Are You Ready for UN R155? The Real Work Behind Automotive Software Security Compliance
Modern vehicles are software systems on wheels with over 100 ECUs, millions of lines of code, and globally distributed supply chains.
The UNECE regulations R155 and R156 have transformed cybersecurity and software update management into conditions for type approval.
If you build or secure automotive software, you must be able to prove that you can defend it.
The Regulatory Stack That Matters
Each standard ultimately asks the same question: can you show that your controls work?
Readiness Means Proof, Not Paperwork
A defensible security posture aligns three capabilities:
- Governance – ownership, accountability, supplier oversight
- Engineering – security embedded in code, updates, and telemetry
Response – measurable incident handling and remediation evidence
Control Mapping — From Mandate to Mechanism
Readiness converts regulatory requirements into verifiable engineering artifacts.
Runtime Proof as the New Baseline
Auditors now seek runtime evidence rather than static compliance documents.
Telemetry, exploitability validation, and continuous monitoring demonstrate control effectiveness in real operating conditions.
This closes Part 1.
Part 2 will examine how runtime analysis and exploit intelligence extend these requirements into measurable proof.
References
- Applied Intuition. (2023). ISO/SAE 21434: Shaping automotive cybersecurity.
- Cybellum. (2023). Introduction to automotive cybersecurity regulations.
- European Commission. (2024). Cyber Resilience Act: Proposal and implementation overview.
- International Organization for Standardization. (2021). ISO/SAE 21434: Road vehicles – Cybersecurity engineering.
- National Highway Traffic Safety Administration. (2022). Cybersecurity best practices for the safety of modern vehicles (Report DOT HS 813 417).
- United Nations Economic Commission for Europe. (2021). UN Regulation No. 155: Cybersecurity and cybersecurity management system requirements.
- United Nations Economic Commission for Europe. (2021). UN Regulation No. 156: Software update processes and management systems.
- Verband der Automobilindustrie (VDA). (2023). Trusted Information Security Assessment Exchange (TISAX) Assessment Levels Guide.
More blogs
Kai at Work: A Day in the Life of an AI AppSec Engineer
Kai, Kodem’s secure-by-design AI AppSec Engineer, is integrated directly into the platform to deliver contextualized and actionable answers precisely when AppSec teams need them. By converting your existing security data into conversational intelligence, Kai eliminates the need for hours of manual investigation and context-switching. You can now ask questions as you would to a senior, humble, and tireless engineer.
CVE-2025-55182: Remote Code Execution in React Server Components
On December 3, 2025, the React and Vercel teams disclosed CVE-2025-55182, a critical remote-code-execution (RCE) vulnerability (CVSS 10) affecting React Server Components (RSC) as used in the Flight protocol implementation.
Shai Hulud 2.0: What We Know About the Ongoing NPM Supply Chain Attack
A new wave of supply chain compromise is unfolding across the open-source ecosystem. Multiple security vendors, including Aikido Security and Wiz have confirmed that the threat actor behind the earlier Shai Hulud malware campaign has resurfaced. This time, compromising NPM accounts, GitHub repositories and widely-used packages associated with Zapier and the ENS (Ethereum Name Service).
A Primer on Runtime Intelligence
See how Kodem's cutting-edge sensor technology revolutionizes application monitoring at the kernel level.
Platform Overview Video
Watch our short platform overview video to see how Kodem discovers real security risks in your code at runtime.
The State of the Application Security Workflow
This report aims to equip readers with actionable insights that can help future-proof their security programs. Kodem, the publisher of this report, purpose built a platform that bridges these gaps by unifying shift-left strategies with runtime monitoring and protection.
.png)
Get real-time insights across the full stack…code, containers, OS, and memory
Watch how Kodem’s runtime security platform detects and blocks attacks before they cause damage. No guesswork. Just precise, automated protection.
Stay up-to-date on Audit Nexus
A curated resource for the many updates to cybersecurity and AI risk regulations, frameworks, and standards.