UNECE R155
Cyber Security Management System: risk register, vulnerabilities, Annex 5 threats and mitigations.
UNECE R155 · R156 · ISO/SAE 21434 · ISO 24089
Vehicle cybersecurity and software update compliance, in one platform.
Omolia connects your CSMS and SUMS processes to the vehicles, ECUs, firmware and OTA campaigns they govern, and keeps the evidence ready for the technical service and the type-approval authority.
- R155 and R156 audit documentation written from your process
- Traceability from vehicle type to firmware
- Multi-tenant, SSO and MFA ready
- documents in the R155 and R156 catalogue
- 59
- compliance matrix requirements, linked to the documents
- 58
- languages for interface and documents
- IT · EN
- click to download the audit pack
- 1
Built around the regulations you are audited on
Each requirement is a living item in the platform, with an owner, a status and the evidence that proves it.
UNECE R156
Software Update Management System: RXSWIN, update procedures, impact assessments and OTA campaigns.
ISO/SAE 21434
Cybersecurity engineering across the lifecycle, with TARA results imported and traced to the vehicle.
ISO 24089
Software update engineering: packages, signatures, compatibility and rollback validated before release.
Deadlines
R155 and R156 are no longer a future project.
The dates that matter to anyone type-approving vehicles in the European Union, and the commitments that come back after approval.
July 2022
New vehicle types
R155 and R156 become mandatory in the EU for the type approval of new vehicle types.
July 2024
All new vehicles
The obligation extends to every newly registered vehicle, including types approved earlier.
Every 3 years
Certificate renewal
The CSMS and SUMS certificates of compliance are valid for up to three years: then you are back in front of the technical service.
Every year
Monitoring report
At least once a year the manufacturer reports to the approval authority on cybersecurity monitoring (R155, 7.4.1).
Every update
Impact assessment
Every software update must be assessed against type-approved systems and the RXSWIN, and recorded (R156, 7.1.1.8 and 7.1.2).
Dates refer to the European Union (Regulation (EU) 2019/2144). Always check the deadlines of your market with the technical service.
Is your next audit getting closer? Let's talkAudit documentation
All the documentation for the CSMS, SUMS and type approval audits, written from your own process.
Describe your organisation once. Omolia prepares the manual, procedures, forms, registers and type approval documents for UN R155 and R156, links them to your registers and to the compliance matrix requirements, and hands over the audit pack ready for the technical service.
Consistent with your process
Roles, systems, suppliers and timescales in the documents are the ones in your profile, not generic template text. Every section can be edited, added or removed: no two companies are the same.
Built on the compliance matrix
Every section states the clauses it gives evidence of. Coverage shows uncovered requirements at a glance, a guide explains how the auditor reads each requirement, and the compliance matrix writes itself.
Always up to date
When profile or register data change (a supplier, an RXSWIN, a manager), the documents that cite them become “to update”, with the before and after already listed.
Audit pack in one click
Approved documents in Word and PDF, an index with versions and signatures, what is missing and the requirement coverage, in one archive. The same evidence updates the SUMS and CSMS audit centre matrices.
Only the modules you need: R156 for trailer and semi-trailer makers (category O), R155, or both with one process for organisation and roles. You can also import the documents you already have and keep working on them in Omolia.
The document set
UN R156 · SUMS and vehicle type approval
29 documents- Management system · 14
- Manual, organisation chart, updates, configuration and RXSWIN, installation, notifications, monitoring, incidents, diagnostic access, backup, UN regulation interference and OTA.
- Forms · 6
- GO/NO-GO release, installation checklist, user notice, incident report, ECU supplier questionnaire, review minutes.
- Registers · 6
- RXSWIN file, vehicle software register, incidents, notices and authority requests, support registers, interference matrix.
- Type approval and audit · 3
- Generated compliance matrix, manufacturer's declaration (Annex 1, Appendix 1), RXSWIN readout test.
