This document discusses how a Cyber Security Management System (CSMS) and Software Update Management System (SUMS) fit together for vehicle certification. A CSMS follows ISO/SAE 21434 and ensures cybersecurity is managed across a carmaker's lifecycle, while a SUMS follows ISO AWI 24089 and manages over-the-air software updates. Both the CSMS and SUMS must be certified by a third party and their certificates are valid for 3 years. Vehicle type approval requires presenting valid CSMS and SUMS certificates as well as system validation reports, with the third party certifying compliance with regulations like UNECE R155.

1. 3rd
party
assessment
checks for
compliance with
UNECE R155
CSMS and SUMS – How do the Pieces fit together?
CSMS
SUMS
System approvals
Carmaker presents
valid CSMS/SUMS
certificates plus all
system validation
reports.
Release candidate
3rd
party certifies all
relevant systems,
eg. UNECE R157.
Result is a system
validation report.
Vehicle type approval
Based on all system
approvals
OTA keep the connected
car secure at any time.
Ready for RevenueAuthorities
ISO / SAE 21434
will serve as basis
of a Cyber Security
Management
System (CSMS)
ISO AWI 24089
may serve as basis of a
Software Update
Management System
(SUMS)
Per carmaker
Covering all orga-
nizational lifecycle
phases including
Decommission
Per carmaker
Covering all Over-
The-Air aspects
and RXSWIN
processes
SUMS
certificate
valid for 3
years
UNECE regulations
enforce CSMS and
SUMS
CSMS
certificate
valid for 3
years
3rd
party
assessment
checks for
compliance with
UNECE R156
Carmaker applies
CSMS & SUMS
to each vehicle
development project.
E...
1
$
$
$
E...
1
E...
1
E...
1
E...
1
E...
1
E...
1
E...
1
E...
1
Carmaker’s CSMS and SUMS are to be certified. Vehicles type certification checks for both
general CSMS/SUMS compliance and vehicle-specific validation report prior to permit.
E...
1