How WP.29 is Steering the Future of Electric Vehicles

The UNECE WP.29’s R155 and R156 regulations are poised to revolutionize the landscape of electric vehicles (EVs). As the automotive industry and its software evolve, so too are the software capabilities of threat actors, ethical hackers, and tuners looking to get the most out of their ride.

Throughout this electric revolution, product security has emerged as a critical way of protecting these mission-critical data centers on wheels that now rely on hundreds of electronic component units (ECUs). As if it weren’t hard enough to secure a single unit, each unit has its own firmware, software, logic, and interoperability challenges that must work together seamlessly for decades without being taken offline for vulnerability scans or reviews.

This presents ample opportunities for people to gain access without being granted official authorization. It also presents a massive challenge for components that may find their way into tens of thousands of vehicles across dozens of OEMs.

Using the United Nations Economic Commission for Europe’s WP.29 R155 as a guide to protect vehicles is a way of keeping vehicles safe and reliable for operators who trust OEMs and an ecosystem of suppliers. It’s even more essential if this ecosystem wants access to the markets of participating countries.

What you’ll learn

• Understand the key objectives and principles of WP.29.
• The impact of WP.29 on EV Development
• Cybersecurity Requirements: Learn about WP.29’s mandates for EV cybersecurity.
• Standardization of Autonomous Driving: Discover WP.29’s role in autonomous vehicle technologies.

The UNECE WP.29 cybersecurity regulation, known as the World Forum for Harmonization of Vehicle Regulations, is pivotal in global vehicle safety and environmental standards. Established in 1952, WP.29’s mission is to develop unified vehicle regulations that enhance safety, environmental protection, and energy efficiency. For example, WP.29 includes regulations that mandate the implementation of safety procedures, including industry safety testing tools, mandating seatbelts, and now, cybersecurity management systems (CSMS). As with physical safety in vehicle manufacturing, vehicles must be designed with cybersecurity in mind from the ground up​​.

WP.29 regulations significantly influence the development and manufacturing of electric vehicles. As recently as this year, they decided to include Class L vehicles (2-wheeled vehicles that exceed 25 km/h). This includes electric bicycles, motorcycles, scooters, and traditional passenger vehicles.

This comprehensive approach ensures that even during development, vehicles, including two-wheelers and commercial vehicles, adhere to stringent cybersecurity standards, impacting how a vehicle’s software is developed. This move is essential as these vehicles increasingly integrate advanced technologies such as adaptive cruise control and connectivity features, introducing new cybersecurity challenges​​​​.

An example of how this could come into play is a major automotive manufacturer recognized the need to update their processes to be R155 compliant. While some vehicles were taking off the market, other product teams had to redesign their entire EV platform to integrate WP.29’s requirements. This included upgrading the vehicle’s communication protocols to prevent potential cyber-attacks, implementing a process for identifying and managing vulnerabilities, and producing compliance reports– all without taking the vehicle out of operation.

By adopting a lifecycle approach to cybersecurity, security is integrated at every stage of vehicle development. Utilizing automated risk assessment and vulnerability management tools can streamline this process and ensure compliance with WP.29 requirements.

WP.29 mandates several cybersecurity measures for electric vehicles, ensuring manufacturers adopt robust cybersecurity management systems (CSMS). Key requirements include risk assessment, vulnerability management, and continuous monitoring throughout the vehicle lifecycle. For instance, WP.29 requires that all new vehicle types undergo a thorough cybersecurity risk assessment and have a documented process for managing these risks​​​​.

In the field, this would see an EV manufacturer implement a CSMS that includes automated monitoring of their software components for vulnerabilities, regular cybersecurity audits, and a dedicated incident response team to address potential threats as they arise.

To comply with WP.29, manufacturers would free up resources by implementing a unified product security platform offering comprehensive risk assessment, vulnerability management, and incident response capabilities. For example, Cybellum’s Product Security Platform can automate these processes and ensure continuous compliance​​.

WP.29 also addresses the standardization of autonomous driving technologies. The regulation outlines specific guidelines to ensure that autonomous vehicles are safe, reliable, and secure. This standardization is crucial as the automotive industry moves towards more advanced levels of vehicle automation. For example, WP.29 includes provisions for the cybersecurity of vehicle-to-everything (V2X) communications, which are critical for the safe operation of autonomous vehicles​​.

Implementing WP.29’s guidelines requires close collaboration between software developers and cybersecurity experts. By leveraging platforms like Cybellum’s, manufacturers can ensure that their autonomous driving technologies comply with WP.29 standards through continuous monitoring and automated threat detection​​.

Compliance with WP.29 requires a structured approach. Manufacturers need to:

1. Implement a certified CSMS.
2. Conduct thorough risk assessments.
3. Integrate security by design principles in vehicle development.
4. Ensure continuous monitoring and management of cybersecurity risks.
5. Align with ISO/SAE 21434 standards for comprehensive cybersecurity measures.

Cybellum’s Product Security Platform can help manufacturers streamline their compliance efforts by implementing automated security tasks while retaining data from throughout the full product lifecycle. The platform provides tools for risk assessment, threat analysis, and other compliance-critical features like the VM-CoPilot as well as embedded reporting templates for over 55 standards and regulations.

The future of automotive cybersecurity is closely tied to the evolution of WP.29. As the regulation adapts, we can expect new amendments to address emerging threats and technologies. For instance, future amendments may focus on enhancing cybersecurity in connected and autonomous vehicles, with greater emphasis on automation and artificial intelligence in cybersecurity practices​​.

Staying ahead of these trends requires continuous innovation and adaptation. Manufacturers should invest in advanced cybersecurity technologies and proactively address new threats. 

Cybellum offers advanced solutions to help automotive manufacturers comply with WP.29. Our Product Security Platform provides a full risk-management system as CSMS guidelines require. This includes aggregating asset and risk data and conducting activities such as SBOM management, assurance, and vulnerability triaging. It also centralizes risk assessment, vulnerability management, and continuous monitoring capabilities. By leveraging automation, manufacturers can streamline their cybersecurity processes and ensure ongoing compliance with WP.29 regulations​​​​.

The UNECE WP.29 regulations are shaping the future of electric vehicles by setting stringent cybersecurity standards. As the automotive industry navigates these changes, compliance with WP.29 will be crucial in ensuring the safety and reliability of modern vehicles. 

Ready to adopt robust product security measures to streamline compliance? Contact us.

What is UNECE WP.29?

UNECE WP.29 is the World Forum for Harmonization of Vehicle Regulations, responsible for developing global vehicle standards to enhance safety, environmental protection, and energy efficiency.

How does WP.29 impact electric vehicle development?

WP.29 influences EV development by mandating comprehensive cybersecurity measures and standardizing safety protocols for autonomous driving technologies.

What are the cybersecurity requirements under WP.29?

WP.29 requires manufacturers to implement a certified Cybersecurity Management System (CSMS), conduct risk assessments, manage vulnerabilities, and ensure continuous monitoring.

How can automotive manufacturers ensure compliance with WP.29?

Manufacturers can ensure compliance by integrating security by design principles, aligning with ISO/SAE 21434 standards, and leveraging automation for effective risk and vulnerability management.