Apply now
Master'sRegulation, Safety, RAMS & Homologation Applications open

Master’s in CSMS/SUMS Engineering, Audits and Vulnerability Management.

Online master's programme of 1,900 hours in CSMS/SUMS engineering, audits and vulnerability management. 12 modules covering UN Regulation No. 155 (CSMS), UN Regulation No. 156 (SUMS), ISO/SAE 21434, TISAX, PSIRT and fleet monitoring, with an assigned technical tutor.

Duration1900 h
ModeOnline
LanguageEnglish
Start datesSet by the faculty
AwardSEIUM Institute diploma
Enrol now View syllabus Ask an advisor
Virtual lab · try it before you enrol

Take the controls.

Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.

SIM · LIVE ●
Learning outcomes

What you will be able to do

01

Design cybersecurity and software update management systems.

02

Manage cybersecurity across the supply chain.

03

Prepare for and pass CSMS audits.

04

Implement vulnerability management processes.

05

Coordinate incident response and disclosure.

06

Monitor the cybersecurity of fleets in service.

07

Measure and improve organisational cybersecurity maturity.

Profile

Who it's for

  • CSMS managers responsible for an organisation's cybersecurity management system.
  • Automotive cybersecurity auditors.
  • Product vulnerability managers.
  • PSIRT coordinators.
  • R155/R156 compliance consultants.
  • VSOC analysts looking to broaden their view of the regulatory framework.
  • Engineering or science graduates seeking to enter the automotive sector.
Standards & tools

What you'll work with

  • UN Regulation No. 155 (cybersecurity management system)
  • UN Regulation No. 156 (software update management system)
  • ISO/SAE 21434:2021 (road vehicle cybersecurity engineering)
  • ISO 24089:2023 (road vehicle software update engineering)
  • ISO/PAS 5112:2022 (guidelines for auditing cybersecurity engineering)
  • VDA ISA / TISAX (automotive information security assessment)
  • ISO/IEC 27001:2022 (information security management systems)
  • Automotive SPICE for Cybersecurity (process maturity assessment)
  • Jira
  • Polarion
  • Dependency-Track
  • Black Duck
  • Splunk
Syllabus

