1. Replies by the Task Force to the comments provided by GRVA members

2. Comments provided by Switzerland (TFCS-14-03)
1) Type approval process not the right approach for addressing Cyber Security „at any time“ => CH in favour of Self-Certification approach
Comments by the Task Force:
Inovative approach was taken in the boundaries given by the existing framework. It was decided to work on a draft UN Regulation under the 58A in order to be directly applied by the signatory Contracting Parties.
The test phase will evaluate the effectiveness and robustness of the approach taken
Task Force noted concerns that the self-certification scheme proposed by Switzerland would not be efficient or effective and be more burdensome
The Task Force confirmed the original approach taken.

3. Comments provided by Switzerland (TFCS-14-03)
2) Type approval process would not be flexible enough to address Cyber Security in emerging situations
=> CH in favour of Self-Certification approach
Comments by the Task Force:
Flexibility is given, especially with the S/W update process Regulation
The Software Update Regulation provides controls to ensure safety and quality of updates, no need for a self-ceriffication approach
It is unclear how self-certification would work for software updates that would affect existing system approvals
The Task Force confirmed the original approach taken

4. Comments provided by Switzerland (TFCS-14-03)
3) Post production phase only addressed in recommendation but not in the regulatory text
Comments by the Task Force:
and of the Regulation requires that monitoring and response procedures are implemented => to be checked at the point of approval
Limits of the 58A prevent requirements for post production being introduced
National/regional legislation covers the issue of post production, e.g. product liability and recall legislation, UNECE may wish to consider extending the convention
The Task Force confirmed the original approach taken

5. Comments provided by Germany (TFCS-14-07rev1)
1) Risk Assessment Unclear how to conduct the risk assessment and what the critical elements are to be protected
Comments by the Task Force:
Critical elements were not identified in the Regulation as this would be dependent on the vehicle design
The critical elements should be identified during the risk assessment
The Interpretation Document/ test phase will help resolving this issue
ISO/SAE can be used to identify the critical elements
The Task Force confirmed the original approach taken

6. Comments provided by Germany (TFCS-14-07rev1)
2) Cyber Security Managment System Unclear how to assess it
Comments by the Task Force:
The Interpretation Document/ test phase will help resolving this issue
ISO/SAE can be used to identify the critical elements
The Task Force confirmed the original approach taken

7. Comments provided by Germany (TFCS-14-07rev1)
3) Software updates Lifetime issue
Comments by the Task Force:
Limits of the 58A prevent requirements for post production being introduced
National/regional legislation covers the issue of post production, e.g. product liability and recall legislation, UNECE may wish to consider extending the convention
The Task Force confirmed the original approach taken

8. Comments provided by Germany (TFCS-14-07rev1)
4) Standardized gateway Need for implementation of a standardized gateway for communication into the vehicle
Comments by the Task Force:
Describes a specific technical solution and is therefore not technology neutral
The approach was extensively discussed with the Task Force on several occasions
The Task Force confirmed the original approach taken

9. Comments provided by FIA (TFCS-14-06)
1) Hardware updates Need for software and hardware updates
Comments by the Task Force:
Hardware updates had been identified to be outside remit of the Task Force on Cyber Security and Over-the-Air issues The Task Force confirmed the original approach taken

10. Comments provided by FIA (TFCS-14-06)
2) Updates over vehicle lifetime Lifetime issue and transferrance of IP rights to 3rd parties
Comments by the Task Force:
Limits of the 58A prevent requirements for post production being introduced
National/regional legislation covers the issue of post production, e.g. product liability and recall legislation, UNECE may wish to consider extending the convention
The Task Force noted the legal difficulties in mandating the transferrance of intellectual properties to 3rd parties
The Task Force confirmed the original approach taken

11. Comments provided by FIA (TFCS-14-06)
3) Reference model („Standardized Gateway“) Need for implementation of a standardized gateway for communication into the vehicle
Comments by the Task Force:
Describes a specific technical solution and is therefore not technology neutral
The approach was extensively discussed with the Task Force on several occasions
The Task Force confirmed the original approach taken