Apply now
Master'sAutonomous, ADAS & Software-Defined Vehicle Applications open

Master’s in ISO 21434 and UNECE R155/R156 Engineering — CSMS, SUMS, Threat Modelling and Secure Updates

Online master's programme of 1,900 hours in ISO 21434 and UNECE R155/R156 engineering, structured in 12 modules covering vehicle cybersecurity, threat modelling and TARA, CSMS under R155, SUMS under R156, security architecture, secure updates with Uptane, cybersecurity testing, VSOC operations, supply chain and global regulation, with an assigned technical tutor.

Duration1900 h
ModeOnline
LanguageEnglish
Start datesSet by the faculty
AwardSEIUM Institute diploma
Enrol now View syllabus Ask an advisor
Virtual lab · try it before you enrol

Take the controls.

Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.

SIM · LIVE ●
Learning outcomes

What you will be able to do

01

Apply the ISO/SAE 21434 cybersecurity lifecycle.

02

Carry out threat analysis and risk assessment (TARA).

03

Implement CSMS and SUMS in accordance with R155 and R156.

04

Design vehicle security architectures.

05

Implement secure updates with Uptane.

06

Plan cybersecurity testing and VSOC operations.

07

Develop a complete vehicle cybersecurity project.

Profile

Who it's for

  • Automotive cybersecurity engineers applying ISO/SAE 21434 in product development.
  • Threat analysts carrying out TARA on vehicle systems.
  • Vehicle penetration testers assessing ECUs, interfaces and backends.
  • CSMS managers preparing organisations for R155 and R156 audits.
  • VSOC analysts monitoring fleets and responding to incidents.
  • Security architects designing defence in depth for the vehicle.
  • Engineering or science graduates aiming to enter the automotive sector.
Standards & tools

What you'll work with

  • ISO/SAE 21434 (road vehicle cybersecurity engineering)
  • UN ECE R155 (cybersecurity management system)
  • UN ECE R156 (software update management system)
  • ISO 24089 (software update engineering)
  • ISO/PAS 5112 (guidelines for auditing cybersecurity engineering)
  • GB 44495 (Chinese vehicle cybersecurity requirements)
  • Regulation (EU) 2024/2847 (Cyber Resilience Act)
  • SAE J3061 (cybersecurity guidebook for cyber-physical vehicle systems)
  • Vector CANoe
  • ANSYS medini analyze
  • Wireshark
  • Uptane
  • Ghidra
Syllabus

