Cybersecurity Best Practices for the Safety of Modern Vehicles

Cybersecurity Best Practices for the Safety of Modern Vehicles

Publication: Federal Register
Agency: National Highway Traffic Safety Administration
Byline: Cem Hatipoglu
Date: 9 September 2022
Subjects: American Government

, Software

[Federal Register Volume 87, Number 174 (Friday, September 9, 2022)]
[Notices]
[Pages 55459-55465]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-19507]

[[Page 55459]]

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

National Highway Traffic Safety Administration

[Docket No. NHTSA-2020-0087]

Cybersecurity Best Practices for the Safety of Modern Vehicles

AGENCY: National Highway Traffic Safety Administration (NHTSA),
Department of Transportation (DOT).

ACTION: Notice of federal guidelines.

-----------------------------------------------------------------------

SUMMARY: On January 12, 2021, NHTSA released its draft Cybersecurity
Best Practices for the Safety of Modern Vehicles guidance (``Draft Best
Practices'' or ``guidance'') in an effort to support industry-led
efforts to improve the industry's cybersecurity posture as well as
provide NHTSA's views on how the automotive industry can develop and
apply sound, risk-based cybersecurity management processes during the
vehicle's entire lifecycle. These guidelines are intended to be
applicable to all individuals and organizations involved in the design,
development, manufacture and assembly of a motor vehicle and its
electronic systems and software. These entities include, but are not
limited to, small and large-volume motor vehicle and motor vehicle
equipment designers, suppliers, manufacturers, and modifiers. This
document summarizes comments received in response to the draft
guidance, responds to those comments, and describes changes made to the
draft guidance in response to those comments. This document also
announces the issuance of the final version of the Cybersecurity Best
Practices for the Safety of Modern Vehicles guidance. While this is the
final version of this iteration of the Best Practices, NHTSA routinely
assesses cybersecurity risks as well as emerging best practices and
will consider future updates as motor vehicles and their cybersecurity
evolve.

DATES: The changes made in this document are effective upon
publication.

FOR FURTHER INFORMATION CONTACT: For technical issues, please contact
Mr. John I. Martin of NHTSA's Office of Vehicle Safety Research at 937-
366-3246 or john.martin@dot.gov. For legal issues, contact Ms. Sara R.
Bennett of NHTSA's Office of Chief Counsel at 202-366-2992 or
sara.bennett@dot.gov.

SUPPLEMENTARY INFORMATION: This final version of the Cybersecurity Best
Practices for the Safety of Modern Vehicles does not have the force and
effect of law and is not a regulation. This guidance document will not
be published in the Code of Federal Regulations but will be posted on
NHTSA's website, www.nhtsa.gov.

I. Introduction

In January 2021, NHTSA released its draft Cybersecurity Best
Practices for the Safety of Modern Vehicles guidance document (``Draft
Best Practices'' or ``guidance'') with the goal of supporting industry-
led efforts to improve the industry's cybersecurity posture and provide
the Agency's views on how the automotive industry can develop and apply
sound, risk-based cybersecurity management processes during the
vehicle's entire lifecycle. As background, the Draft Best Practices
document is an update to NHTSA's first cybersecurity best practices
document, Cybersecurity Best Practices for Modern Vehicles (``2016 Best
Practices''). NHTSA requested comment on the Draft Best Practices in an
accompanying Federal Register notice.\1\
---------------------------------------------------------------------------

\1\ 86 FR 2481 (Jan. 12, 2021).
---------------------------------------------------------------------------

