Why supplier cybersecurity is now a supplier quality topic
Only vehicle manufacturers can obtain approval under UN Regulation 155. But the UK Vehicle Certification Agency (VCA) is explicit that manufacturers must show they manage their supply chain effectively: they must identify supply chain risks and cascade security requirements to suppliers whose products could affect a vehicle type (VCA).
VCA adds that the UNECE interpretation document introduces the use of contracts to reflect supplier-related risks, and it points to ISO/SAE 21434 Clause 7 (distributed cybersecurity activities) for manufacturer-supplier agreements and responsibilities. It also advises suppliers to consult each manufacturer they supply, because security requirements may differ.
Supplier quality engineers (SQEs) already run supplier selection, audits and monitoring. Cybersecurity adds a new set of requirements to that same workflow.
Where R155 sits on the timeline
R155 has applied to new EU whole-vehicle type approvals since July 6, 2022 and to existing approvals since July 7, 2024 for unlimited-series vehicles; existing small-series and special-purpose approvals follow from July 7, 2026 (VCA). For suppliers, that means OEM requirements are now in force in contracts and supplier manuals, not just in pilot projects.
What to assess at a supplier
| Area | What to look for | Typical evidence |
|---|---|---|
| Organization | Named cybersecurity responsibility, competence, policy | Org chart, role descriptions, training records |
| Agreement | Who does which cybersecurity activities for this component | Cybersecurity interface agreement or equivalent contract terms (ISO/SAE 21434 Clause 7) |
| Risk assessment | Threat analysis and risk assessment for the supplied item | TARA or equivalent, linked to the item definition |
| Development | Security requirements, verification and testing | Requirements trace, test reports, vulnerability scans |
| Production | Secure handling of keys, software and programming at end of line | Process instructions, access controls, records |
| Post-production | Vulnerability monitoring and incident response for the supplied item | Monitoring procedure, contact points, response times |
| Sub-tier suppliers | How the supplier cascades requirements further | Sub-tier agreements, supplier list |
Fitting cybersecurity into the SQE workflow
Supplier selection
Add cybersecurity capability to selection criteria for suppliers of electronic control units, software, connectivity and any item the OEM identifies as security-relevant.
Contract and agreement
Make sure the purchase contract or a separate interface agreement allocates responsibilities. VCA notes that the interpretation document introduces contracts as the vehicle for supplier-related risks.
Audit
Add a cybersecurity module to your process or system audit. Interview the people who actually do the work, as R155 auditors do with manufacturers.
Monitoring
Track vulnerability notifications, response times and changes to software or hardware alongside quality metrics.
Change management
A software change at a supplier can affect both security and the vehicle’s software update management under R156. Require advance notification.
Who you work with
- OEM or customer cybersecurity team: the requirements you must cascade.
- Your company’s product security team: technical review of supplier evidence.
- Purchasing: contract terms and supplier selection.
- Engineering: component security requirements.
- Quality manager: integrating cybersecurity into supplier audits and scorecards.
Common weaknesses
- Cybersecurity treated as a one-time questionnaire at sourcing.
- No written allocation of responsibilities between customer and supplier.
- Sub-tier software suppliers outside the scope of any agreement.
- No defined route for vulnerability reports after start of production.
- SQEs asked to approve technical evidence they cannot evaluate, with no security expert involved.
Checklist
- Security-relevant supplied items identified
- Cybersecurity criteria in supplier selection
- Interface agreement or contract terms in place
- Cybersecurity module in supplier audits
- Vulnerability and incident contact points agreed
- Change notification covers software and security changes
How AskDona helps
Supplier cybersecurity evidence arrives as questionnaires, agreements, TARAs, test reports and policies, often in different formats from every supplier. AskDona reads that evidence against your customer’s requirements or an ISO/SAE 21434-based checklist and shows which requirements are covered and which are missing, with page citations. Run a sample supplier cybersecurity evidence review on one ECU supplier. AskDona shows the evidence; your supplier quality and security teams decide.
Editor’s note: Based on the UK VCA’s guidance; other approval authorities and OEMs may set different supplier requirements. ISO/SAE 21434 text is copyrighted and not reproduced; the assessment table is an illustrative framework. The LinkedIn count was supplied by the client.
FAQ
Do suppliers need R155 approval? No. Only vehicle manufacturers obtain approval, but they must cascade security requirements to relevant suppliers.
Which standard covers customer-supplier cybersecurity responsibilities? ISO/SAE 21434 Clause 7, distributed cybersecurity activities.
Do all OEMs ask for the same thing? No. VCA advises suppliers to consult each manufacturer they supply.
Where should an SQE start? Identify security-relevant supplied items, then make sure responsibilities are agreed in writing.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| UK VCA: Cyber security and software updating (updated May 22, 2026) | Approval authority guidance | Supply chain requirements, ISO/SAE 21434 Clause 7, dates |