Apply now
Master'sAutonomous, ADAS & Software-Defined Vehicle Applications open

Master’s in ISO 21434 and UNECE R155/R156 (CSMS/SUMS)

Online master's programme of 1,900 hours in automotive cybersecurity to ISO/SAE 21434 and UNECE R155/R156. 12 modules covering CSMS, TARA, secure architecture, cryptography, testing, vulnerability management, SUMS and type-approval audits, with an assigned technical tutor.

Duration12–14 months
ModeOnline
LanguageEnglish
Start datesSet by the faculty
AwardSEIUM Institute diploma
Enrol now View syllabus Ask an advisor
Virtual lab · try it before you enrol

Take the controls.

Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.

SIM · LIVE ●
Learning outcomes

What you will be able to do

01

Interpret the requirements of UNECE R155, R156 and ISO/SAE 21434.

02

Implement a cybersecurity management system within the organisation.

03

Carry out a threat analysis and risk assessment (TARA).

04

Design a secure vehicle architecture with appropriate cryptography.

05

Plan cybersecurity verification and testing.

06

Manage vulnerabilities, incidents and software updates.

07

Prepare the documentation for audit and type-approval.

Profile

Who it's for

  • Automotive cybersecurity engineers.
  • CSMS managers.
  • TARA analysts.
  • Vehicle penetration testing engineers.
  • Software update management (SUMS) managers.
  • Cybersecurity type-approval auditors.
  • Engineering or science graduates seeking to enter vehicle manufacturers.
Standards & tools

What you'll work with

  • ISO/SAE 21434 (road vehicle cybersecurity engineering)
  • UN Regulation No. 155 (CSMS)
  • UN Regulation No. 156 (SUMS)
  • ISO 24089 (software updates in road vehicles)
  • Regulation (EU) 2019/2144 (general safety type-approval)
  • ISO 26262 (functional safety)
  • ISO/IEC 27001 (information security management)
  • Vector CANoe
  • Ansys medini analyze
  • Wireshark
  • Python (Scapy)
  • Burp Suite
Syllabus