The Draft Best Practices builds upon agency research and industry
progress since 2016, including emerging voluntary industry standards,
such as the International Organization for Standardization (ISO)/SAE
International (SAE) Draft International Standard (DIS) 21434, ``Road
Vehicles--Cybersecurity Engineering.'' \2\ In addition, the Draft Best
Practices references a series of industry best practice documents
developed by the Automotive Information Sharing and Analysis Center
(Auto-ISAC) through its members. The Draft Best Practices also reflects
findings from NHTSA's continued research in motor vehicle
cybersecurity, including over-the-air updates, formal verification,
static code analysis, new learnings obtained through researchers and
stakeholder engagement as well as continued building of our capability
in cybersecurity testing and diagnostics. The updates included in the
Draft Best Practices incorporate insights gained from public comments
received in response to the 2016 guidance and from information obtained
during the annual SAE/NHTSA Vehicle Cybersecurity Workshops.
---------------------------------------------------------------------------

\2\ ISO/SAE 21434:2021 Road Vehicles--Cybersecurity Engineering,
available at: https://www.iso.org/standard/70918.html.
---------------------------------------------------------------------------

The Draft Best Practices touches on a wide array of issues
associated with safety-related cybersecurity practices, and provides
recommendations to industry on the following topics:

General Cybersecurity Best Practices
Education
Aftermarket/User-Owned Devices
Serviceability
Technical Vehicle Cybersecurity Best Practices

The first topic in the list, ``General Cybersecurity Best
Practices,'' is the largest topic and discusses cybersecurity practices
with respect to industry stakeholders. There are a variety of practices
in this category. For example, one practice suggests that manufacturers
should evaluate all commercial off-the-shelf and open-source software
components used in vehicle Electronic Control Units (ECUs) against
known vulnerabilities.\3\
---------------------------------------------------------------------------

\3\ G.12 in NHTSA's Cybersecurity Best Practices for the Safety
of Modern Vehicles.
---------------------------------------------------------------------------

The second topic, ``Education,'' discusses the role and
responsibilities of industry and academia in supporting an educated
cybersecurity workforce.
The third topic, ``Aftermarket/User-Owned Devices,'' discusses the
issues associated with connecting aftermarket devices to vehicle
systems. For instance, the guidance suggests that any connection to a
third-party device should be authenticated and provided with
appropriate, limited access.\4\
---------------------------------------------------------------------------

\4\ G.42 in NHTSA's Cybersecurity Best Practices for the Safety
of Modern Vehicles.
---------------------------------------------------------------------------

The fourth topic, ``Serviceability,'' touches on industry's
obligation to simultaneously provide for both cybersecurity and third-
party serviceability.
The last topic, ``Technical Vehicle Cybersecurity Best Practices,''
discusses cybersecurity practices with respect to the vehicle. As an
example, one of the 25 technical vehicle cybersecurity best practices
suggests that network segmentation and isolation techniques should be
used to limit connections between wireless-connected ECUs and low-level
vehicle control systems, particularly those controlling safety critical
functions, such as braking, steering, propulsion, and power management.
This notice summarizes the comments received, NHTSA's responses to
those comments, and finalizes the Draft Best Practices document. The
final Best Practices document continues to use the numbering scheme
introduced in the Draft Best Practices document. For example, it uses
[G.1] through [G.45] for general cybersecurity best practices and [T.1]
through [T.25] for technical vehicle cybersecurity best practices.
Additions to the Draft Best Practices mean that there are some
numbering differences between the draft and final versions of the Best
Practices. This Federal Register notice exclusively refers to the final
Best Practices

[[Page 55460]]

numbering scheme, rather than the draft version. Cases where there are
differences between the draft and final numbering scheme are noted with
a footnote. Finally, the agency stresses that the final Best Practices
remain voluntary and non-binding, as has been the case with this
guidance beginning with its initial 2016 edition.

