Security Solutions Built for Connected Vehicles

Focuses on cybersecurity for automotive systems, addressing risk management in vehicle software, hardware, and networks.

Core Components:

• Threat and Risk Assessment (TARA) 

• Incident response planning 

• Secure design principles for vehicle systems

Deals with functional safety in electrical and electronic systems in road vehicles, introducing the concept of Automotive Safety Integrity Levels (ASIL) to assess risks. 

Core Components: 

• Hazard analysis and risk assessment (HARA)
• Systematic verification and validation of safety-critical functions

• Safety management across the supply chain

Mandates cybersecurity measures in vehicle design, manufacturing, and maintenance and establishes a baseline for regulatory compliance in global markets.

Core Components: 

• Mandatory certification of Cyber Security Management System (CSMS)
• Continuous threat detection and response mechanisms
• Compliance with threat intelligence frameworks
• Risk-Based Certification 

Focuses on software update management for road vehicles and encompasses secure methods for over-the-air (OTA) updates.

Core Components: 

• Update integrity and authenticity checks
• Compatibility validation to prevent malfunctions post-update
• Continuous monitoring and reporting 

A broad cybersecurity standard for industrial automation, including connected vehicles, that advocates for defense-in-depth strategies.

Core Components: 

• Layered security measures e.g., perimeter defenses, internal segmentation, endpoint protections
• System-level security requirements e.g., role-based access control, monitoring, etc.
• Vendor certification and supply chain security 
• Secure communication protocols 
• Security lifecycle management (includes patch management, vulnerability assessments, and system audits)

A proposed set of rules aimed at safeguarding the connected vehicle supply chain by regulating the software and hardware used in connected vehicles — particularly those originating from China and Russia.

(Proposed) Core Components: 

• A ban on import/sale of Vehicle Connectivity Systems and Automated Driving Systems tied to "adversaries"
• Mandatory submission of annual Declarations of Conformity to the U.S. Department of Commerce
• Mandatory SBOMs for all vehicle software

Proposed deadline: 2027 for software, 2030 for hardware (or 2029 for units without a model year)