12 modules

  1. 1.1UNECE R155 and its scope of application
  2. 1.2UNECE R156 and update management
  3. 1.3Relationship with type-approval
  4. 1.4ISO/SAE 21434 as the state of the art
  5. 1.5Obligations of the manufacturer and the supply chain
  6. 1.6Application timeline in the European Union
  7. 1.7Audits by the type-approval authority
  8. 1.8Consequences of non-conformity
  9. 1.9Relationship with ISO 26262 and SOTIF
  10. 1.10Complete regulatory map of the project
  1. 2.1Scope and governance of the CSMS
  2. 2.2Policies, roles and responsibilities
  3. 2.3Processes across the whole life cycle
  4. 2.4Supplier and interface management
  5. 2.5Staff competence and training
  6. 2.6Configuration and version management
  7. 2.7Indicators and management review
  8. 2.8Evidence required by the auditor
  9. 2.9Preparing for the initial audit
  10. 2.10Workshop: documentary framework of a CSMS
  1. 3.1Identification of assets to be protected
  2. 3.2Threat scenarios and attack trees
  3. 3.3Impact assessment: safety, operational, financial and privacy
  4. 3.4Attack feasibility and methods
  5. 3.5Determination of the risk level
  6. 3.6Treatment decision: avoid, reduce, share or accept
  7. 3.7Cybersecurity goals and requirements
  8. 3.8Traceability from risk to requirement
  9. 3.9Review and maintenance of the TARA
  10. 3.10Case study: TARA of a telematics unit
  1. 4.1Domain segmentation and trust zones
  2. 4.2Gateways and control of flows between networks
  3. 4.3Attack surface and its reduction
  4. 4.4Principles of least privilege and defence in depth
  5. 4.5Secrets management and secure storage
  6. 4.6Secure elements and HSMs in automotive
  7. 4.7Message authentication on CAN: SecOC
  8. 4.8Ethernet protection: MACsec, TLS and IPsec
  9. 4.9In-vehicle intrusion detection
  10. 4.10Workshop: hardening an E/E architecture
  1. 5.1Symmetric primitives and their embedded use
  2. 5.2Digital signatures and certificates in the vehicle
  3. 5.3Public key infrastructure for a fleet
  4. 5.4Key provisioning in the factory and in aftersales
  5. 5.5Rotation, revocation and expiry
  6. 5.6Random number generation on MCUs
  7. 5.7Performance and real-time cost
  8. 5.8Side-channel resistance
  9. 5.9Crypto-agility and post-quantum readiness
  10. 5.10Lab: certificate chain for an ECU
  1. 6.1Level-based test strategy
  2. 6.2Functional testing of security mechanisms
  3. 6.3Static analysis and code review
  4. 6.4Fuzzing of interfaces and protocols
  5. 6.5Penetration testing on the bench and in the vehicle
  6. 6.6Hardware testing and physical access
  7. 6.7Acceptance criteria and coverage
  8. 6.8Management and closure of findings
  9. 6.9Reports for the authority
  10. 6.10Lab: fuzzing campaign on UDS
  1. 7.1Monitoring of sources and advisories
  2. 7.2Triage and exploitability assessment
  3. 7.3Response teams and escalation
  4. 7.4Communication with the authority and the customer
  5. 7.5Coordinated disclosure with researchers
  6. 7.6Emergency patching and temporary mitigations
  7. 7.7Incident logging and lessons learned
  8. 7.8Response time metrics
  9. 7.9Incident drills
  10. 7.10Workshop: response exercise for a critical vulnerability
  1. 8.1R156 requirements for the SUMS
  2. 8.2RXSWIN software identification
  3. 8.3Impact assessment of each update
  4. 8.4Compatibility with the current type-approval
  5. 8.5Security of the OTA campaign
  6. 8.6Consent, user information and vehicle conditions
  7. 8.7Rollback and handling of update failures
  8. 8.8Version records per vehicle
  9. 8.9Updates in aftersales and the workshop
  10. 8.10Lab: OTA campaign plan
  1. 9.1Cybersecurity interface agreements
  2. 9.2Allocation of responsibilities with suppliers
  3. 9.3Contractual requirements and evidence
  4. 9.4Software bill of materials (SBOM)
  5. 9.5Third-party and open-source components
  6. 9.6Supplier maturity assessment
  7. 9.7Second-party audits
  8. 9.8Change management for supplied components
  9. 9.9End of support and obsolescence
  10. 9.10Workshop: drafting a CIA with a supplier
  1. 10.1Monitoring of the fleet in service
  2. 10.2Security telemetry and privacy
  3. 10.3Secure diagnostics and workshop access
  4. 10.4Management of vehicles out of support
  5. 10.5Second life and change of ownership
  6. 10.6Secure erasure of personal data
  7. 10.7Spare parts and non-original parts
  8. 10.8Decommissioning and dismantling
  9. 10.9Residual obligations of the manufacturer
  10. 10.10Case study: end-of-support policy
  1. 11.1Preparation of the type-approval file
  2. 11.2CSMS and SUMS evidence per vehicle
  3. 11.3Relationship between the type file and projects
  4. 11.4Interviews and sampling during the audit
  5. 11.5Non-conformities and action plans
  6. 11.6Periodic surveillance and renewal
  7. 11.7Type-approval extensions
  8. 11.8Coordination between authorities in different countries
  9. 11.9Errors that delay a type-approval
  10. 11.10Mock audit
  1. 12.1Definition of the vehicle and its architecture
  2. 12.2Complete TARA of the chosen system
  3. 12.3Cybersecurity concept and derived requirements
  4. 12.4Design of countermeasures and their justification
  5. 12.5Verification plan and results
  6. 12.6Update plan and RXSWIN
  7. 12.7R155 and R156 audit file
  8. 12.8Residual risk analysis
  9. 12.9Report and defence before a panel
  10. 12.10Master's Thesis: final review with the tutor
Methodology, software & labs

How you'll learn

A 100% online programme on the SEIUM campus, with downloadable materials, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, so it fits around your job.

Each module combines theory, guided reading of the original standard and applied exercises. The working software is Vector CANoe, Ansys medini analyze, Wireshark, Python (Scapy) and Burp Suite, in free, academic or evaluation versions. Testing is studied through real procedures for TARA analysis of an architecture, penetration testing of in-vehicle networks and CSMS audits. Assessment is continuous by module, plus the final Master's Thesis.

