UN Regulation No. 155: cyber security and cyber security management system
Vehicle type approval requires a certified cyber security management system covering the vehicle's lifecycle, including monitoring, detection, and response to attacks on vehicle systems.
Scope. Not in force in the United States, which is not a party to the 1958 Agreement. Kept because a case cites it; it is not a US obligation.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Actor identity verification C-A1 | Implied | authentication of remote commands to the vehicle (Kia dealer portal) | medium | 4 cases |
| Containment and isolation C-E5 | Implied | isolation between external interfaces and vehicle control | medium | 5 cases |
| Independent audit log C-V1 | Implied | monitoring and detection require logging the vehicle's own stack cannot alter | medium | 1 case |
Cases that cite this rule
| Case | How the case cites it | Outcome |
|---|---|---|
| Kia dealer portal 2024 | UN R155 (vehicle cybersecurity management) for newer markets; not directly applicable in the United States | Caught first by researchers |