UN R155 · CSMS and vehicle type approval
30 documents- Management system · 11
- Manual, organisation and competences, policy, lifecycle, TARA, testing, monitoring and vulnerabilities, incidents and forensic data, suppliers, updates.
- Forms · 5
- Event triage, incident report, supplier questionnaire and cybersecurity interface agreement (CIA), residual risk acceptance, review minutes.
- Registers · 5
- Risks and TARA, vulnerabilities and events, incidents, suppliers and CIA, competence and training.
- Type approval and audit · 9
- Generated compliance matrix, vehicle type documentation, TARA report, Annex 5 mitigations, testing, monitoring, cryptography, annual report.
From the platform · Regulatory coverage
The matrix auditors want to see. Here is an excerpt.
In the platform, under Documents › Regulatory coverage, every R155 and R156 requirement meets the documents that give evidence of it. Here you see a few rows, with the real references of the compliance matrix and the codes of the document catalogue.
- Each row is a clause of the regulation, with its compliance matrix reference and guidance on how the auditor reads it.
- Each column is a document of your set: manual, procedure, form, register or type approval report.
- Each cell tells whether that document covers the requirement and what state it is in. A row with no documents turns red: you know what is missing before the audit.
| Requirement | MAN-SUMS-00 · SUMS manual | PRO-SUMS-02 · Update management | PRO-SUMS-04 · Installation | PRO-SUMS-13 · OTA updates | MOD-SUMS-02 · Installation checklist | REC-SUMS-01 · RXSWIN file |
|---|---|---|---|---|---|---|
| 7.1.1.4Check that the vehicle's software versions match the RXSWIN | – | |||||
| 7.1.1.8Assessing the impact of an update on type-approved systems | – | – | – | |||
| 7.1.2.3Searchable record of the software behind each RXSWIN | – | – | – | |||
| 7.1.3.1Protecting updates against compromise | – | – | ||||
| 7.2.2.1.1Recovering the previous version if an update fails | – | |||||
| 7.2.2.1.2Enough power to complete the update | – | – |
ApprovedDraft or in reviewTo updateNot generated yetReal catalogue coverage, example document states.
29 more requirements and 23 more documents in the full matrix.
Explore it in a demoLiving documents
Data changes, documents know.
Try it: simulate a new software release and watch what happens to the procedure that mentions the RXSWIN.
RXSWIN register
Vehicle type VT-2027
RXSWIN in force
R156-VT27-SW03
PRO-SUMS-03
Vehicle software configuration management procedure
For vehicle type VT-2027 the software identification in force is R156-VT27-SW03, recorded in the RXSWIN file and checked at every installation.
What changed
- Before
- R156-VT27-SW03
- After
- R156-VT27-SW04
The document goes back to review with before and after already listed. The previous approval stays in the history.
In a demo you see it on all your registers: suppliers, owners, risks, campaigns.
Why Omolia
From spreadsheets and shared folders to an audit-ready system
Audit-ready evidence
Documents, approvals and records are attached to the requirement they satisfy, with version history and an audit log.
End-to-end traceability
Vehicle types, ECUs, firmware, RXSWIN and campaigns are linked, so the impact of every change is visible.
Readiness at a glance
Dashboards and the readiness simulator show what blocks the audit and who has to act.
One workspace for every role
Compliance, release, engineering, suppliers and auditors work on the same data with their own permissions.
Modules
Everything you need to run CSMS and SUMS
Start with the modules you need today and enable the others as your programme grows.
SUMS workspace
Compliance matrix, procedures, manual builder, templates and reports for UNECE R156.
CSMS workspace
Risk register, vulnerability management and residual risk decisions for UNECE R155.
Vehicle cybersecurity
Annex 5 threat matrix and TARA results imported and linked to the vehicle type.
Software and OTA campaigns
Firmware packages, signatures, RXSWIN, campaign gates and R156 impact assessments.
Gap analysis
Assess where you stand against R155 and R156 and turn every gap into a tracked action.
