UN R155 / R156 Compliance

No approved CSMS, no type approval. We get OEMs and suppliers ready for UN R155 and R156, from your first TARA through to the audit, so cybersecurity stops standing between you and launch.

Start a Compliance Gap Assessment →

Why UN R155/R156 Decides Your Launch

UN R155/R156 makes an approved Cybersecurity Management System (CSMS) a condition of vehicle type approval across UNECE markets. UN R156 adds a Software Update Management System (SUMS) for OTA and software updates.

Without both, an OEM can't legally put new vehicle types on the market in those regions. That makes this a launch-gating requirement, not an optional best practice you can get to later.

What R155 and R156 Require

UN R155/R156: CSMS (Cybersecurity Management System)

A managed process to identify, assess and treat cybersecurity risks across the vehicle's lifecycle. A TARA for each vehicle type, with documented risk treatment. The ability to monitor for new threats after production, and respond to them.

TARA

UN R156: SUMS (Software Update Management System)

A system governing how software updates are authored, validated and delivered. Integrity and authenticity for every OTA update. Records that link software versions to vehicle configurations (RXSWIN).

Certified and Backed by the Standards That Matter

We are an ISO 9001:2015 and ISO 27001:2022 certified company, and our experts are certified across ISO/SAE 21434, ISO 26262 and TISAX, the standards your auditors and regulators actually ask for.

ISO 9001:2015, Quality Management Certified Company ISO 27001:2022, Information Security Certified Company

Common Questions

R155 is about the vehicle's Cybersecurity Management System (CSMS). R156 is about the Software Update Management System (SUMS), meaning how your software and OTA updates are managed. You generally need both.
Yes, indirectly. An OEM has to show its supply chain supports the CSMS, so Tier-1 and Tier-2 suppliers need to provide cybersecurity evidence for their components.
It's a software identification number that links your approved software versions to a vehicle type, and it's central to how R156 manages updates.
India's AIS-189/190 is aligned with UN R155/R156. If you sell in both markets, much of the CSMS work carries over, though each approval is still separate.

Make Cybersecurity a Launch Enabler

Start with a gap assessment against UN R155 and R156, and walk away with a clear, prioritised path to type-approval readiness.

Start a Compliance Gap Assessment → Talk to our team →