ISO/PAS 5112:2022 道路車両—サイバーセキュリティエンジニアリングを監査するためのガイドライン | ページ 2

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, 2 (see www.iso.org/directives ).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents ).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html .

This document was prepared by Technical Committee ISO/TC 22, Road vehicles, Subcommittee SC 32, Electrical and electronic components and general system aspects.

Introduction

This document is related to ISO/SAE 21434 Road vehicles — Cybersecurity engineering and extends ISO 19011 Guidelines for auditing management systems to the automotive domain.

This document is intended for organizations involved in automotive cybersecurity engineering in any part of the automotive supply chain and for organizations needing to conduct audits. This document can be used for audits of varying scope.

This document is adapted to fit the scope of an automotive cybersecurity engineering audit programme. Cybersecurity audits in this document are aimed at cybersecurity activities at the organizational level. While results from past projects can be used as evidence for implemented and applied processes, the project and product levels are not in the focus of this document.

This document provides guidelines on the management of an audit programme, on the planning and conducting of management system audits, as well as on the competence and evaluation of an audit team. An audit can be conducted against a range of audit criteria. This document gives a set of audit criteria based on ISO/SAE 21434 objectives. In addition, Annex A contains an example questionnaire that can be adapted.

This document can be used for internal audits (first party), for audits conducted by organizations on their external parties (second party) and for external audits conducted by third parties (e.g. for the purpose of certification). This document can also be useful to organizations involved in auditor training or personnel certification.

1 Scope

In addition to the guidelines in ISO 19011, this document provides guidelines to organizations that contribute to the achievement of road vehicle cybersecurity throughout the supply chain on:

• managing an audit programme for a cybersecurity management system (CSMS);
• conducting organizational CSMS audits;
• competencies of CSMS auditors; and
• providing evidence during CSMS audits.

Elements of the CSMS are based on the processes described in ISO/SAE 21434. This document is applicable to those needing to understand or conduct internal or external audits of a CSMS or to manage a CSMS audit programme.

This document does not provide guidelines on cybersecurity assessments.

2 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO/SAE 21434, ISO 19011 and the following apply.

ISO and IEC maintain terminology databases for use in standardization at the following addresses:

Bibliography