12 modules · 1900 h

  1. 1.1The CSMS management system concept
  2. 1.2The SUMS management system concept
  3. 1.3Requirements of R155 and R156
  4. 1.4Relationship with ISO/SAE 21434 and ISO 24089
  5. 1.5Organisational and product scope
  6. 1.6CSMS certificate of compliance
  7. 1.7Certificate life cycle
  8. 1.8Roles within the organisation
  9. 1.9Cybersecurity governance
  10. 1.10Case study: analysis of a manufacturer's CSMS structure
  1. 2.1Cybersecurity policy
  2. 2.2Secure development processes
  3. 2.3Organisational risk management
  4. 2.4Supplier management
  5. 2.5Competences and training
  6. 2.6Documentation management
  7. 2.7Support tools
  8. 2.8System indicators
  9. 2.9Continuous improvement of the system
  10. 2.10Practical exercise: process map of a CSMS
  1. 3.1Update management processes
  2. 3.2RXSWIN software identification
  3. 3.3Update impact assessment
  4. 3.4Configuration compatibility
  5. 3.5Security of the distribution process
  6. 3.6User information
  7. 3.7Updates affecting type approval
  8. 3.8Records and traceability
  9. 3.9SUMS audit
  10. 3.10Lab: assessing the impact of an update on type approval
  1. 4.1Cybersecurity interface with suppliers
  2. 4.2Distributed development agreements
  3. 4.3Contractual cybersecurity requirements
  4. 4.4Supplier assessment
  5. 4.5Software bill of materials
  6. 4.6Open-source components
  7. 4.7Tracking third-party vulnerabilities
  8. 4.8Supplier audits
  9. 4.9Responsibilities shared with suppliers
  10. 4.10Practical exercise: cybersecurity interface agreement template
  1. 5.1Preparing for the approval authority audit
  2. 5.2Evidence required by the authority
  3. 5.3Interviews and sampling
  4. 5.4Findings and non-conformities
  5. 5.5Corrective action plans
  6. 5.6Internal system audits
  7. 5.7Surveillance audits
  8. 5.8Certificate renewal
  9. 5.9Lessons from real audits
  10. 5.10Workshop: simulated audit of a CSMS
  1. 6.1VDA ISA and TISAX
  2. 6.2Assessment levels
  3. 6.3Prototype protection
  4. 6.4Data protection
  5. 6.5Relationship with ISO/IEC 27001
  6. 6.6Preparing for the assessment
  7. 6.7Managing TISAX labels
  8. 6.8Integration with the CSMS
  9. 6.9Cost and planning
  10. 6.10Case study: TISAX preparation plan for a supplier
  1. 7.1Sources of vulnerabilities
  2. 7.2CVE monitoring
  3. 7.3Relevance analysis
  4. 7.4Vulnerability risk assessment
  5. 7.5CVSS and its automotive adaptation
  6. 7.6Treatment and prioritisation
  7. 7.7Fleet patching
  8. 7.8Communication to customers
  9. 7.9Management metrics
  10. 7.10Lab: vulnerability triage on an SBOM
  1. 8.1Coordinated disclosure policies
  2. 8.2Bug bounty programmes
  3. 8.3Relationship with researchers
  4. 8.4Incident management
  5. 8.5Product PSIRT teams
  6. 8.6Coordination with suppliers
  7. 8.7Notification to authorities and type-approval bodies
  8. 8.8Public communication of incidents
  9. 8.9Lessons learned from incidents
  10. 8.10Practical exercise: PSIRT procedure for a disclosed vulnerability
  1. 9.1Monitoring in the post-production phase
  2. 9.2Vehicle security events
  3. 9.3VSOC architecture
  4. 9.4Event correlation
  5. 9.5Threat intelligence
  6. 9.6Auto-ISAC and information sharing
  7. 9.7Indicators of compromise
  8. 9.8Reporting to the authority
  9. 9.9Incident escalation
  10. 9.10Case study: a VSOC for a fleet of 500,000 vehicles
  1. 10.1Cybersecurity work products
  2. 10.2Cybersecurity case
  3. 10.3Requirements traceability
  4. 10.4TARA reports
  5. 10.5Test reports
  6. 10.6Cybersecurity assessment
  7. 10.7Configuration management
  8. 10.8Evidence management tools
  9. 10.9Documentation quality
  10. 10.10Workshop: building a cybersecurity case
  1. 11.1Cybersecurity maturity models
  2. 11.2Automotive SPICE for cybersecurity
  3. 11.3Key performance indicators
  4. 11.4Management dashboards
  5. 11.5Sector maturity benchmarking
  6. 11.6Security culture
  7. 11.7Ongoing staff training
  8. 11.8Management reviews
  9. 11.9Improvement roadmap
  10. 11.10Practical exercise: maturity assessment with Automotive SPICE for Cybersecurity
  1. 12.1Defining the organisational scope
  2. 12.2Diagnosis of the current state
  3. 12.3CSMS and SUMS design
  4. 12.4Supplier management
  5. 12.5Vulnerability process
  6. 12.6Audit plan
  7. 12.7Indicators and improvement
  8. 12.8Conclusions and future work
  9. 12.9Master's Thesis report
  10. 12.10Master's Thesis: defence before a panel
Methodology, software & labs

How you'll learn

100% online learning on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, making it compatible with work.

Each module combines theory, guided reading of the original standard and applied exercises. The working software is Jira, Polarion, Dependency-Track, Black Duck and Splunk, in free, academic or evaluation versions. Practical work is based on real procedures from simulated CSMS audits, vulnerability triage on software bills of materials and the design of PSIRT response processes. Assessment is continuous for each module, plus the final Master's Thesis.

Standards covered: UN Regulation No. 155 (CSMS), UN Regulation No. 156 (SUMS), ISO/SAE 21434:2021, ISO 24089:2023, ISO/PAS 5112:2022, VDA ISA / TISAX, ISO/IEC 27001:2022 and Automotive SPICE for Cybersecurity.