12 modules · 1900 h

  1. 1.1Evolution of threats to the vehicle
  2. 1.2Attack surface of the connected vehicle
  3. 1.3Documented attacks on vehicles
  4. 1.4E/E architecture and security
  5. 1.5Threat actors and motivations
  6. 1.6Impact on safety and privacy
  7. 1.7Backend ecosystem and services
  8. 1.8Regulation as a driver of change
  9. 1.9Organising cybersecurity
  10. 1.10Case study: analysis of the Jeep Cherokee attack
  1. 2.1Scope and structure of the standard
  2. 2.2Policies and organisational management
  3. 2.3Cybersecurity project management
  4. 2.4Distributed activities with suppliers
  5. 2.5Continual cybersecurity activities
  6. 2.6Cybersecurity concept
  7. 2.7Product development
  8. 2.8Cybersecurity validation
  9. 2.9Production, operations and end of life
  10. 2.10Lab: project cybersecurity plan
  1. 3.1Asset identification
  2. 3.2Damage scenarios
  3. 3.3Threat scenarios
  4. 3.4The STRIDE threat model
  5. 3.5Attack trees
  6. 3.6Attack feasibility
  7. 3.7Safety, financial and privacy impact
  8. 3.8Risk determination
  9. 3.9Risk treatment
  10. 3.10Practical exercise: complete TARA of an ECU
  1. 4.1Requirements of Regulation R155
  2. 4.2The CSMS management system
  3. 4.3Annex 5 threats and mitigations
  4. 4.4CSMS assessment
  5. 4.5Vehicle type approval
  6. 4.6Supply chain management
  7. 4.7Monitoring and response
  8. 4.8Reporting to the authority
  9. 4.9Interpretation with ISO/PAS 5112
  10. 4.10Workshop: simulated CSMS audit
  1. 5.1Requirements of Regulation R156
  2. 5.2The SUMS management system
  3. 5.3The RXSWIN software identifier
  4. 5.4OTA and workshop updates
  5. 5.5Impact assessment of updates
  6. 5.6Update security
  7. 5.7Information to the user
  8. 5.8Integration with ISO 24089
  9. 5.9Records and traceability
  10. 5.10Lab: SUMS process for an update
  1. 6.1Defence in depth
  2. 6.2Network segmentation
  3. 6.3Secure gateways with filtering
  4. 6.4Secure communication with SecOC
  5. 6.5Secure boot and root of trust
  6. 6.6Hardware security modules (HSM)
  7. 6.7Key management
  8. 6.8Secure diagnostics with authentication
  9. 6.9Ethernet security
  10. 6.10Practical exercise: secure architecture design
  1. 7.1End-to-end OTA architecture
  2. 7.2The Uptane framework and its architecture
  3. 7.3Package signing and encryption
  4. 7.4Metadata and roles
  5. 7.5Rollback protection
  6. 7.6Differential updates and compression
  7. 7.7Failure recovery
  8. 7.8OTA backend security
  9. 7.9Update testing
  10. 7.10Workshop: Uptane implementation
  1. 8.1Penetration testing
  2. 8.2Protocol fuzzing
  3. 8.3Firmware analysis
  4. 8.4Wireless interface testing
  5. 8.5Diagnostics testing
  6. 8.6Backend testing
  7. 8.7Testing tools
  8. 8.8Findings management
  9. 8.9Test reports
  10. 8.10Lab: CAN fuzzing
  1. 9.1Fleet monitoring
  2. 9.2Vehicle security operations centres (VSOC)
  3. 9.3Intrusion detection
  4. 9.4Vulnerability management
  5. 9.5Incident response
  6. 9.6Threat intelligence
  7. 9.7Information sharing in Auto-ISAC
  8. 9.8Coordinated vulnerability disclosure
  9. 9.9Operational metrics
  10. 9.10Case study: responding to a fleet vulnerability
  1. 10.1Cybersecurity interface agreements
  2. 10.2Requirements for suppliers
  3. 10.3Supplier assessment
  4. 10.4Software inventory (SBOM)
  5. 10.5Open-source components
  6. 10.6TISAX certification of suppliers
  7. 10.7Cybersecurity audits of suppliers
  8. 10.8Management of legacy components
  9. 10.9Allocation of contractual responsibilities
  10. 10.10Practical exercise: CIA with a supplier
  1. 11.1China's GB 44495 standard
  2. 11.2Regulation in the USA
  3. 11.3Regulation in Japan and Korea
  4. 11.4Cyber Resilience Act
  5. 11.5NIS2 in automotive
  6. 11.6Data Act
  7. 11.7Vehicle data privacy
  8. 11.8Harmonisation across jurisdictions
  9. 11.9Global regulatory trends
  10. 11.10Workshop: regulatory comparison
  1. 12.1Item definition
  2. 12.2TARA of the item
  3. 12.3Cybersecurity concept of the item
  4. 12.4Security architecture
  5. 12.5SUMS update process
  6. 12.6Test plan
  7. 12.7Operations plan
  8. 12.8Conclusions and future work
  9. 12.9Thesis report
  10. 12.10Master's Thesis: defence before a panel
Methodology, software & labs

How you'll learn

Training is 100% online on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within the intake, so the programme can be combined with work.

Each module combines theory, guided reading of the original standard and applied exercises. The working software is Vector CANoe, ANSYS medini analyze, Wireshark, Uptane and Ghidra, in free, academic or evaluation versions. Exercises are based on real procedures for TARA of vehicle systems, penetration testing of ECUs and CSMS and SUMS audits. Assessment is continuous by module, plus the final Master's Thesis.

Standards covered: ISO/SAE 21434, UN ECE R155, UN ECE R156, ISO 24089, ISO/PAS 5112, GB 44495, Regulation (EU) 2024/2847 (Cyber Resilience Act), SAE J3061.