II. Summary of Differences Between the Draft and Final Cybersecurity
Best Practices for the Safety of Modern Vehicles

The purpose of this section is to provide a summary of the
differences between the draft and final Cybersecurity Best Practices
for the Safety of Modern Vehicles. The next section of this document,
``Summary of Public Comments Received in Response to Draft
Cybersecurity Best Practices,'' will discuss the comments received and
the reasons why these changes were made.
The following provides a high-level summary of changes made in the
final version. First, in response to a comment, NHTSA clarified, with a
minor edit, that the scope of the Best Practices includes all
individuals and organizations involved in the maintenance of a motor
vehicle. Second, the Agency updated all references to the ISO/SAE 21434
standard to reflect the finalized version of the subject industry
standard, which occurred after the Draft Best Practices were published
for comments. Third, in the General Cybersecurity Best Practices
section, several headings were retitled in response to comments, and
the new changes clarified terms, and altered the order of mention of
the Auto-ISAC and standards development organizations (SDO) in some
places to avoid unintended potential referencing to Auto-ISAC as an
SDO. Additionally, NHTSA added a new general cybersecurity best
practice to address future risks and bifurcated an existing one into
two separate practices based on well-supported comments. Fourth, in the
Technical Cybersecurity Best Practices section, NHTSA added mention of
current cryptographic techniques and their implementation and made
wording changes to clarify protections from unauthorized disclosure and
accessibility to other vehicles. The Agency also added a new technical
practice to limit firmware version rollback attacks and rewrote a
technical practice [T.11].\5\ The new practice now reads ``[T.11] \6\
Employ best practices for communication of critical information over
shared and possibly insecure channels. Limit the possibility of replay,
integrity compromise, and spoofing. Physical and logical access should
also be highly restricted.'' Fifth, NHTSA added definitions of ``global
symmetric keys'' and ``recovery'' to the appendix's Terms and
Descriptions section. Finally, NHTSA updated and added minor wording
changes and references throughout, including addressing clerical
errors.
---------------------------------------------------------------------------

\5\ In the draft version, this was T.10.
\6\ In the draft version, this was T.10.
---------------------------------------------------------------------------

III. Summary of Public Comments Received in Response to Draft
Cybersecurity Best Practices

NHTSA received comments from a total of 38 entities in response to
the Draft Best Practices, published in January 2021. These comments
came from government entities,\7\ industry associations,\8\ standards
development organizations,\9\ automotive and equipment
manufacturers,\10\ consumer and safety advocacy organizations,\11\
university and research organizations,\12\ and individuals.\13\ The
comments represent an evolution of vehicle cybersecurity opinion among
stakeholders and the general public. Comments to the 2016 guidance
tended to be general and higher-level (i.e., bigger-picture). In
contrast, comments received in response to the Draft Best Practices
focused on discrete issues important to commenters. This evolution is
also likely due to the introduction of vehicle-specific cybersecurity
standards and best practices in the automotive sector. Overall, most
commenters seemed supportive of NHTSA's efforts to encourage continual
progress in the automotive sector through the issuance of best
practices, though there was some divergence as to the details of what
those best practices should contain, the level of detail necessary to
fulfill the agency's goals, and other specific topics commenters stated
NHTSA should address. The aggregated comments presented several high-
level themes, and thus, this document presents comments organized by
the following categories of request:
---------------------------------------------------------------------------

\7\ California Highway Patrol.
\8\ Alliance for Automotive Innovation, American Alliance for
Vehicle Owner's Rights, American Trucking Association, Auto Care
Association, Automotive Aftermarket Suppliers Association,
Automotive Recyclers Association, Specialty Equipment Market
Association, National Motor Freight Traffic Association, National
Automobile Dealers Association, Motor Equipment Manufacturers
Association and Consumer Technology Association.
\9\ SAE and Institute of Electrical and Electronics Engineers.
\10\ General Motors LLC, Toyota Motor Corporation, Continental
Automotive Systems, Denso Corporation, ZF North America, Robert
Bosch GmbH, Amazon Web Services, Blackberry Corporation, AT&T,
GeoTab, Nuro, Arilou Automotive Cybersecurity and LKQ Corporation.
\11\ Center for Auto Safety, Privacy4Cars, SecuRepairs and
Digital Right to Repair Coalition.
\12\ Carnegie Mellon Software Engineering Institute, Sandia
National Laboratories, Underwriters Laboratories LLC.
\13\ Norman Field, Rik Farrow,Ryan Moss and Howard Hoffman.
---------------------------------------------------------------------------

