What Is UNECE WP.29?
UNECE WP.29 (UN Regulation No. 155) requires vehicle manufacturers to establish a Cybersecurity Management System (CSMS) as a condition of vehicle type approval in participating markets including the EU, Japan, and South Korea. Without a verified CSMS, manufacturers can’t get new vehicle types approved for sale in those markets. The regulation took effect for new vehicle types in 2022 and expanded to all new vehicles in 2024.
WP.29 doesn’t just apply to automakers. It extends security requirements through the supply chain: component suppliers, software vendors, and system integrators that touch connected vehicle systems all become part of the compliance equation. UN Regulation 156 runs parallel to R155, adding a Software Update Management System (SUMS) requirement for over-the-air update capabilities. Most manufacturers address R155 and R156 together as a unified compliance program.
The CSMS is not a one-time certification. It must be operated continuously across the vehicle’s full lifecycle — from development through production and into post-production support. Type approval authorities audit CSMS operation, not just documentation, which means the security program has to function in practice, not just on paper.
Why Choose AdVran for UNECE WP.29?
WP.29 mandates that vehicle manufacturers establish a CSMS for type approval. This extends to the whole supply chain, requiring documented security practices from component suppliers through final assembly. California automotive technology companies — EV software suppliers, connected component manufacturers, and tier-1 integrators — that supply into vehicles sold in WP.29 markets face real exposure even without direct EU or Japanese regulatory relationships.
The IT infrastructure that supports a CSMS involves monitoring capabilities, incident response procedures, secure development environment controls, and supply chain security assessments. These are IT and security program requirements, not just engineering requirements. That’s where AdVran’s role is most direct.
1. CSMS Technical Infrastructure
We build and operate the IT infrastructure and security monitoring capabilities that form the backbone of your CSMS. That includes asset management for connected vehicle systems, continuous monitoring for cybersecurity events, and the logging and evidence retention that type approval authorities review. Our SOC monitoring and threat hunting provides the 24/7 detection capability WP.29 requires for monitoring cybersecurity events across connected vehicle systems.
2. Supply Chain Security Controls
WP.29 requires that manufacturers assess and manage cybersecurity risks in their supply chain, including Tier 1 and Tier 2 suppliers. For suppliers, this means demonstrating that your security practices are mature enough to be part of a manufacturer’s compliant supply chain. Our compliance and risk management services support both the supplier-side documentation and the manufacturer-side supply chain assessment process.
3. Incident Detection and Response
WP.29’s CSMS requirements include cybersecurity monitoring for vehicles in production and in-use, and procedures for detecting and responding to cybersecurity events that affect the vehicle type’s safety or performance. Our incident response services provide the detection, containment, and documentation capabilities that regulatory authorities look for when assessing whether a CSMS is functioning as intended.
4. Software Update Security (UN R156)
UN Regulation 156 adds SUMS requirements for OTA update delivery. Updates must be authenticated, integrity-verified, and protected against unauthorized modification. We secure the IT infrastructure supporting OTA update systems, including the signing infrastructure, delivery network security, and audit logging that demonstrates update integrity from origin to vehicle.
5. Secure Development Environment
Connected vehicle software development requires controlled environments that prevent unauthorized access to vehicle software and development data. Our network infrastructure services implement segmented development environments with access controls, code signing infrastructure, and secure file transfer capabilities appropriate for vehicle software development.
WP.29 CSMS Core Requirements
The CSMS under UN R155 must address cybersecurity risk management across six functional areas:
-
Risk assessment and treatment: Identify and assess cybersecurity risks relevant to vehicle types and their connected systems. Document risk treatment decisions.
-
Security by design: Integrate cybersecurity requirements into vehicle development processes, including threat analysis and risk assessment (TARA) per ISO/SAE 21434.
-
Supplier and sub-supplier security: Identify and manage cybersecurity dependencies on suppliers. Require suppliers to demonstrate they can protect shared data and development assets.
-
Incident monitoring and response: Monitor for cybersecurity attacks, incidents, and vulnerabilities affecting vehicle types in production and in use. Respond proportionally.
-
Post-production security: Maintain cybersecurity controls throughout the vehicle’s operational life, including vulnerability monitoring and the ability to deploy fixes for discovered vulnerabilities.
-
CSMS effectiveness verification: Demonstrate that the CSMS is operating as intended through internal audits and management reviews. Provide evidence to type approval authorities on request.
Frequently Asked Questions About UNECE WP.29 Compliance
Who must comply with this regulation?
UNECE WP.29 applies to vehicle manufacturers selling into markets that have adopted the regulation: currently the EU, Japan, South Korea, and other UNECE member states. It flows down to Tier 1 suppliers and software vendors whose components are integrated into the vehicle’s connected systems. California automotive technology companies supplying connected components or vehicle software to manufacturers selling in WP.29 markets should assess their exposure — the supply chain obligations apply even for companies without direct regulatory relationships in those markets.
What are the key security requirements?
WP.29 requires a documented and operated CSMS covering risk identification and treatment, supply chain security practices, incident monitoring and response, post-production security maintenance, and CSMS effectiveness verification. UN Regulation 156 adds SUMS requirements for OTA updates, including authentication, integrity verification, and rollback capability. Our managed IT services configure and operate the IT security controls that underpin both requirements.
What are the consequences of non-compliance?
Manufacturers without a verified CSMS can’t obtain new vehicle type approvals in WP.29 markets. For suppliers, non-compliance can mean disqualification from OEM programs when the manufacturer conducts supply chain security assessments. Type approval is a market access issue — manufacturers in WP.29 markets have no practical alternative to CSMS compliance if they want to sell new vehicle types.
How does AdVran help businesses achieve and maintain compliance?
We start with a gap assessment against WP.29 and R156 requirements, then configure controls through managed services, continuous monitoring, and automated evidence collection. Our GRC platform maintains a live compliance posture dashboard. Our team has experience working with automotive technology clients through WP.29 readiness assessments and OEM supply chain due diligence processes.
How does this framework interact with other compliance requirements?
WP.29 CSMS requirements align closely with ISO/SAE 21434 (automotive cybersecurity engineering standard) and ISO 27001. Organizations holding ISO 27001 certification have significant control overlap already addressed. TISAX certification provides relevant evidence for WP.29 supply chain assessments — OEMs conducting supplier security due diligence accept TISAX results as evidence of information security management maturity. Our multi-framework approach maps controls across all applicable requirements at once.
Automotive manufacturers and suppliers operating in connected vehicle programs commonly face multiple overlapping requirements. TISAX covers information security for automotive supply chain partners and is frequently required alongside WP.29 compliance — the two frameworks address complementary aspects of automotive cybersecurity. ISO 27001 provides the ISMS foundation that both TISAX and WP.29 CSMS requirements build on. IEC 62443 applies to industrial control systems in manufacturing environments, relevant for vehicle production facilities. GDPR/CCPA intersects with connected vehicle programs through vehicle telemetry, driver behavior data, and occupant personal data collected by connected systems.