R155 and R156 Course: Cybersecurity and OTA Updates
Online course of 300 hours in UN R155 and R156: vehicle cybersecurity and OTA updates. 6 modules covering the vehicle cybersecurity context, UN Regulation No. 155 and the CSMS, ISO/SAE 21434 cybersecurity engineering, UN Regulation No. 156 and software updates, technical implementation and evidence, with an assigned technical tutor.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Understand the context and threats of vehicle cybersecurity.
Apply the requirements of UN Regulation No. 155 and the CSMS.
Carry out TARA in accordance with ISO/SAE 21434.
Implement a software update management system compliant with UN Regulation No. 156.
Design secure and traceable OTA updates.
Prepare technical evidence for type approval and audit.
Develop an R155 and R156 compliance plan for a vehicle.
Who it's for
- Automotive cybersecurity engineers
- CSMS managers at vehicle manufacturers
- Homologation engineers
- Embedded software architects
- Vehicle vulnerability analysts
- Cybersecurity auditors
- Engineering or science graduates looking to join vehicle manufacturers
What you'll work with
- UN Regulation No. 155 (cybersecurity and cybersecurity management system)
- UN Regulation No. 156 (software update and software update management system)
- ISO/SAE 21434 (road vehicles cybersecurity engineering)
- ISO 24089 (road vehicles software update engineering)
- ISO/PAS 5112 (guidelines for auditing cybersecurity engineering)
- Regulation (EU) 2019/2144 (General Safety Regulation)
- Regulation (EU) 2018/858 (EU vehicle type-approval framework)
- ISO 26262 (road vehicles functional safety)
- Vector CANoe
- Wireshark
- ETAS ESCRYPT CycurRISK
- Microsoft Threat Modeling Tool
6 modules · 300 h
1.1The connected vehicle and its attack surface1.2Known incidents and vulnerabilities1.3Electrical and electronic architecture1.4CAN and Ethernet buses and gateways1.5Telematics connectivity and V2X1.6Origin of the regulations in WP.291.7Relationship between R155, R156 and ISO/SAE 214341.8Mandatory application in the EU from 2022 and 20241.9Supply chain and responsibilities1.10Case study: analysis of a published remote attack
2.1The cybersecurity management system2.2The manufacturer's CSMS certificate2.3Vehicle type approval for cybersecurity2.4Annex 5: threats and mitigations2.5The interpretation document2.6Monitoring of the fleet in service2.7Cybersecurity incident response2.8Supplier management2.9Audit by the approval authority2.10Workshop: mapping Annex 5 threats
3.1Item cybersecurity concept3.2TARA threat analysis and risk assessment3.3Assets, damage scenarios and attack paths3.4CAL assurance levels3.5Cybersecurity goals and requirements3.6Secure design and defence in depth3.7Verification and penetration testing3.8Vulnerability management3.9End of support and decommissioning3.10Practical exercise: TARA of a telematics control unit
4.1The software update management system4.2The RXSWIN software identifier4.3Wired and OTA updates4.4Safety requirements during the update4.5Information to the user4.6Compatibility and dependencies4.7The ISO 24089 standard4.8Configuration records4.9Impact on the existing type approval4.10Lab: secure OTA update workflow
5.1Secure boot and hardware security modules5.2Software signing and encryption5.3Secure communications with SecOC5.4In-vehicle intrusion detection5.5Vehicle security operations centre5.6Evidence for the technical service5.7Audits to ISO/PAS 51125.8Cybersecurity in heavy vehicles5.9Evolution of the requirements5.10Case study: preparing a CSMS audit
6.1Definition of the vehicle and its architecture6.2Scope of the CSMS6.3TARA of the vehicle6.4Mitigation measures6.5Update plan6.6In-service monitoring plan6.7Evidence file6.8Certification roadmap6.9Report and presentation6.10Final project: final review with the tutor
How you'll learn
100% online study on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, so the programme fits around your job.
Each module combines theory, guided reading of the original standards and applied exercises. The working software is Vector CANoe, Wireshark, ETAS ESCRYPT CycurRISK and Microsoft Threat Modeling Tool, in free, academic or evaluation versions. Practical work is based on real procedures: TARA of a connected component, design of a secure OTA update process and preparation of evidence for a CSMS audit. Assessment is continuous, module by module, plus the final project.
Standards covered: UN Regulation No. 155; UN Regulation No. 156; ISO/SAE 21434; ISO 24089; ISO/PAS 5112; Regulation (EU) 2019/2144; Regulation (EU) 2018/858; ISO 26262.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- No prior qualification is required.
- An internet connection and a computer able to run the programme software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 300 hours over 3 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with Vector CANoe, Wireshark, ETAS ESCRYPT CycurRISK and Microsoft Threat Modeling Tool, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute certificate, awarded on passing the continuous assessment and the final project. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed are recognised in a higher programme in the same area (postgraduate diploma or master's). Ask about the recognition policy when you enrol.
No prior qualification is required; you need a computer able to run the programme software and English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Course in Maritime Casualty Investigation
Online 300-hour course in maritime casualty investigation. 6 modules covering the IMO Casualty Investigation Code (Res. MSC.255(84)), Regulation (EU) 1286/2011 (common investigation methodology) and Kongsberg K-Sim.…
NOBO/DeBo Course in Railway Projects
Online 300 h course in NOBO/DeBo in railway projects. 6 modules covering Directive (EU) 2016/797 (railway interoperability), Decision 2010/713/EU (conformity assessment modules) and IBM DOORS. Assigned…
FMVSS Homologation Course in the US
Online course of 300 hours in FMVSS vehicle certification in the USA. 6 modules covering the US vehicle safety regulatory system, FMVSS crash avoidance and crashworthiness…
More in Regulation, Safety, RAMS & Homologation
All Regulation, Safety, RAMS & Homologation programmes → · How to apply · Fees & financing · Scholarships