Assigned technical tutor:every module ends with a deliverable that your tutor marks individually.
Standards-based learning:guided reading of ISO/SAE 21434, UN ECE R155 and UN ECE R156 applied to real cases, not as a theoretical annex.
Industry software:Vector CANoe, ANSYS medini analyze, Wireshark, Uptane and Ghidra, in free, academic or evaluation versions.
Master's Thesis with defence:A complete vehicle cybersecurity project, from item definition and TARA to the cybersecurity concept, security architecture, SUMS update process and test and operations plans, defended before a panel.
Flexible format:100% online, no fixed timetables, compatible with full-time work.
Capstone project

Build it end to end

Your final project follows the real engineering workflow, step by step, reviewed by your tutor.

Define the item
Describe the vehicle system, its interfaces and assets.
Carry out the TARA
Identify damage and threat scenarios, assess feasibility and treat the risk.
Design concept and architecture
Set cybersecurity goals and design the security architecture with SecOC, HSM and secure boot.
Plan updates and testing
Define the SUMS update process and the penetration and fuzzing test plan.
Master's Thesis
Complete the operations plan and overall cybersecurity case, defended before a panel.
Career opportunities

Where this takes you

Automotive Cybersecurity EngineerThreat AnalystVehicle Penetration TesterCSMS ManagerVSOC AnalystSecurity Architect
Admissions & scholarships

Requirements

  • A university degree in engineering, science or architecture, or equivalent demonstrable professional experience.
  • An internet connection and a computer capable of running the programme's software.
  • English sufficient to read technical standards.

Ready to start?

Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.

Apply now Scholarships
FAQ

Frequently asked questions

The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.

You work with Vector CANoe, ANSYS medini analyze, Wireshark, Uptane and Ghidra, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.

A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.

Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.

A university degree in engineering, science or architecture (or equivalent professional experience), a computer able to run the programme's software and English sufficient to read technical standards.

Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.

Keep exploring

Related programmes

See all in Autonomous, ADAS & Software-Defined Vehicle
Master's6,610 $

Master’s in Risk-Based Scenarios and PEGASUS-Like Engineering

Online master's programme of 1,900 hours in risk-based and PEGASUS-like scenario engineering, structured in 12 modules covering scenario sources and modelling, risk analysis, sampling and critical…

1900 hOnlineAutonomous, ADAS & Software-Defined Vehicle
Master's7,730 $

Master’s in Event, Thermal and Multispectral Camera Engineering

Online master's programme of 1,900 hours in event, thermal and multispectral camera engineering, structured in 12 modules covering unconventional image sensors, event-data processing, infrared thermography, multispectral…

1900 hOnlineAutonomous, ADAS & Software-Defined Vehicle
Master's9,970 $

Master’s in Planning, Decision & Control Engineering

Online master's programme of 1,900 hours in planning, decision-making and control engineering for automated driving, structured in 12 modules covering decision and control architecture, route planning,…

1900 hOnlineAutonomous, ADAS & Software-Defined Vehicle
Master’s in ISO 21434 and UNECE R155/R156 Engineering — CSMS, SUMS, Threat Modelling and Secure UpdatesEnrol
Related programmes

More in Autonomous, ADAS & Software-Defined Vehicle

Master’s in Event, Thermal and Multispectral Camera EngineeringView programme →Master’s in Product, Regulation & Business EngineeringView programme →Master’s in Dev Platforms Engineering for SDVs — Vehicle-Centric APIs, App Stores, Sandboxing and PermissionsView programme →Master’s in Advanced Radar and LiDAR Processing EngineeringView programme →Master’s in Heterogeneous Computing Engineering for AD — CPU/GPU/NPUs, Scheduling, Thermal/Power BudgetingView programme →Master’s in Perception & Sensors EngineeringView programme →

All Autonomous, ADAS & Software-Defined Vehicle programmes → · How to apply · Fees & financing · Scholarships

Scroll to Top
SEIUM – Institute of Advanced Engineering
Powered by  GDPR Cookie Compliance
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.