NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (2022)
The regulator's expectations for vehicle cybersecurity across the life of the vehicle: a risk-based process, protection of safety-critical systems from external interfaces, control of diagnostic and remote access, secure over-the-air updates, logging to support incident detection and investigation, and a vulnerability disclosure path for outside researchers.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Containment and isolation C-E5 | Recommended | isolation and segmentation of safety-critical vehicle systems from external connectivity | high | 5 cases |
| Actor identity verification C-A1 | Recommended | authentication and access control for diagnostic, service, and remote interfaces | medium | 4 cases |
| Independent audit log C-V1 | Recommended | logging that supports detection and later investigation of cyber incidents | medium | 1 case |
| Coordinated disclosure program C-O1 | Recommended | a vulnerability reporting and disclosure policy for outside researchers | high | not yet seen missing in a case |