UNECE WP.29 R155 7.2.2.2(a): 7.2.2.2(a) Processes within the organization to manage cyber security

The processes used within the manufacturer's organization to manage cyber security. The Interpretation Document limits this to processes relevant to the cyber security of vehicle types (not the enterprise ISMS) and looks for the organizational structure and the roles, responsibilities and accountability for cyber security management; it is unfulfilled where processes are absent, incomplete, inconsistently applied, routinely circumvented, unrelated to governance, wholly reliant on careful manual user behaviour, unreviewed after major change, or unusable by staff, and fulfilled where governance and risk management are documented with KPIs reported to executive management, processes are practical and reviewed at regular intervals and after incidents or change.