Manage Cybersecurity Competencies and Culture: with the ACP Framework

Clarity of the requirements, harmonization of the terminology and standardization of all the relevant disciplines involved:

• ISO/SAE 21434 Road Vehicles – Cybersecurity Engineering
• and UN Regulation No. 155

stand for the ambition of a consistent standardization in the field of automotive cybersecurity. This also affects the levels of cybersecurity competence and cybersecurity culture.

A major challenge here is not only developing the necessary skills and awareness (e.g., through training), but also providing the corresponding, reliable evidence of these skills.

For instance, ISO/SAE 21434 specifically points out that the evidence of a practiced competence management becomes as necessary as the evidence of the continuous establishment of a cybersecurity culture. Organizations are obliged to meet these documentation requirements with a framework that is applicable throughout the organization and well established in the industry, such as the ACP Framework of the CYRES Academy.

How does the certification procedure work? Due to increased demand, the certification process will soon be extended by an institutionalized procedure with an external certification partner. Updated information on the current process will be published here.

The current process as outlined:

• Fulfilling the prerequisites: Along the defined ACP framework levels (Foundation, Advanced and Expert) the respective prerequisites have to be fulfilled in order to be admitted to the respective exam.
• Identification: The identification of the examinee (via ID/camera) is required to take the exam.
• Performance of the test: The test questions must be answered within the specified time period. An appropriate percentage of correct answers is to be achieved, the test result is indicated in the certificate.
• Issuance of certificates: upon passing the test, the respective certificates are issued and made available (digital/analog) to the certificate holders.
• Security checks: Additional security features are used to prove the uniqueness of the certificates issued.
• Organizational: The fees for the examination are to be paid along the certification regulations (on request), issued certificates are only valid for a limited period of time.

The dates for the examination are scheduled regularly and at short intervals. We will publish the upcoming exam dates on our websites, if required, please contact us directly about it.

Holistic cybersecurity competence management means that, in addition to standardized state-of-the-art technical knowledge, organization-specific cybersecurity application know-how (such as policies, regulations, processes, etc.) must also be included to the required extent. Thus, in the trainings of the CYRES Academy, the adaptation and enhancement of the learning curriculums is easily possible. The Automotive Cybersecurity Professional Framework also offers the possibility for customer-specific adjustments at all certification levels.

From OEM to Tier-N supplier, all involved actors in the automotive value chain have touch points with cybersecurity. Every single role along the entire product lifecycle has specific cybersecurity competency and awareness requirements to meet. The organization has an obligation not only to develop this (e.g., in the form of training), but also to provide the evidence required.

The ACP Framework provides the holistic competency management framework for this:

• ACP Level 1 Foundation: This level is the basis for cybersecurity in the automotive industry. It is aimed at everyone with interfaces to cybersecurity activities.
• ACP Level 2 Advanced: This level is more in-depth for employees who are directly involved in cybersecurity issues or are required to cooperate accordingly.
• ACP Level 3 Expert: This level (divided into engineering and management) is for employees with broad and deep cybersecurity responsibilities. (Relevant work experience is part of the prerequisites).

Detailed information on the certification regulations will be available here shortly, in advance only on request.