UNECE WP.29 R155
The UN type approval regulation that makes vehicle cyber security a condition of sale in the UNECE markets: the manufacturer holds a Certificate of Compliance for its Cyber Security Management System covering development, production and post-production, and for each vehicle type identifies critical elements, assesses every Annex 5 threat, implements the relevant Annex 5 mitigations, tests, monitors the fleet and reports yearly. Rebuilt on the Regulation's own paragraphs from the consolidated text with Supplements 1 to 3 and the WP.29 Interpretation Document.
UNECE WP.29 R155 is a compliance framework from International (Contracting Parties to the UNECE 1958 Agreement that apply the Regulation) with 9 domains and 57 controls. The largest domains are Annex 5 Part B: Mitigations intended for vehicles – UNECE WP.29 R155 (19 controls), Paragraph 7.2: Requirements for the Cyber Security Management System – UNECE WP.29 R155 (12 controls), Paragraph 7.3: Requirements for vehicle types – UNECE WP.29 R155 (8 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (9)
Annex 5 Part B: Mitigations intended for vehicles – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::A5-B5-20.4 | Annex 5 B5-20.4 Correlate data from different sources against driving data or diagnostic data manipulation |
| unece-wp-29-r155::A5-M10 | Annex 5 M10 The vehicle verifies the authenticity and integrity of messages it receives |
| unece-wp-29-r155::A5-M11 | Annex 5 M11 Security controls for storing cryptographic keys |
| unece-wp-29-r155::A5-M12 | Annex 5 M12 Confidential data transmitted to or from the vehicle is protected |
| unece-wp-29-r155::A5-M13 | Annex 5 M13 Measures to detect and recover from denial of service attacks |
| unece-wp-29-r155::A5-M14 | Annex 5 M14 Measures to protect systems against embedded viruses or malware should be considered |
| unece-wp-29-r155::A5-M15 | Annex 5 M15 Measures to detect malicious internal messages or activity should be considered |
| unece-wp-29-r155::A5-M16 | Annex 5 M16 Secure software update procedures are employed |
| unece-wp-29-r155::A5-M18 | Annex 5 M18 User roles and access privileges defined and controlled on least privilege |
| unece-wp-29-r155::A5-M19 | Annex 5 M19 Security procedures defined and followed, with logging of security management actions |
| unece-wp-29-r155::A5-M20 | Annex 5 M20 Security controls on systems with remote access |
| unece-wp-29-r155::A5-M21 | Annex 5 M21 Software security assessed, authenticated and integrity protected; third-party software risk minimised |
| unece-wp-29-r155::A5-M22 | Annex 5 M22 Security controls on external interfaces |
| unece-wp-29-r155::A5-M23 | Annex 5 M23 Cyber security best practices for software, hardware, system design and integration, with adequate test coverage |
| unece-wp-29-r155::A5-M24 | Annex 5 M24 Best practices protect the integrity and confidentiality of stored personal data |
| unece-wp-29-r155::A5-M6 | Annex 5 M6 Systems implement security by design to minimise risks |
| unece-wp-29-r155::A5-M7 | Annex 5 M7 Access control techniques and designs protect system data and code |
| unece-wp-29-r155::A5-M8 | Annex 5 M8 System design and access control prevent unauthorised access to personal or system-critical data |
| unece-wp-29-r155::A5-M9 | Annex 5 M9 Measures to prevent and detect unauthorised access |
Annex 5 Part C: Mitigations outside the vehicle – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::A5-M1 | Annex 5 M1 Security controls on back-end systems to minimise the risk of insider attack |
| unece-wp-29-r155::A5-M2 | Annex 5 M2 Security controls on back-end systems to minimise unauthorised access |
| unece-wp-29-r155::A5-M3 | Annex 5 M3 Back-end security controls with recovery measures for critical services |
| unece-wp-29-r155::A5-M4 | Annex 5 M4 Security controls to minimise cloud computing risks |
| unece-wp-29-r155::A5-M5 | Annex 5 M5 Security controls on back-end systems to prevent data breaches |
Paragraph 5: Approval – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::5.4 | 5.4 Manufacturer ensures the cyber security aspects are implemented |
Paragraph 6: Certificate of Compliance for CSMS – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::6.10 | 6.10 Apply in due time for a new or extended CSMS certificate |
| unece-wp-29-r155::6.3 | 6.3 CSMS certificate application: CSMS documents and signed declaration |
| unece-wp-29-r155::6.4 | 6.4 Declare and demonstrate the necessary CSMS processes |
| unece-wp-29-r155::6.9 | 6.9 Inform the authority of changes affecting the CSMS certificate |
Paragraph 7.2: Requirements for the Cyber Security Management System – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::7.2.2.1 | 7.2.2.1 CSMS covers the development, production and post-production phases |
| unece-wp-29-r155::7.2.2.2(a) | 7.2.2.2(a) Processes within the organization to manage cyber security |
