The automotive industry is expected to face increasing cybersecurity threats as vehicles become connected. Therefore, more regulations requiring companies to develop safety solutions thoughout a car's lifecycle have been set up.
MIH and PricewaterhouseCoopers(PwC) Taiwan held a seminar about EV supply chain cybersecurity on December 15. MIH is an EV alliance initiated by Foxconn.
Chin Jui Chang, one of the speakers and a partner of PwC Risk Consulting Taiwan, said the ICT industry in Taiwan is essential to global supply chains. Almost every player in the industry now targets the EV market.
However, Chang said many companies do not know about the requisites for automotive cybersecurity, which is a worrisome situation.
He added that the future automotive ecosystem will be much more complicated than it used to be. The system will involve energy, charging, battery, chips, ride-hailing service and many other segments. A vehicle will rely on over-the-air updates and gather tons of data. As a result, cybersecurity is a critical issue.
According to PwC's Global Automotive Cyber Security Management System Survey 2022, 89% of OEMs believed enhanced cybersecurity management will make a carmaker more competitive.
About 90% of the survey participants agreed that automakers and suppliers should work more closely on the issue. Chang said cybersecurity threats exist throughout a vehicle's lifecycle, from development and production to resale. More vulnerabilities are identified in the development and testing phases.
Several international rules mandate OEMs and suppliers to take cybersecurity measures. In March 2021, the United Nations Economic Commission for Europe (UNECE) published the WP. 29 R155 regulation, which will become mandatory for all new vehicles produced in Europe from July 2024.
According to MIH, the European Union, Japan, South Korea and 54 other countries will comply with R155. Chang said the regulation requires OEMs to receive a CSMS certificate of conformity. CSMS stands for cyber security management system. OEMs also must get vehicle type approval (VTA) for each model they sell.
Chang said the CSMS has to apply to the development, production and post-production stages. While the regulation is mandatory for carmakers, automotive suppliers and service providers must follow suit when the needs arise, according to Chang.
Another common regulation is the Trusted Information Security Assessment Exchange (TISAX), established by the German Association of the Automotive Industry (VDA).
Sidney Ho, SGS Taiwan's division manager at Knowledge BU, said TISAX demands companies to apply for security assessment covering every part involved with data. It requires each entity to possess the basic cybersecurity measures.
Ho said, for example, if the R&D and production departments have access to sensitive data during the production process, they must take the assessment. Those who pass the evaluation will receive a certificate that can be looked up on the TISAX platform.
Several OEMs might need the assessment result of the same component. Ho said the platform can provide the information in the same format for any company. The system also helps suppliers to save costs on assessments.
Ho added that TISAX may apply to more companies involved in mobility in the future, including cloud service providers. Microsoft, Google and AWS have obtained certificates with various assessment levels for their data centers around the world.