Assigned technical tutor:every module ends with a deliverable that your tutor marks individually.
Standards-based learning:guided reading of UN R155, UN R156 and ISO/SAE 21434 applied to real cases, not as a theoretical annex.
Industry software:Jira, Polarion, Dependency-Track, Black Duck and Splunk, in free, academic or evaluation versions.
Master's Thesis with defence:design of a complete CSMS and SUMS for an organisation, including supplier management, vulnerability process and audit plan, defended before a panel.
Flexible format:100% online, no fixed timetables, compatible with full-time work.
Capstone project

Build it end to end

Your final project follows the real engineering workflow, step by step, reviewed by your tutor.

Analyse a CSMS structure
Analyse how a manufacturer organises its CSMS and map its processes.
Assess update impact
Evaluate the impact of a software update on type approval under the SUMS.
Simulate a CSMS audit
Run a simulated authority audit of a CSMS and draft corrective action plans.
Triage and respond
Triage vulnerabilities on an SBOM and define the PSIRT procedure for a disclosed vulnerability.
Master's Thesis
Design a complete CSMS and SUMS for an organisation, with audit plan and improvement indicators, defended before a panel.
Career opportunities

Where this takes you

CSMS ManagerAutomotive Cybersecurity AuditorProduct Vulnerability ManagerPSIRT CoordinatorR155/R156 Compliance ConsultantVSOC Analyst
Admissions & scholarships

Requirements

  • A university degree in engineering, science or architecture, or equivalent demonstrable professional experience.
  • An internet connection and a computer capable of running the programme software.
  • English sufficient to read technical standards.

Ready to start?

Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.

Apply now Scholarships
FAQ

Frequently asked questions

The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.

You work with Jira, Polarion, Dependency-Track, Black Duck and Splunk, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.

A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.

Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.

A university degree in engineering, science or architecture (or equivalent professional experience), a computer able to run the programme software and English sufficient to read technical standards.

Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.

Keep exploring

Related programmes

See all in Regulation, Safety, RAMS & Homologation
Master's9,970 $

Master’s in Type-Approval Routes Engineering: C-NCAP/JNCAP/KNCAP, Import and Localisation

Online master's programme of 1,900 hours in regulatory route engineering for C-NCAP, JNCAP and KNCAP, importation and localisation. 12 modules covering the C-NCAP 2024 management regulation,…

1900 hOnlineRegulation, Safety, RAMS & Homologation
Master's11,090 $

Master’s in Electric Vehicle and Infrastructure Type-Approval Engineering

Online master's programme of 1,900 hours in electric vehicle and charging infrastructure type-approval engineering. 12 modules covering UN R100 electric powertrain safety, Regulation (EU) 2023/1542 on…

1900 hOnlineRegulation, Safety, RAMS & Homologation
Master's8,850 $

Master’s in Railway Certification Engineering

Online master's programme of 1,900 hours in railway certification engineering, structured in 12 modules covering the railway system and its regulation, vehicle authorisation, rolling stock and…

1900 hOnlineRegulation, Safety, RAMS & Homologation
Master’s in CSMS/SUMS Engineering, Audits and Vulnerability Management.Enrol
Related programmes

More in Regulation, Safety, RAMS & Homologation

Master’s in Audit Engineering, Change Control, Recalls, Post-Market Surveillance.View programme →Master’s in Type-Approval Routes Engineering: US NCAP, CARB, Labelling & RecallsView programme →Master’s in Active/Passive Safety Engineering, ADAS & Autonomous VehiclesView programme →Master’s in Route Engineering: EU vs US vs China Requirements.View programme →Master’s in Type-Approval Routes Engineering: ANCAP, Permits and ImportView programme →Master’s in Route Engineering: Country-by-Country Implementation.View programme →

All Regulation, Safety, RAMS & Homologation programmes → · How to apply · Fees & financing · Scholarships

Scroll to Top
SEIUM – Institute of Advanced Engineering
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.