The manufacturer holds a valid Certificate of Compliance for CSMS relevant to the vehicle type being approved. For type approvals of Categories M, N and O first issued before 1 July 2024, and of Category L first issued before 1 July 2029, and for each extension of them, where the manufacturer shows the type could not be developed under the CSMS it must instead demonstrate that cyber security was adequately considered during development (Supplements 1 and 3). The Interpretation Document: the allowance covers only development; production and post-production must fully comply with the certified CSMS, and later extensions should follow CSMS development processes as far as possible with deviations justified and owned at management level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.