| unece-wp-29-r155::7.2.2.2(b) | 7.2.2.2(b) Processes to identify risks to vehicle types, considering Annex 5 Part A |
| unece-wp-29-r155::7.2.2.2(c) | 7.2.2.2(c) Processes to assess, categorize and treat identified risks |
| unece-wp-29-r155::7.2.2.2(d) | 7.2.2.2(d) Processes to verify that identified risks are appropriately managed |
| unece-wp-29-r155::7.2.2.2(e) | 7.2.2.2(e) Processes to test the cyber security of a vehicle type |
| unece-wp-29-r155::7.2.2.2(f) | 7.2.2.2(f) Processes to keep the risk assessment current |
| unece-wp-29-r155::7.2.2.2(g) | 7.2.2.2(g) Processes to monitor, detect and respond, and to re-check mitigation effectiveness |
| unece-wp-29-r155::7.2.2.2(h) | 7.2.2.2(h) Processes to provide data to support analysis of attacks |
| unece-wp-29-r155::7.2.2.3 | 7.2.2.3 Threats and vulnerabilities needing a response are mitigated within a reasonable timeframe |
| unece-wp-29-r155::7.2.2.4 | 7.2.2.4 Monitoring is continual, covers registered vehicles and uses vehicle data and logs |
| unece-wp-29-r155::7.2.2.5 | 7.2.2.5 CSMS manages dependencies on suppliers, service providers and sub-organizations |
Paragraph 7.3: Requirements for vehicle types – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::7.3.1 | 7.3.1 Valid CSMS certificate relevant to the vehicle type, with the transitional allowance |
| unece-wp-29-r155::7.3.2 | 7.3.2 Identify and manage supplier-related risks for the vehicle type |
| unece-wp-29-r155::7.3.3 | 7.3.3 Identify critical elements and perform an exhaustive risk assessment for the type |
| unece-wp-29-r155::7.3.4 | 7.3.4 Protect the type with proportionate mitigations, including relevant Annex 5 Part B and C measures |
| unece-wp-29-r155::7.3.5 | 7.3.5 Secure dedicated environments for aftermarket software, services, applications or data |
| unece-wp-29-r155::7.3.6 | 7.3.6 Test before type approval that security measures are effective |
| unece-wp-29-r155::7.3.7 | 7.3.7 Measures to detect and prevent attacks, support monitoring and provide forensics |
| unece-wp-29-r155::7.3.8 | 7.3.8 Cryptographic modules in line with consensus standards or justified |
Paragraph 7.4: Reporting provisions – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::7.4.1 | 7.4.1 Report monitoring outcomes at least once a year and confirm mitigations remain effective |
Paragraphs 3 and 4: Application for approval and marking – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::3.2 | 3.2 Application documents: vehicle type description and the CSMS certificate |
| unece-wp-29-r155::3.2.2 | 3.2.2 Sufficient information despite intellectual property or know-how |
| unece-wp-29-r155::3.3 | 3.3 Documentation package and material open for inspection, kept ten years |
| unece-wp-29-r155::4.1 | 4.1 International approval mark on every conforming vehicle |
Paragraphs 8 to 12: Modification, conformity of production and discontinuation – UNECE WP.29 R155
| Code | Title |
|---|---|
| unece-wp-29-r155::11.1 | 11.1 Inform the authority when production is definitively discontinued |
| unece-wp-29-r155::8.1 | 8.1 Notify modifications of the vehicle type affecting cyber security |
| unece-wp-29-r155::9.1.1 | 9.1.1 Conformity of production: record test results and keep the documents |
What is UNECE WP.29 R155 and who does it apply to?
UNECE WP.29 R155 is a compliance framework from International (Contracting Parties to the UNECE 1958 Agreement that apply the Regulation) with 9 domains and 57 controls. The UN type approval regulation that makes vehicle cyber security a condition of sale in the UNECE markets: the manufacturer holds a Certificate of Compliance for its Cyber Security Management System covering development, production and post-production, and for each vehicle type identifies critical elements, assesses every Annex 5 threat, implements the relevant Annex 5 mitigations, tests, monitors the fleet and reports yearly. Rebuilt on the Regulation's own paragraphs from the consolidated text with Supplements 1 to 3 and the WP.29 Interpretation Document. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does UNECE WP.29 R155 actually require?
UNECE WP.29 R155 has 57 controls organised across 9 domains. The largest domains are Annex 5 Part B: Mitigations intended for vehicles – UNECE WP.29 R155 (19 controls), Paragraph 7.2: Requirements for the Cyber Security Management System – UNECE WP.29 R155 (12 controls), Paragraph 7.3: Requirements for vehicle types – UNECE WP.29 R155 (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of UNECE WP.29 R155 do I already cover?
UNECE WP.29 R155 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement UNECE WP.29 R155?
Start your UNECE WP.29 R155 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about UNECE WP.29 R155 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 57 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required