Cars now run on software, and OEMs expect their suppliers to prove it is safe and secure, with processes they can audit and not just promises. In several markets, cybersecurity and software update management are even a condition for vehicle approval.

Our automotive cybersecurity and functional safety consulting helps you build those processes, from the management system to the engineering of each product, aligned with each other and with the systems you already have.

Modern vehicles depend on software, connectivity and electronic systems that control critical functions. Each new feature brings new risks: cyberattacks, software faults, malfunctions of electronic systems and situations that automated functions were not designed to handle.

As a result, OEMs require their suppliers to demonstrate structured cybersecurity, functional safety and software development processes, and regulations in many markets make cybersecurity and software update management a condition for vehicle approval. For suppliers, these capabilities have become a requirement to enter and remain in vehicle programs.

Cybersecurity, functional safety and software quality cannot be added at the end of development. They must be built into the organization’s processes and applied from the concept phase through development, production, operation and end of support.

We help organizations establish these processes at organizational level and apply them in real projects. Because the disciplines are closely related, we align them with each other and with existing quality and information security systems, such as IATF 16949 and TISAX®, to avoid duplicated processes and conflicting requirements.

ISO/SAE 21434 defines how cybersecurity risks must be managed throughout the lifecycle of road vehicles and their components. Regulations such as UNECE R155, and equivalent national requirements in other markets, require vehicle manufacturers to operate a Cybersecurity Management System and to extend these obligations to their supply chain.

We support organizations in establishing cybersecurity management systems, defining cybersecurity roles and processes, and applying them in projects through Threat Analysis and Risk Assessment (TARA), cybersecurity concepts and requirements, and support for verification and validation activities. We also support vulnerability management, incident response, post-production monitoring and the cybersecurity agreements that define responsibilities between customers and suppliers.

ISO 26262 addresses the risks caused by malfunctions of electrical and electronic systems in road vehicles. It requires a safety lifecycle, from hazard analysis and risk assessment to safety requirements, design, verification, validation and production, scaled according to the Automotive Safety Integrity Level (ASIL) of each function.

We support organizations in establishing functional safety management, defining safety processes and roles, and applying them in projects, from the definition of safety goals and concepts to the preparation of the safety case. We also carry out gap assessments and readiness reviews ahead of customer audits and functional safety assessments.

ISO 21448 addresses risks that do not come from system failures, but from functional insufficiencies and foreseeable misuse, such as the limits of sensors and perception algorithms in automated driving and driver assistance systems.

We help organizations identify hazardous scenarios, define acceptance criteria and plan the verification and validation activities needed to demonstrate that the residual risk is acceptable. SOTIF activities are aligned with the functional safety lifecycle, so that both approaches work together in the same project.

Automotive SPICE is the reference model OEMs use to evaluate the capability of their suppliers’ software and system development processes. Many customers set a required capability level as a condition for awarding or maintaining business.

We support organizations in assessing their current process capability, defining an improvement roadmap and implementing development processes that meet the required capability level in practice. We also prepare teams and projects for customer assessments and help integrate Automotive SPICE with cybersecurity and functional safety requirements.

Over-the-air and workshop software updates are now part of the normal lifecycle of a vehicle. ISO 24089 defines the requirements for software update engineering, and regulations such as UNECE R156, and equivalent national requirements, require a Software Update Management System.

We support organizations in defining software update processes, managing software identification and compatibility, assessing the impact of updates on safety and cybersecurity, and preparing the evidence that customers and authorities expect.

Our services are aligned with the standards that define cybersecurity, safety and software quality in the automotive industry: ISO/SAE 21434, ISO 26262, ISO 21448, Automotive SPICE and ISO 24089, together with vehicle cybersecurity and software update regulations such as UNECE R155 and R156 and equivalent national requirements.

We also consider the customer-specific requirements of each OEM, which often add their own expectations for cybersecurity, safety and software development processes.