More specifics in the guidance;
Industry collaboration;
Minor editorial amendments;
Additional references to ISO/SAE 21434;
Additional references to other standards;
Clarification of entity designations;
Changes in scope; and
Right to repair.
In the sections that follow, NHTSA summarizes each category of
major comments received in response to the Draft Best Practices and the
agency's response.

a. Commenter Requested More Specifics in the Guidance

Several commenters requested that NHTSA make certain language in
the guidance more specific to address issues important to the
commenter. As background, NHTSA intends to maintain wide applicability
in the Draft Best Practices, so that it can encompass the many industry
stakeholders, variety of business models, and vehicle and equipment
architectures available on the market. This guidance is also intended
to be flexible enough to encompass future business models and vehicle
and equipment designs, to help ensure that this guidance remains
helpful and relevant beyond a single point in time. Even so, NHTSA
found it possible to integrate several suggestions from commenters in
response to requests for more specificity. As such, NHTSA added two
definitions to the document's glossary, and made the changes described
below.
The two definitions that NHTSA added in response to comments are
for the terms, ``recovery,'' and ``global symmetric keys.'' The
Institute of Electrical and Electronics Engineers (IEEE), a standards
setting professional organization, suggested defining the term
``recovery'' in the context of referencing the National Institute of
Standards and Technology (NIST) Cybersecurity Framework's five
principal functions ``Identify, Protect, Detect, Respond and Recover.''
IEEE suggested that the document did not describe what was meant by
``recovery.'' Toyota Motor Corporation (Toyota) and Geotab suggested
defining the specific term ``global symmetric keys'' because, in their
opinion, the meaning may not

[[Page 55461]]

be obvious. NHTSA considered the merits of adding these new definitions
for improving clarity and agreed that their addition would be
beneficial for public understanding, and thus, added them to the final
Best Practice's appendix in ``Terms and Definitions''.
In section 8.2 of the Draft Best Practices, ``Cryptographic
Credentials,'' Sandia National Laboratories (Sandia) and DENSO
Corporation (Denso) suggested additional specific discussion of
cryptographic techniques and standards. In response, NHTSA has modified
section 8.2 with additional text and a slight title change that
reflects section 8.2's new focus on techniques.
Sandia also expressed the comment that, ``The claim that Public key
cryptography techniques are more secure than symmetric key systems
should be caveated with `properly implemented techniques' are
`generally' more secure. . . .''.\14\ While Sandia made this comment
with respect to section 8.3 of the Draft Best Practices, ``Vehicle
Diagnostic Functionality,'' NHTSA responded to Sandia's comment by
incorporating the text ``While the selection of appropriate
cryptographic techniques is an important design criterion, it should be
noted that implementation issues often determine any system's
security'' into section 8.2. NHTSA considered Sandia's assertion to be
correct, and NHTSA agrees that implementation issues are very
important.
---------------------------------------------------------------------------

\14\ See Comment ID ``NHTSA-2020-0087-0009'' for Document
``NHTSA-2020-0087-0002'' on the regulations.gov website.
---------------------------------------------------------------------------

NHTSA also incorporated a comment from SAE that asked for technical
guidance that would limit firmware version rollback attacks where an
attacker may use software update mechanisms to place older, more
vulnerable software on a targeted device. NHTSA agrees that the
practice of manufacturers allowing the installation of older,
potentially vulnerable versions of firmware in vehicles and vehicle
equipment should be avoided whenever possible. In response, NHTSA added
practice [T.23].
Because of NHTSA's desire for the document to remain broadly
applicable, many comments asking for additional specifics were not
incorporated into the guidance. For instance, NHTSA did not accept
comments suggesting that the agency explicitly define terms such as
``lifecycle,'' ``end-of-life,'' and ``state of the art,'' among others.
NHTSA acknowledges that many of these terms may have different meanings
to different companies and stakeholders, but NHTSA did not believe it
would be appropriate to define these terms in such a way that might
inadvertently suggest limitations to or conflicts with company
responsibilities, such as manufacturers' responsibility to notify NHTSA
of any safety defect in its motor vehicles or motor vehicle
equipment.\15\
---------------------------------------------------------------------------

