Why cybersecurity landed on the quality manager’s desk
UN Regulation 155 (cybersecurity and cybersecurity management systems) and UN Regulation 156 (software updates and software update management systems) are management-system regulations. The UK Vehicle Certification Agency (VCA) describes R155 as “audit based”: manufacturers submit their management systems for assessment, and the authority interviews stakeholders (VCA).
Audits, documented processes, records, continual improvement: that is quality management territory. Security engineers own the technical content, but quality managers are often asked to make the CSMS and SUMS work as auditable systems.
Key dates
From VCA’s guidance (last updated May 22, 2026):
| Regulation | Scope | Date |
|---|---|---|
| R155 | New whole-vehicle type approvals, EU unlimited series (M and N) | July 6, 2022 |
| R155 | Existing type approvals, EU unlimited series | July 7, 2024 |
| R155 | Existing approvals, small series and special purpose | July 7, 2026 |
| R156 | New whole-vehicle type approvals, unlimited series | July 7, 2024 (with earlier application from July 2022 where post-registration updates affect type-approved characteristics) |
| R156 | New completed vehicles, unlimited series | July 7, 2029 |
Only vehicle manufacturers can obtain approval under R155, but VCA states that they must show they manage their supply chain effectively, which pulls suppliers in.
CSMS and SUMS in plain terms
| CSMS (R155) | SUMS (R156) | |
|---|---|---|
| Purpose | Manage cybersecurity risk across the vehicle lifecycle | Carry out software updates safely and traceably |
| Closest standard | ISO/SAE 21434 (VCA: R155 “can be closely mapped” to it) | ISO 24089 |
| Typical evidence | Risk assessments, threat monitoring, incident response, supplier requirements, governance | Configuration records, RXSWIN management, compatibility and type-approval impact assessments, update protection, owner information |
| Certificate | Typically valid for up to three years (SPK and Associates) | Valid for three years (UL Solutions) |
The two systems interlock: the CSMS decides when and why an update is needed; the SUMS governs how it is delivered.
Where quality management adds value
1. Process ownership and document control
CSMS and SUMS processes need the same discipline as any QMS process: owners, controlled procedures, training and records. Many companies integrate them into the existing IATF 16949 or ISO 9001 document system.
2. Internal audit and management review
UL describes the SUMS as following a Plan-Do-Check-Act cycle with regular evaluation of effectiveness, including audits by independent bodies. Quality teams already run internal audit programs and management reviews; extending them to CSMS and SUMS is the most direct contribution.
3. Supplier requirements
VCA expects manufacturers to identify supply chain risks and cascade security requirements to suppliers whose products could affect a vehicle type, using contracts. It cites ISO/SAE 21434 Clause 7 (distributed cybersecurity activities) for manufacturer-supplier agreements. Supplier quality is the natural channel.
4. Change and configuration control
R156 depends on knowing exactly which hardware and software versions are in each vehicle type. Configuration management is a classic quality discipline.
5. Evidence readiness
An auditor will follow a requirement to a process to a record. Quality managers know how to build that trail.
Who you work with
- Vehicle cybersecurity team / CSMS owner: technical risk content.
- Software and E/E engineering: update engineering and configuration.
- Homologation / type approval: approval authority and technical service.
- Supplier quality and purchasing: supplier cybersecurity requirements.
- IT and product security operations: monitoring and incident response.
Common weaknesses
- CSMS documents written as a one-off project, not maintained as a management system.
- No internal audit of the CSMS or SUMS between certification audits.
- Supplier cybersecurity requirements missing from contracts.
- Configuration records that do not match RXSWIN or the vehicles in the field.
- Management review that never discusses cybersecurity.
Checklist
- CSMS and SUMS procedures under document control with named owners
- Internal audit program covers CSMS and SUMS
- Management review includes cybersecurity and update performance
- Supplier contracts cascade security requirements
- Configuration and RXSWIN records reconciled
- Certificate renewal dates tracked
How AskDona helps
CSMS and SUMS evidence sits across security, engineering, homologation and supplier files. AskDona reads those documents against the requirement set you choose (for example, an R155 or R156 checklist or ISO/SAE 21434 mapping) and shows where each requirement is supported, with citations to the page. Run a sample CSMS/SUMS evidence check on one process area. AskDona shows the evidence; your security and quality teams decide.
Editor’s note: Dates are from the UK VCA’s guidance; other approval authorities may publish different implementation details. Certificate validity is reported by secondary sources rather than the regulation text. Not legal advice. The LinkedIn count was supplied by the client.
FAQ
What is the difference between R155 and R156? R155 covers cybersecurity management (CSMS); R156 covers software update management (SUMS).
Can a supplier get R155 approval? No. Only vehicle manufacturers can, but they must manage supply chain risk and cascade requirements to suppliers.
Which standards map to R155 and R156? ISO/SAE 21434 for R155 and ISO 24089 for R156.
How long is a CSMS or SUMS certificate valid? Secondary sources report up to three years.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| UK VCA: Cyber security and software updating (updated May 22, 2026) | Approval authority guidance | Dates, audit approach, supply chain, ISO mapping |
| UL Solutions: Software update management system (SUMS) | Certification body explainer | SUMS processes, PDCA, validity |
| SPK and Associates: R155 vs R156 (Mar 20, 2026) | Consultancy explainer | CSMS validity, evidence types |