Document Studio
R155 and R156 manual, procedures, forms and registers generated from your profile, with requirement coverage, signed approvals and the audit pack.
Compliance assistant
Guided answers on requirements and on what your evidence still has to cover.
Supplier portal
Suppliers upload firmware and evidence in their own space, without seeing your data.
How it works
From a new tenant to the audit pack
- 01
Switch on the modules
R155, R156 or both: each customer only sees what concerns it. Invite the team and choose the document language.
- 02
Describe the process
The process profile gathers roles, systems, suppliers and timings, with suggested answers to confirm.
- 03
Connect the registers
Vehicles, ECUs, RXSWINs, risks, TARA and vulnerabilities enter the documents as live data.
- 04
Generate the documents
One click creates the applicable manual, procedures, forms and registers, ready to adapt section by section.
- 05
Check the evidence
Requirement-by-requirement coverage, the auditor's guide and consistency checks between documents and registers.
- 06
Approve and go to the audit
Signed versions, living documents and a downloadable audit pack, aligned with the SUMS and CSMS audit centres.
Who it is for
For every company in the automotive supply chain
Vehicle manufacturers
Run CSMS and SUMS across vehicle types and keep type approval under control.
Tier 1 and Tier 2 suppliers
Provide OEMs with the cybersecurity and software update evidence they request.
Consultants and technical services
Support several clients from one place, each in an isolated workspace.
Self-assessment
How ready are you for the audit?
Up to eight questions taken from the compliance matrix. Two minutes, no data required.
Security
Built for data you cannot afford to lose
Isolated tenants
Each organisation works in its own workspace, with its own address and policies.
SSO and MFA
Sign in with your company identity provider and require multi-factor authentication.
Complete audit log
Every change is recorded with who made it, when and what changed.
Role-based access
Admins, compliance managers, release managers, auditors and suppliers see only what they need.
The demo
Watch your documentation take shape.
No slides: we work in the platform, with the regulations and vehicle types you care about. Here is what you will see. The rest we would rather let you discover live.
Tell us your regulations, vehicle types and timeline: we prepare the demo around your case.
- 01
From profile to manual
Answer the questions about your process and watch the manual and procedures fill in with your own roles, systems and suppliers.
- 02
Data changes, documents know
Change an RXSWIN or an owner: the documents that mention it move to “to update”, with before and after listed.
- 03
The full matrix
Every applicable R155 and R156 requirement, crossed with your documents and with guidance on how the auditor reads each clause.
- 04
The audit pack
Approved documents, an index with versions and signatures and requirement coverage in a single archive for the technical service.
FAQ
Frequently asked questions
Does Omolia replace our existing tools?
No. Omolia connects to them: you can import matrices and TARA results and link documents that stay in your systems through the integrations and the public API.
Are the generated documents enough to pass the audit?
They are the starting point, consistent with the compliance matrix and with your process. The auditor also asks for records: completed forms and up-to-date registers, which Omolia organises and links to the requirements.
Can I see the full compliance matrix?
Yes, in a demo. Above you find an excerpt; in the platform the matrix covers every R155 and R156 requirement that applies to your profile, document by document, with guidance for the auditor.
Can I use the documents I already have?
Yes. Import Word, Markdown or text files: Omolia splits them into sections, suggests the requirements they cover and treats them like the other documents. Headers and letterheads are not imported.
Can we start with SUMS only?
Yes. Modules are enabled per organisation, so you can start with R156 and add CSMS and the other modules later.
Can our suppliers use the platform?
Yes. The supplier portal gives them a restricted space to deliver firmware and evidence, without access to the rest of your data.
Which languages are supported?
The interface is available in Italian and English, and documents can be produced in either language.
How long does it take to get started?
A workspace is ready in a few minutes. The guided onboarding and the gap analysis help you set up the first vehicle type in the first weeks.
Contact
Tell us about your programme
Request a demo, a quote or simply information. We will reply within two working days.
- A demo on your vehicle types and regulations
- A proposal sized on your modules and users
- Support for onboarding and data migration