Standards covered: ISO/SAE 21434, UN Regulation No. 155, UN Regulation No. 156, ISO 24089, Regulation (EU) 2019/2144, ISO 26262 and ISO/IEC 27001.

Assigned technical tutor:every module ends with a deliverable that your tutor marks individually.
Standards-based learning:guided reading of ISO/SAE 21434, UN Regulation No. 155 and UN Regulation No. 156 applied to real cases, not as a theoretical annex.
Industry software:Vector CANoe, Ansys medini analyze, Wireshark, Python (Scapy) and Burp Suite, in free, academic or evaluation versions.
Master's Thesis with defence:an integrated project covering the TARA, cybersecurity concept, verification and R155/R156 audit file for a chosen vehicle system, defended before a panel.
Flexible format:100% online, no fixed timetables, compatible with full-time work.
Capstone project

Build it end to end

Your final project follows the real engineering workflow, step by step, reviewed by your tutor.

TARA of a telematics unit
Carry out a complete threat analysis and risk assessment for a telematics control unit.
Hardening an E/E architecture
Apply segmentation, SecOC and secure communication to harden a vehicle E/E architecture.
UDS fuzzing campaign
Plan and run a fuzzing campaign on a UDS diagnostic interface and manage the findings.
OTA campaign plan
Design a secure OTA update campaign compliant with the R156 SUMS requirements.
Master's Thesis
Build an integrated cybersecurity and R155/R156 audit file for a chosen vehicle system, defended before a panel.
Career opportunities

Where this takes you

Automotive cybersecurity engineerCSMS managerTARA analystVehicle penetration testing engineerSoftware update management (SUMS) managerCybersecurity type-approval auditor
Admissions & scholarships

Requirements

  • University degree in engineering, science or architecture, or equivalent demonstrable professional experience.
  • Internet connection and a computer capable of running the programme's software.
  • English sufficient to read technical standards.

Ready to start?

Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.

Apply now Scholarships
FAQ

Frequently asked questions

The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.

You will work with Vector CANoe, Ansys medini analyze, Wireshark, Python (Scapy) and Burp Suite. Free, academic or evaluation versions are used, and your tutor indicates the free alternative where one exists.

A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.

Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.

A university degree in engineering, science or architecture, or equivalent professional experience; a computer able to run the programme's software; and English sufficient to read technical standards.

Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.

Keep exploring

Related programmes

See all in Autonomous, ADAS & Software-Defined Vehicle
Master's7,730 $

Master’s in Event, Thermal and Multispectral Camera Engineering

Online master's programme of 1,900 hours in event, thermal and multispectral camera engineering, structured in 12 modules covering unconventional image sensors, event-data processing, infrared thermography, multispectral…

1900 hOnlineAutonomous, ADAS & Software-Defined Vehicle
Master's6,610 $

Master’s in Vulnerable Road User Detection and Urban Safety Engineering

Online master's programme of 1,900 hours in vulnerable road user detection and urban safety, structured in 12 modules covering sensing, detection and intention prediction of pedestrians…

1900 hOnlineAutonomous, ADAS & Software-Defined Vehicle
Master's9,970 $

Master’s in Runtime Monitoring Engineering

Online master's programme of 1,900 hours in runtime monitoring engineering, structured in 12 modules covering runtime verification with temporal logic, perception, planning and ODD monitoring, safe…

1900 hOnlineAutonomous, ADAS & Software-Defined Vehicle
Master’s in ISO 21434 and UNECE R155/R156 (CSMS/SUMS)Enrol
Related programmes

More in Autonomous, ADAS & Software-Defined Vehicle

Master’s in Optimal Control and MPC for Autonomous VehiclesView programme →Master’s in Human Factors & HMI EngineeringView programme →Master’s in HARA, ASIL & Safety Case EngineeringView programme →Master’s in Reinforcement and Imitation Learning Engineering for DrivingView programme →Master’s in Optimal Control and MPC Engineering for Autonomous Vehicles — Constraints, Robustness and Real TimeView programme →Master’s in Autonomous Urban Buses and Shuttles EngineeringView programme →

All Autonomous, ADAS & Software-Defined Vehicle programmes → · How to apply · Fees & financing · Scholarships

Scroll to Top
SEIUM – Institute of Advanced Engineering
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.