The processes used to identify risks to vehicle types, within which the threats of Annex 5 Part A and other relevant threats are considered. The Interpretation Document expects all probable sources of risk, including connected services and dependencies external to the vehicle, sources such as vulnerability and threat sharing platforms and lessons learned, and a method covering relevance of a system to cyber security, a system description (function, boundaries and interactions, architecture, operating environment), assets, threats and vulnerabilities. Unfulfilled where identification rests on undefined assumptions, is a one-off, or assesses the type in isolation from IT and OT dependencies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.