Automotive Cyber Certification

exida has established cybersecurity certification programs for both:

• engineering processes used to design and develop components such as  embedded devices, automotive subsystems, network devices, host devices, and software
• engineering processes used to design systems of devices

The exida Security Development Process program is based upon IEC 62443-4-1 and covers manufacturer design and development, especially software design and coding. This program is well suited to Original Equipment Manufacturer (OEM) product maintenance and development where full variability computer languages (C, C++, etc.) are being used.

The exida System Integrator Process program is based upon IEC 62443-2-4 and covers the cybersecurity aspects of system integration, testing, and installation. The certification covers the process itself not any specific device or system designed using that process. This program allows a system integrator to show cybersecurity competence to potential customers and results in more secure systems.

The exida Security Development Process program for automotive is based upon ISO/SAE 21434 and covers manufacturer design and development.

A device (an embedded control product, a platform device, or a software application) can get a cybersecurity certification from exida. Each device must be designed and tested following a cybersecurity engineering process per IEC 62443-4-1 and the device must include a set of cybersecurity defense techniques as specified in IEC 62443-4-2. There are four security levels specified in that standard with sets of requirements that increase with higher numbered levels as shown in the Figure below. 

Any device meeting the requirements of this program will be given a certificate stating the achieved security level which demonstrates to potential customers the cybersecurity strength built into the device.

For devices that are to be used in an automotive context, exida offers an ISO 21434 device certification, but this standard currently does not include security levels.

Two cybersecurity certification schemes are available from exida:

• Original Equipment Manufacturer (OEM) System Certification and
• Integrated System Certification.

The exida System Security Certification for OEMs is based upon IEC 62443-4-1 and IEC 62443-4-2.  This scheme has similar requirements to a device cybersecurity certification except it is applied a system level where many devices are networked into a system.  With this certification a system supplier can show accredited third party cybersecurity certification for all devices in the system when configured and maintained according to the security manual. 

The exida Integrated System Certification is based upon IEC 62443-2-4 and IEC 62443-3-3.  This certification scheme applies to a networked system designed by an integration company per an engineering process for integrators and provides cybersecurity features as required by IEC 62443-3-3.  Four security levels are specified with additional cybersecurity defense mechanisms needed for each higher level.  

View Completed Cybersecurity Certifications

As a pioneer in IACS personnel competency certification, exida introduced the CFSE/CFSP program in 2000.

Two cybersecurity personnel certification programs based on the same fundamental principles are available from exida – the CACE and the CACS programs.