Experiences with the automotive SPICE for cybersecurity assessment model and tools

Richard Messnarz; Damjan Ekert; Georg Macher; Alexander Much; Tobias Zehetner; Laura Aschbacher

doi:10.1002/smr.2519

Experiences with the automotive SPICE for cybersecurity assessment model and tools

Richard Messnarz^*, Damjan Ekert, Georg Macher, Alexander Much, Tobias Zehetner, Laura Aschbacher

^*Corresponding author for this work

Institute of Technical Informatics (4480)

Research output: Contribution to journal › Article › peer-review

Abstract

In August 2021 the ISO 21434:2021 standard for Road vehicles—Cybersecurity Engineering has been published. At the same time the blue book from VDA (Verein der Deutschen Automobilgesellschaft; German Automotive Association) for Automotive SPICE cybersecurity assessments has been released. In addition in the period September–December 2021 the training material for iNTACS (INTernational Assessor Certification Schema) certified Automotive SPICE for cybersecurity assessors has been developed. Since February 2022 the upgrade training of assessors worldwide has started. Beside the ASPICE (Automotive SPICE) for cybersecurity blue book also a red book from VDA has been published. The red book describes the questions to check in an ACSMS (Automotive CyberSecurity Management System) audit. This paper explains the main strategy and content for ASPICE for Cybersecurity assessments and how such assessments are integrated to the overall ACSMS strategy. Also, the paper outlines an example method and tool used in ASPICE for cybersecurity assessments and how such assessment results will look like.

Original language	English
Journal	Journal of Software: Evolution and Process
DOIs	https://doi.org/10.1002/smr.2519
Publication status	E-pub ahead of print - 2022

Keywords

capability adviser tool based assessment
CSMS audit
cybersecurity ASPICE assessment
first experiences

ASJC Scopus subject areas

Software

Access to Document

10.1002/smr.2519

Cite this

@article{2e6c4740c72e47e7921641c18b3ae20b,

title = "Experiences with the automotive SPICE for cybersecurity assessment model and tools",

abstract = "In August 2021 the ISO 21434:2021 standard for Road vehicles—Cybersecurity Engineering has been published. At the same time the blue book from VDA (Verein der Deutschen Automobilgesellschaft; German Automotive Association) for Automotive SPICE cybersecurity assessments has been released. In addition in the period September–December 2021 the training material for iNTACS (INTernational Assessor Certification Schema) certified Automotive SPICE for cybersecurity assessors has been developed. Since February 2022 the upgrade training of assessors worldwide has started. Beside the ASPICE (Automotive SPICE) for cybersecurity blue book also a red book from VDA has been published. The red book describes the questions to check in an ACSMS (Automotive CyberSecurity Management System) audit. This paper explains the main strategy and content for ASPICE for Cybersecurity assessments and how such assessments are integrated to the overall ACSMS strategy. Also, the paper outlines an example method and tool used in ASPICE for cybersecurity assessments and how such assessment results will look like.",

keywords = "capability adviser tool based assessment, CSMS audit, cybersecurity ASPICE assessment, first experiences",

author = "Richard Messnarz and Damjan Ekert and Georg Macher and Alexander Much and Tobias Zehetner and Laura Aschbacher",

note = "Publisher Copyright: {\textcopyright} 2022 John Wiley & Sons Ltd.",

year = "2022",

doi = "10.1002/smr.2519",

language = "English",

journal = "Journal of Software: Evolution and Process",

issn = "2047-7481",

publisher = "Wiley-Blackwell",

}

TY - JOUR

T1 - Experiences with the automotive SPICE for cybersecurity assessment model and tools

AU - Messnarz, Richard

AU - Ekert, Damjan

AU - Macher, Georg

AU - Much, Alexander

AU - Zehetner, Tobias

AU - Aschbacher, Laura

PY - 2022

Y1 - 2022

N2 - In August 2021 the ISO 21434:2021 standard for Road vehicles—Cybersecurity Engineering has been published. At the same time the blue book from VDA (Verein der Deutschen Automobilgesellschaft; German Automotive Association) for Automotive SPICE cybersecurity assessments has been released. In addition in the period September–December 2021 the training material for iNTACS (INTernational Assessor Certification Schema) certified Automotive SPICE for cybersecurity assessors has been developed. Since February 2022 the upgrade training of assessors worldwide has started. Beside the ASPICE (Automotive SPICE) for cybersecurity blue book also a red book from VDA has been published. The red book describes the questions to check in an ACSMS (Automotive CyberSecurity Management System) audit. This paper explains the main strategy and content for ASPICE for Cybersecurity assessments and how such assessments are integrated to the overall ACSMS strategy. Also, the paper outlines an example method and tool used in ASPICE for cybersecurity assessments and how such assessment results will look like.

AB - In August 2021 the ISO 21434:2021 standard for Road vehicles—Cybersecurity Engineering has been published. At the same time the blue book from VDA (Verein der Deutschen Automobilgesellschaft; German Automotive Association) for Automotive SPICE cybersecurity assessments has been released. In addition in the period September–December 2021 the training material for iNTACS (INTernational Assessor Certification Schema) certified Automotive SPICE for cybersecurity assessors has been developed. Since February 2022 the upgrade training of assessors worldwide has started. Beside the ASPICE (Automotive SPICE) for cybersecurity blue book also a red book from VDA has been published. The red book describes the questions to check in an ACSMS (Automotive CyberSecurity Management System) audit. This paper explains the main strategy and content for ASPICE for Cybersecurity assessments and how such assessments are integrated to the overall ACSMS strategy. Also, the paper outlines an example method and tool used in ASPICE for cybersecurity assessments and how such assessment results will look like.

KW - capability adviser tool based assessment

KW - CSMS audit

KW - cybersecurity ASPICE assessment

KW - first experiences

UR - http://www.scopus.com/inward/record.url?scp=85143230094&partnerID=8YFLogxK

U2 - 10.1002/smr.2519

DO - 10.1002/smr.2519

M3 - Article

AN - SCOPUS:85143230094

SN - 2047-7481

JO - Journal of Software: Evolution and Process

JF - Journal of Software: Evolution and Process

ER -

Experiences with the automotive SPICE for cybersecurity assessment model and tools

Abstract

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this