Standards Development

Scope

This PAS gives recommendations for the inclusion of security considerations in the management of of safety risks in a connected automotive ecosystem. An objective of the PAS is to integrate security into safety for risk management of the automotive ecosystem. Broadly speaking, security management identifies the threat, vulnerability and potential mitigation of a safety-related issue, whilst safety management are responsible for assessing the impact and consequence and managing the safety risk. However, this broad outline is not fixed, as through the application of continuous risk management it is likely that safety management could also inform security, e.g., identify new vulnerabilities, and security management inform safety, e.g., identify new hazards.

The PAS covers both the entire connected automotive ecosystem and its constituent systems throughout their lifetimes (including manufacturing, supply chain, maintenance, and decommissioning activities). The ecosystem includes vehicles (both those used solely on public roads, such as cars, and those used occasionally on public roads, such as farming and construction equipment), as well as road-side and other static infrastructure, communication channels between vehicles and infrastructure, servicing and repair facilities, digital services, data and information and other services that support the proper operation of road transport. The focus is on digital communication between the vehicle and the outside world, which includes the use of computer vision systems to read road signs as well as more conventional services provided to the vehicle such as navigation and traffic information. All levels of vehicle automation and autonomy are in scope. However, the security of the networks used for communication with the vehicle is out of scope.

The PAS is intended to be used by manufacturers, operators and maintainers of products and services used in a connected automotive ecosystem. In this context, a product is something that is installed in the vehicle whereas a service is something external to the vehicle that is accessed via an interface. A product can be an item, component or complete sub-system in its own right and can include both hardware and software. A service is a means of providing distinct functionality to the vehicle from an external source and requires a suitable interface to be installed in the vehicle. t is important to ensure the integrity and authenticity of both products and services to avoid compromising the safety and security of the vehicle.

This PAS might also be of interest to regulators and other stakeholders in the connected automotive ecosystem, including owners of large vehicle fleets, and local and national authorities responsible for road safety.