• Defining a complete lifecycle process framework that can be tailored and utilized within each organization’s development processes to incorporate Cybersecurity into cyber-physical vehicle systems from concept phase through production, operation, service, and decommissioning.
• Providing information on some common existing tools and methods used when designing, verifying and validating cyber-physical vehicle systems.
• Providing basic guiding principles on Cybersecurity for vehicle systems.
• Providing the foundation for further standards development activities in vehicle Cybersecurity.

1. Appendices A–C – Describe some techniques for Threat Analysis and Risk Assessment, Threat Modeling and Vulnerability Analysis (e.g., Attack Trees) and when to use them.
2. Appendices D–I – Provide awareness of information that is available to the Vehicle Industry.
3. Appendix D – Provides an overview of sample Cybersecurity and privacy controls derived from NIST SP 800-53 that may be considered in design phases.
4. Appendix E – Provides references to some available vulnerability databases and vulnerability classification schemes.
5. Appendix F – Describes vehicle-level considerations, including some good design practices for electrical architecture.
6. Appendix G -Lists current Cybersecurity standards and guidelines of potential interest to the vehicle industry.
7. Appendix H – Provides an overview of vehicle Cybersecurity-related research projects starting from 2004.
8. Appendix I – Describes some existing security test tools of potential interest to the vehicle industry.

— virtual machines (VMs) and hypervisors;

— containers and container management systems (CMSs);

— serverless computing;

— microservices architecture;

— automation;

— platform as a service systems and architecture;

— storage services;

— security, scalability and networking as applied to the above cloud computing technologies.

1)    role and responsibilities of parties conducting audit and description of the interactions between the CSC, CSP, and CSN;

2)    approaches for conducting audits of cloud services to facilitate confidence in delivering and using cloud services;

3)    examples of available frameworks and standards which can be used for audit schemes, for certification, and for authorization.

This document builds upon the cloud auditor role as defined in ISO/IEC 17789 and ISO/IEC 22123.

This document is applicable to all types and sizes of organizations that need to plan and conduct internal or external audits, and that use, provide and support cloud services.

This document is not intended to describe certification or to identify controls that are published elsewhere.

It includes a domain-independent technical framework, addressing functional requirements and non-functional requirements.

— concept of edge computing systems;

— architectural foundation of edge computing;

— edge computing terminology;

— software classifications in edge computing, e.g. firmware, services, applications;

— supporting technologies, e.g. containers, serverless computing, microservices;

— networking for edge systems, including virtual networks;

— data, e.g. data flow, data storage, data processing;

— management, of software, of data and of networks, resources, quality of service;

— virtual placement of software and data, and metadata;

— security and privacy;

— real time;

— mobile edge computing, mobile devices.

— definition of terms and concepts, and provision of an overview for interactions between CSNs and CSCs and CSPs;

— description of types of CSN interactions;

— description of interactions between CSNs and CSCs;

— description of interactions between CSNs and CSPs;

— description of elements of CSAs and Cloud SLAs for CSN interactions, both with CSPs and with CSCs.

1) an ID triggered modular access system, the functions of the modules and the messages they exchange, and the sequence of messages, i.e. transitions of the transaction;

2) the system responsibility from receiving an access request until sending the result. i.e. a complete transaction;

3) the responsibilities of the modules, including time stamping and responding to the requests they received; and

4) the sequence and semantics of the messages and their elements.