Automotive Internal Development Process Improvement for Assuring Compliance with the ASPICE for Cybersecurity Extension

Abstract

Cybersecurity standards of the automotive industry are rapidly developed in order to aid suppliers and OEMs to keep up with the increasing number of cybersecurity attacks. The interfaces, connectivity to the surrounding environment and smart solutions of a vehicle are key vulnerabilities exploited by hackers. Therefore, the regulators have recognized the importance of introducing such standards for providing a safer development path of the technologies embedded within modern vehicles. ASPICE has recently introduced the ASPICE for Cybersecurity add-on module providing a method for identifying product risks that might arise during the development process. By introducing processes and work products focusing on cybersecurity, ASPICE has become a complex framework that must be followed by automotive suppliers. The conducted work presents a gap analysis conducted in order to map the internal Vitesco S&A development process to the newly released ASPICE for Cybersecurity model. The scope of the work is to identify any inconsistencies within the internal development process that might affect its compliance with the ASPICE model. The gaps are then underlined while additional outcomes for continuous development process improvement together with the current organizational approach are presented.