Automotive Security Standards to Protect Vehicles Throughout Their Lifecycle
Oct 29, 2026Digital Trust Stories / AutomotiveDoes a connected vehicle remain secure after years on the road? Continuous cybersecurity management goes beyond initial testing.
A vehicle may be safe when it leaves the factory, but what happens when its software is updated, new features are added, or new vulnerabilities emerge? In today’s automotive industry, cybersecurity should not be addressed solely during initial development and validation. It requires attention throughout the vehicle’s lifecycle, from initial design and development to production and years of operation on the road.
As vehicles become more connected, the challenge grows. According to recent research from Upstream, 92% of automotive cyberattacks are remote. Connectivity has fundamentally changed the automotive security landscape: vehicle security is no longer just about testing individual components, but about understanding how software, AI-powered components, and interconnected systems interact, and where those dependencies create risk.
This raises a bigger question: how can OEMs and Tier 1 and Tier 2 suppliers demonstrate that their systems remain safe, secure, and reliable not only under expected conditions, but also when exposed to new data, scenarios, and situations that were not fully anticipated during development and validation?
Standards and regulations play a key role in addressing these challenges throughout the automotive lifecycle. But which frameworks help manufacturers turn safety and security objectives into concrete requirements and practices? Let’s explore the key frameworks shaping automotive safety, security an reliability.
Cybersecurity should start at the design stage, not when the vehicle is ready for testing. ISO/SAE 21434 is the international standard for cybersecurity engineering in road vehicles. It provides a structured approach to identifying, assessing and managing cybersecurity risks across the concept, development, production, operation, maintenance and decommissioning of vehicle electrical and electronic (E/E) systems, including their components and interfaces.
Considering cybersecurity early helps manufacturers identify threats, define security requirements and address vulnerabilities before they become more costly to fix. This makes cybersecurity part of vehicle development from the outset, rather than a final testing step.
Functional Safety (FuSa) is also part of the picture. A vehicle’s electrical and electronic systems must also be designed to prevent malfunctions from becoming safety hazards. ISO 26262 provides a framework for Functional Safety in road vehicles, helping manufacturers identify potential hazards and define safety requirements during system, hardware and software development. This matters particularly for functions such as braking and steering, where an electronic failure could put people at risk.
Safety considerations do not end with development. When systems are maintained or modified, manufacturers and suppliers must also consider whether those changes introduce new safety risks. This becomes especially important once vehicles are in use and their software and components evolve.
The same principle applies to cybersecurity: protecting a vehicle when it is developed is not enough if new threats emerge after it reaches the road. UN R155 and R156 address two important aspects of ongoing vehicle security: cybersecurity management and software updates.
UN R155 requires manufacturers within its scope to establish a Cyber Security Management System (CSMS) to identify, assess and manage cybersecurity risks. UN R156 focuses on software updates, requiring a Software Update Management System (SUMS) to ensure updates are properly managed and documented.
Together, these regulations help manufacturers monitor cybersecurity risks and manage software changes throughout a vehicle’s service life. This allows OEMs to respond to emerging vulnerabilities and maintain oversight as vehicles evolve after production.
But managing risks after production is only part of the challenge. Reliability also depends on how the vehicle’s software is developed in the first place.
Automotive SPICE (ASPICE) is a process assessment model used to evaluate and improve the processes involved in developing automotive systems and software. Unlike regulations that establish legal requirements, ASPICE focuses on how development work is carried out. It helps manufacturers and suppliers establish consistent practices, from requirements analysis and system design to implementation, integration and testing.
ASPICE helps teams identify weaknesses in their development processes and check that requirements are traced through design, implementation and testing. For example, when developing an electronic braking system, teams need to ensure that software requirements are clearly defined, linked to the implementation and verified through testing.
This becomes increasingly important as software takes on more complex tasks and plays a greater role in vehicle functionality and reliability. With AI now being integrated into automotive systems, manufacturers must also consider risks that traditional development and testing approaches may not fully address.
AI introduces a completely new assurance challenge: a system can work as designed and still produce an unsafe result when facing unfamiliar data or unexpected conditions. ISO/PAS 8800 brings safety principles specifically to AI-powered automotive systems, addressing risks such as insufficient AI outputs, systematic errors, and hardware failures. This standard provides guidance on identifying and managing safety risks associated with AI in road vehicles. It builds on existing approaches to functional safety and the safety of intended functionality, addressing issues such as incorrect data and limitations in how AI systems perform in different situations.
Consider a driver assistance system that fails to recognize a pedestrian in poor lighting or unusual weather conditions. ISO/PAS 8800 helps manufacturers assess these limitations, define appropriate safety measures and gather evidence that the AI-based function can operate without unreasonable safety risks before deployment.
As AI moves deeper into Autonomous Driving Assistance Systems (ADAS) and other safety-related functions, ISO/PAS 8800 provides a framework for building a reliable safety case around AI behavior.
Extend Cybersecurity Beyond the Vehicle: Cyber Resilience Act (CRA)
The Cyber Resilience Act (CRA) is an EU regulation that introduces cybersecurity requirements for hardware and software products with digital elements placed on the EU market. It requires manufacturers within its scope to address cybersecurity risks during product development, manage vulnerabilities and provide security updates throughout the product’s support period.
The CRA does not apply to every digital product in the automotive ecosystem. Its applicability depends on whether a product falls within its scope or is covered by specific EU sectoral legislation that provides for an exclusion.
Vehicles and systems covered by the relevant automotive regulatory framework are generally addressed by sector-specific rules, while other digital products may fall within the CRA’s scope.
For example, a supplier selling a connected diagnostic tool or standalone automotive software may need to meet the CRA’s cybersecurity requirements, including vulnerability management, security updates and applicable conformity assessment obligations.
Automotive companies should therefore identify which products fall under the CRA and which are covered by automotive-specific regulations, such as UN R155 and R156. Suppliers serving multiple industries can also benefit from aligning their cybersecurity processes across sectors.
Building Trust Throughout the Vehicle Lifecycle
A vehicle’s safety and security cannot be taken for granted once it leaves the factory. Software continues to evolve, vulnerabilities emerge and new features bring new challenges. Keeping vehicles safe and secure means continuously managing emerging risks throughout their operational life and taking appropriate action when changes, vulnerabilities or new threats require it.
The frameworks covered here tackle different parts of that challenge, from automotive cybersecurity and functional safety, to software development and AI. Some guide how systems are designed and tested, others establish regulatory requirements, and ASPICE helps assess development processes. For manufacturers and suppliers, the challenge is to understand how these frameworks fit together and apply them across the vehicle’s lifecycle and the wider supply chain.
With more than 100 years of experience in road safety, DEKRA combines expertise in Cybersecurity, Functional Safety and Artificial Intelligence to help the automotive industry navigate complex standards and regulatory requirements. Through independent testing, certification and training, DEKRA supports the development and validation of automotive technologies, from early design and component testing to vehicle-level assessments and type approval. This comprehensive approach helps manufacturers address evolving risks, demonstrate compliance and build confidence in the technologies shaping today’s and tomorrow’s mobility.
Looking to strengthen your automotive cybersecurity strategy? Contact DEKRA to discuss your testing, certification and compliance needs.