Securing automotive software: Automation, safety and security

You are reading part 2 of our series of articles on quality assurance for automotive software

• Part 1 – Quality assurance for automotive software: From testing to ASPICE 4.0
• Part 2 – Securing automotive software: Automation, safety, and security

Requirements for automotive software are growing on multiple levels simultaneously. Shorter development cycles demand more efficient testing processes. At the same time, regulatory requirements for functional safety and cybersecurity are tightening. Since July 2024, UN Regulations R155 and R156 apply to all new vehicles in the EU. These automotive software requirements can only be managed with an integrated approach combining automation and systematic validation.

Functional safety for automotive software

Safety-critical systems such as brakes, steering, and driver assistance are subject to ISO 26262. The standard defines Automotive Safety Integrity Levels (ASIL A to D) based on severity, probability of occurrence, and controllability of hazards. The higher the ASIL, the stricter the requirements for development and verification of automotive software.

The process begins with a comprehensive risk analysis (HARA). This leads to safety requirements that must be verified through specific verification and validation tests. The third edition of ISO 26262 is expected in 2027 and will include updates for AI-based systems.

Cybersecurity: Mandatory since July 2024

With UN Regulations R155 and R156, binding cybersecurity requirements have applied since July 2024 to all new vehicles in UNECE member states. The core requirements for automotive software include:

• UN R155: Proof of a certified Cybersecurity Management System (CSMS) with risk management throughout the entire vehicle lifecycle. The regulation defines 69 attack vectors.
• UN R156: Establishment of a Software Update Management System (SUMS) for secure over-the-air updates.

Without appropriate certification, manufacturers do not receive type approval. The requirements cascade through the supply chain: Tier-1 and Tier-2 suppliers must also provide compliance evidence for their automotive software. ISO/SAE 21434 provides the engineering framework for implementation.

Integrated approach for automotive software

Sources

• UNECE: UN Regulation No. 155 – Cyber Security and Cyber Security Management System
• ISO: ISO/SAE 21434:2021 – Road vehicles – Cybersecurity engineering
• ISO: ISO 26262-1:2018 – Road vehicles – Functional safety
• VDA QMC: Automotive SPICE for Cybersecurity 2.0 (March 2025)