Cybersecurity for the automotive supply chain
Since July 2024, new cars, light commercial vehicles, buses and trucks can be registered in the European Union only if the manufacturer has a cybersecurity management system that complies with UN R155. Manufacturers pass that obligation on to their suppliers, while NIS2 and the Cyber Resilience Act add legal obligations of their own. We help suppliers, component makers and aftermarket operators meet all of them with a single system.
Four sets of requirements, one supply chain
Today an automotive supplier receives cybersecurity requests from several directions: from the vehicle manufacturer, which must show the type-approval authority that it has the risks of its supply chain under control; from the National Cybersecurity Agency (ACN), if the company falls within NIS2; and from the European market, for every product with digital elements sold outside vehicle type approval.
Answering each one with a separate project costs twice as much and leaves gaps. It is better to start from a common base (risk, secure development, vulnerability management, suppliers, incidents) and from there produce the evidence each party asks for.
- UN R155 and R156: cybersecurity and software update management, a condition for vehicle type approval
- ISO/SAE 21434: the engineering standard manufacturers use to ask suppliers to demonstrate the security of their components
- TISAX: the information security assessment that many manufacturers require by contract
- NIS2: the manufacture of motor vehicles, trailers and semi-trailers (NACE division C29, including parts and accessories) is among the sectors in Annex II of Legislative Decree 138/2024
- Cyber Resilience Act: reporting of vulnerabilities and incidents from 11 September 2026 for products outside vehicle type approval
What we do
We work on two levels: the company (IT systems, plants, suppliers) and the product (components, software, connected services). The first answers to NIS2 and TISAX, the second to R155, ISO/SAE 21434 and the Cyber Resilience Act. The shared parts, such as risk, incidents and suppliers, we build only once.
For organisations that already have an ISO/IEC 27001 system the path is shorter: much of the evidence already exists and only needs to be linked to the new requirements.
- Gap analysis against ISO/SAE 21434 and the cyber requirements in manufacturers’ specifications
- Preparation for the TISAX assessment, starting from the existing management system
- NIS2 applicability check, registration, baseline measures and notifications
- Product vulnerability management process and reporting procedure for the Cyber Resilience Act
- Security of production plants (IEC 62443) and of suppliers’ remote access
- Qualification and monitoring of ICT and component suppliers
- War Room exercise on a supply chain scenario: lines stopped by an attack on a supplier
One incident, several recipients
The same event may have to be reported to ACN as a NIS2 incident, to ENISA and the CSIRT as a product vulnerability or incident under the Cyber Resilience Act, and to the customer manufacturer within the contractual deadlines. If there is a personal data breach that poses a risk to data subjects, the Italian Data Protection Authority (Garante) is added.
We define in advance who decides, on what criteria and how quickly, so that when the incident happens nobody has to read the law for the first time.
- NIS2 (CSIRT Italia): early warning within 24 hours, notification within 72 hours, final report within one month
- Cyber Resilience Act (ENISA and CSIRT): early warning within 24 hours, notification within 72 hours, final report within 14 days of the fix (vulnerability) or within one month of the notification (severe incident)
- Customer manufacturer: within the deadlines set in the supply contract
How we work
The work is carried out by the 823 Consulting staff, coordinated by Giacomo Pesce, CISO at a NIS2 essential entity included in the National Cyber Security Perimeter and ISO/IEC 27001 Lead Auditor. On product engineering we work alongside your development teams, who know the architecture better than anyone else.
- Survey: customers, contracts, products, systems and NIS2 classification
- Map of obligations: what each regulation asks for and what you already have
- Single plan: priorities, owners and deadlines
- Exercise: a supply chain scenario with the crisis committee
- Review: after incidents, customer audits and new requests
Customers ask for evidence, not statements
Tell us what manufacturers are asking of you and which products you sell. We will tell you which regulations really apply to you and where to start.