance intelligence mapping components to Annex 5 threat vectors

• Component-level supplier evidence association and gap identification

• Complex vehicle architecture hierarchy support for multi-tier products

• Digital passport and traceability systems linking ECUs to cybersecurity documentation

RelatedRegulations

EU Cyber Resilience Act (CRA)

CRA covers connected product cybersecurity broadly; overlaps with vehicle backend and IoT components

Combined Value

Single evidence collection satisfies both vehicle and product cybersecurity frameworks

ISO/SAE 21434

Industry standard supporting CSMS implementation under R155

Combined Value

Certivo validates supplier evidence against both regulation and standard requirements

ISO 24089

Industry standard supporting SUMS implementation under R156

Combined Value

Unified software update evidence collection and validation

China GB 44495:2024

Parallel Chinese vehicle cybersecurity standard with additional technical verification requirements

Combined Value

Multi-framework validation from one supplier submission

EU General Safety Regulation (GSR)

GSR mandates R155/R156 compliance for EU type approval

Combined Value

Integrated documentation covering GSR and UN R155/R156 requirements

EU RoHS

Material compliance for electronic components in vehicles; overlapping supply chain documentation

Combined Value

Single declaration collection satisfies both cybersecurity and material compliance frameworks

Managing UN R155/R156 compliance alongside related regulations eliminates duplicate supplier requests. Certivo validates one submission against multiple frameworks.

IndustriesMostImpacted

Automotive Manufacturing

Your Pain Point

Multi-tier CSMS evidence; OEM-to-supplier flowdown; 12–25 year lifecycle obligations

Electronics Manufacturing

Your Pain Point

ECU and connected component cybersecurity evidence; complex BOMs with hundreds of cybersecurity-relevant parts

Semiconductor & High-Tech

Your Pain Point

Chipset and SoC security evidence; hardware root-of-trust documentation; IP concerns alongside compliance

Industrial Machinery & Heavy Equipment

Your Pain Point

Connected off-highway vehicles and machinery under expanding scope; legacy ECU architectures

Aerospace & Defense

Your Pain Point

Stringent cybersecurity documentation; prime contractor flowdown to multi-tier suppliers

Energy & Infrastructure

Your Pain Point

EV charging infrastructure cybersecurity; vehicle-to-grid communication interfaces

ReturnonInvestment

80%

Reduction in Compliance Labor

From Manual Evidence Compilation to Exception Management

CORA extracts cybersecurity evidence automatically. Your team focuses on exceptions that need human judgment—not manual document chasing across supplier tiers.

4 Hours

To Audit-Ready Package

CSMS Documentation Acceleration

Generate complete, audit-ready CSMS evidence packages in hours—not the 4–6 months of manual compilation typical for type approval cycles.

Real-Time

Regulatory Monitoring

Proactive UN R155/R156 Compliance Tracking

When supplier certificates expire, scope expands, or parallel regulations emerge, Certivo reassesses your evidence portfolio instantly. Know which gaps exist before auditors ask.

Key Statistics

69

Annex 5 attack vectors tracked with automated evidence mapping

99.2%

Cybersecurity evidence extraction accuracy from supplier declarations

95%

Supplier response rate with CORA-powered campaigns

FrequentlyAskedQuestions

What vehicles and companies are subject to UN R155/R156 compliance obligations?

Any vehicle manufacturer seeking type approval in UNECE contracting parties must hold valid CSMS and SUMS certificates. This applies to passenger cars (M), commercial vehicles (N), trailers with ECUs (O), and—from December 2027—motorcycles and all Category L vehicles. While type approval responsibility sits with OEMs, the regulation cascades to Tier 1, Tier 2, and Tier 3 suppliers who must provide cybersecurity evidence. Certivo's automated campaigns ensure multi-tier evidence is collected, validated, and audit-ready regardless of supply chain depth.

What happens if an OEM fails to meet UN R155/R156 requirements?

Without valid CSMS and SUMS certification, a vehicle manufacturer cannot obtain type approval—meaning the vehicle cannot legally be sold in any contracting party including the EU, UK, Japan, and South Korea. Several OEMs have already discontinued specific models due to UN R155/R156 compliance challenges. Approval authorities can withdraw existing type approvals if post-production monitoring or recertification obligations are not met. CORA's continuous compliance monitoring ensures evidence stays current between audit cycles.

How does Certivo manage supplier cybersecurity evidence across multiple tiers?

CORA launches targeted cybersecurity evidence campaigns to suppliers across all tiers, following up automatically in suppliers' native languages. Certivo accepts any format—security concept documents, TARA reports, penetration test results, ISO/SAE 21434 work products, and freeform declarations. AI document parsing and certificate validation extracts structured data, maps it to Annex 5 requirements, and flags gaps automatically. Supplier risk scoring and due diligence give your team instant visibility into evidence quality across your automotive supply chain.

Does Certivo support UN R155/R156 alongside China's GB 44495 and other parallel frameworks?

Yes. Certivo validates supplier cybersecurity evidence against UN R155/R156, China's GB 44495:2024, the EU Cyber Resilience Act, and related frameworks simultaneously through regulatory intelligence and horizon scanning. A single supplier submission is validated across multiple regulatory requirements—eliminating duplicate evidence collection campaigns and supporting dual-track compliance for UNECE and Chinese market access.

How does Certivo handle CSMS recertification and ongoing compliance obligations?

Certivo maintains continuous tracking of CSMS and SUMS certificate validity, supplier evidence freshness, and regulatory scope changes. When recertification is due, CORA automatically identifies outdated supplier evidence, triggers targeted re-collection campaigns, and generates updated audit packages. The platform tracks post-production monitoring obligations and annual reporting requirements—transforming the three-year recertification cycle from a crisis event into a managed process through a centralized compliance data backbone.

Ready to Automate UN R155/R156 Compliance?

See how Certivo's automotive cybersecurity compliance software transforms CSMS evidence management from reactive audit scrambles to proactive confidence.

Book a Demo

Talk to an Expert