Supplier Cybersecurity Assurance Beyond Questionnaires

Why questionnaires alone fail R155 programs

UN R155 expects manufacturers to manage cybersecurity across suppliers. Many programs respond with lengthy questionnaires and green spreadsheet status. That creates documentation, not assurance — especially for ECUs that terminate external connectivity, hold keys, enforce gateway policy, or run update clients.

Self-attestation is a starting filter. It is not verification. Technical services and sophisticated customers increasingly ask how you checked high-risk claims, not only whether the supplier answered “yes.”

Tier suppliers by cybersecurity consequence

Not every part deserves the same depth. Spend assurance effort where compromise creates type-level or fleet-level damage.

• Highest tier: telematics, gateways, domain controllers with external interfaces, HSM/key custody components, OTA clients, digital-key / phone-as-key stacks
• High tier: ECUs that can inject safety- or security-critical bus traffic, diagnostic masters, charging / V2X interfaces
• Standard tier: constrained ECUs with limited interfaces but still in the item boundary — lighter evidence, clear assumptions
• Watch shared backends and mobile apps: often owned by a different supplier organization than the ECU hardware team

Contractual flow-down that engineers can use

Purchase specs and SOWs should state cybersecurity obligations in engineering language: required work products, notification SLAs for vulnerabilities, update support windows, key-provisioning responsibilities, and right-to-audit or right-to-test for high-tier parts.

Vague “comply with ISO/SAE 21434” clauses without deliverables produce argument at gate time. Specify which artifacts are due at which milestones — concept, sample, PPAP-equivalent cybersecurity pack, and SOP support model.

Evidence packs worth requesting

For high-tier suppliers, ask for artifacts you can read against your item TARA — not marketing security whitepapers.

• Item / component definition and interface list aligned to your architecture
• Supplier TARA or threat scenarios for the delivered functions, with residual risk and treatments
• Cybersecurity requirements and verification results for authentication, secure boot, update verification, and diagnostic access
• Secure development process summary: vulnerability handling, change control, and who to contact after SOP
• Cryptographic key management description: generation, injection, uniqueness, and extraction resistance claims

When to verify technically

Verify when the supplier controls a privileged boundary or when residual risk in your TARA depends on their control operating as claimed. Typical methods: interface testing against gateway/diagnostic policy, secure-boot and update negative tests on bench samples, review of signing and provisioning flows, and targeted penetration testing of connected services.

Sampling beats theater: a shallow test of every supplier is weaker than deep verification of the five components that dominate your attack surface.

Shared responsibility and integration risk

Many failures sit between organizations: OEM assumes supplier authenticates diagnostics; supplier assumes OEM gateway blocks the path; neither tests the composed system. Interface agreements and joint integration tests close that gap.

Treat “assumed control by other party” as an explicit TARA entry with an owner and a verification plan. Unowned assumptions are not controls.

Operating model after SOP

Supplier assurance continues after launch. You need contacts, SBOM or software inventory expectations where feasible, vulnerability notification paths, and contractual ability to require fixes or compensating controls within defined timelines.

If a critical supplier cannot update or will not disclose, your CSMS incident playbooks must already include containment options — network controls, feature disablement, or campaign strategy — rather than discovering the limitation during a live incident.

Bottom line

Supplier cybersecurity assurance is risk-tiered technical management: contracts that demand real work products, evidence reviewed against your TARA, and verification where trust would otherwise be blind. Questionnaires remain useful triage — they are not the control.