Bentley and MHP ensure cybersecurity compliance with UNECE Vehicle Regulations

• Collaboration achieves certification with zero non-conformities
• Transformative project enabled Bentley to achieve compliance standards
• The achievement means Bentley’s GT range of vehicles meets the highest cybersecurity and software update management systems

Reading, UK – MHP Consulting UK Limited and Bentley Motors have collaborated together to establish robust Cybersecurity and Software Update Management Systems (CSMS & SUMS) for the Bentley landscape, achieving compliance with the UNECE (United Nations Economic Commission for Europe) World Forum for Harmonization of Vehicle Regulations (WP.29). Bentley achieved its certification with zero non-conformities for this project, spanning approximately 24 months.

In the age of connected vehicles and increasing cyber threat, it is vital for OEMs to demonstrate they have robust processes and systems in place to protect vehicles and individuals interacting with them. The UNECE regulations strive to thoroughly address this issue: as of July 2024, OEMs must adhere to these regulations in order to sell any vehicle and product within its 56 member states. Notably, the key regulations include R155, which centres on cybersecurity; and R156, which focuses on software updates. In addition to achieving compliance, OEMs are required to introduce the necessary related supporting management systems across their organisations to maintain compliance. What is more, they have to also have them audited by a technical service in order to sell any vehicles in UNECE regions.

As part of this initiative, despite Bentley’s advanced systems and the fact that its CSMS and SUMS were already cutting edge, and broadly similar to UNECE’s requirements, the manufacturer still had to ensure that it complied with both the R155 and R156 regulations for regulatory and type approvals. To achieve this, Bentley sought the expertise and support of MHP Consulting. Together Bentley and MHP embarked on a transformative project that enabled Bentley to achieve compliance, with the initiative being implemented in two key stages.

Phase 1: Cybersecurity & Software Update Management Systems (CSMS & SUMS)
 
During the initial phase of this working relationship, Bentley and MHP Consulting UK were proactive and engaged with a technical service to enable it to develop the appropriate concepts and processes that would align with the UNECE requirements, reinforcing Bentley’s strategic direction and regulatory compliance. Therefore, the nature of this joint work and collaboration resulted in Bentley concentrating on communicating with the external auditors and members of the authorities. MHP Consulting UK captured the key actions, points and behaviours related to the initiative. The successful audit preparation consisted of:

• Sophisticated audit strategy development – executing a thorough “dress rehearsal”
• Successful integration of requirements in new and existing processes and their implementation
• Successful adaption of group-wide policies and processes (e.g. ISO21434 / R155/156)
• High process maturity in consideration of ISO21434
• Successful onboarding of CSMS/SUMS relevant IT tools
• High managerial commitment

Well-structured governance ensured that policies and practices were well-defined and aligned with industry standards. As a result, the Certification Audit was achieved with zero non-conformities.

Phase 2: Operationalisation and execution of Phase 1

Phase 2 of this project involved operationalising, executing and running Bentley’s customised CSMS/SUMS management system, none of which would have been possible without the solid foundation established in Phase 1 – as this foundation enabled the programme to deliver a successful first Surveillance Audit. Phase 2 accomplished the following:

• A strong programme governance structure
• Extensive surveillance audit preparation
• Collected concrete evidence about the process operationalisation
• Worked closely and in a cross-functional manner with the business
• Demonstration of running CSMS & SUMS relevant IT tools across the business

The use of innovative programme management tools in the business has also enabled strong and transparent programme management during this initiative. The cybersecurity (CS) culture within Bentley was enhanced, too, through Awareness & Communication campaigns (e.g. CS Tech Talks & Monthly Reports). This approach strategically prepared the business for a sustainable integration of CSMS & SUMS deeper into Bentley’s business-as-usual operations.

Chris Cole, Product Line Director Bentley Motors Ltd, says: “We’re proud of this close collaboration with MHP Consulting UK, and the fact that Bentley has met the cybersecurity legislative requirements set out by the United Nations Economic Commission for Europe. Not only have our joint teams achieved certification with zero non-conformities, they have pushed the boundaries of innovation, further entrenching cybersecurity as a cultural imperative into the Bentley brand. This is a major achievement for our team and ultimately means that our GT range of vehicles meets the highest cybersecurity and software update management systems.”

Bodo Philipp, CEO MHP Consulting UK, says: “Achieving UNECE compliance is crucial for an OEM’s market access, and can therefore mean a bottom-line impact of millions, even billions, depending on the brand. It is key for OEMs to work with proven experts that can help them to navigate the regulatory landscape successfully – especially as the industry becomes more and more dependent on data, internet access and connected services.” He adds: “Our teams have done incredibly successful transformative work together. They’ve led the charge on this initiative, and have set new standards within Bentley – a fantastic achievement. Well done!”