Compliance Service for Intelligent and Connected Vehicle

Through end-to-end integrated security compliance consulting, implementation and operation solutions, PricewaterhouseCoopers helps car companies build security capabilities required for technological changes such as intelligent connectivity and autonomous vehicles, meet mandatory regulatory requirements such as vehicle cybersecurity, vehicle software upgrades, and privacy protection, and enhance cybersecurity compliance resilience:

WP29 management system certification: Based on the R155 vehicle network security management system and R156 software upgrade management system issued by WP29, referring to international standards such as ISO21434 and ISO24089, we assist car companies' core departments in R&D, production, quality management, procurement, etc. to establish a vehicle network security management system (CSMS) and vehicle software upgrade management system (SUMS) that can cover the entire life cycle of the vehicle, and obtain R155 and R156 certifications.

WP29 model certification: Assist car companies to analyze and implement specific technical requirements for vehicle network security and vehicle software upgrade management in each model, and help them obtain corresponding model type certification (VTA).

Strong domestic standard compliance response: Based on mandatory national standards “Vehicle Information Security Technical Requirements” and “General Technical Requirements for Vehicle Software Upgrades”, we assist enterprises to implement vehicle information security technical requirements and vehicle manufacturers' information security management system requirements.

Threat analysis and risk assessment (TARA): Based on ISO21434 standards, it systematically identifies potential threats in scenarios such as autonomous driving systems and V2X communication, performs attack path modeling and risk level quantification, and outputs implementable protection strategies and priority rectification plans to reduce safety risks throughout the vehicle life cycle.

Vehicle component and platform testing: Penetration testing, fuzzy testing and reverse protocol analysis are carried out for key components such as ECU, T-Box, intelligent gateway, and vehicle networking platforms, covering communication interfaces, firmware code and cloud API vulnerability tests, verifying that they meet the requirements of standards such as ISO 21434, and outputting reinforcement plans and compliance certificates.

Data security and privacy protection: help enterprises sort out domestic and overseas intelligent connected vehicle data security compliance requirements, such as China's “Cybersecurity Law”, “Data Security Law”, “Personal Data Protection Law”, “Certain Vehicle Data Security Management Regulations”, etc., as well as overseas “EU General Data Protection Regulations (GDPR)” and EDPB's “Internet of Vehicles Personal Data Protection Guide”, etc., to establish a global data compliance system for car companies; design full-link compliance plans for user data collection, storage, cross-border transmission and destruction, plan global data center deployment and transmission routes, and strengthen sensitive data security protection measures. Avoid the risk of privacy breaches and regulatory penalties.

TISAX certification: As a participant in the formulation of TISAX standards, PricewaterhouseCoopers is also one of the few TISAX certification bodies in the world. It deeply integrates information security management and data protection requirements to help enterprises quickly pass certification and enhance the reliability of industrial chain cooperation.