\15\ 49 U.S.C. 30118(c).
---------------------------------------------------------------------------

Similarly, while NHTSA encourages companies to pay close attention
to cybersecurity throughout its corporate structures and supply chain,
NHTSA does not view this guidance as a mechanism to suggest how
corporate responsibilities among companies should be distributed. This
guidance does not attempt to provide any particular view of the
automotive supply chain, and NHTSA recognizes that many of these
considerations may be handled via contract. Although ISO/SAE 21434 does
address supply chain responsibilities to some extent, NHTSA's Best
Practices purposefully does not provide such details.
In other cases of requested specificity, NHTSA determined that some
commenters' requests inadvertently resulted in limiting the
applicability of the document. As stated before, one of NHTSA's
underlying goals of this document was to ensure it remains accessible
to a wide audience and all of NHTSA's regulated entities.
NHTSA also tries to maintain the document's generality by limiting
language specific to a particular corporate process, perhaps even
specific to a particular corporation. Comments that make suggestions
encompassing specific corporate processes have not been incorporated
into the updated document.
In addition, a comment asked NHTSA to address forensic data
retrieval. NHTSA recognizes the importance of forensic data retrieval
but has determined that the subject is out-of-scope for this document.

b. Commenter Encourages Industry Collaboration

Many commenters expressed the sentiment that industry collaborative
efforts are a good idea, including the Alliance for Automotive
Innovation (Alliance) and Amazon Web Services (Amazon), both of which
provided specific comments encouraging collaboration. The Alliance
suggested that NHTSA create a new section on emerging risks where there
may not be established best practices developed to manage those risks.
The Alliance suggested that this new section should include high-level
recommendations to encourage industry-wide collaboration to establish
best practices to treat those risks. Amazon suggested NHTSA should
encourage industry collaboration to identify attempted and successful
exploitations and attacks not previously considered in the design and
assessment phases.
NHTSA agrees with the importance of industry collaboration,
especially within the automotive cybersecurity realm. Therefore, NHTSA
has encouraged membership and active participation in the Auto-ISAC and
collaboration through its annual cybersecurity forum that the agency
holds with SAE. In response to these commenters, NHTSA added a new
general practice [G.24] that states: ``As future risks emerge; industry
should collaborate to expediently develop mitigation measures and best
practices to address new risks.'' NHTSA believes that this addition and
the rest of the guidance covers both commenters' suggestions.

c. Commenter Requested Minor Editorial Amendments

Many commenters provided a wealth of suggested additional word
choices, terminology changes, and phrasing modifications. NHTSA
appreciates these suggestions and adopted these changes wherever
possible and is grateful for the improvements these suggestions
provide.
Multiple comments \16\ pointed out a typographical error in section
4.5 where ``[G.27[a]-[c]]'' \17\ should have been ``[G.28[a]-[c].''
\18\ NHTSA adopted the suggested change. Other editorial amendments
include modifying the word ``standards'' in [G.9] to ``expectations.''
In the draft Best Practices, [G.9] stated ``Clear cybersecurity
standards should be specified and communicated to the suppliers that
support the intended protections.'' NHTSA adopted the change to the
word ``expectations'' because commenters suggested they needed
additional clarification as to what word ``standards'' means in that
particular practice. NHTSA believes ``expectations'' would maintain the
agency's intended breadth while also clarifying any ambiguity for
stakeholders.
---------------------------------------------------------------------------

\16\ ZF North America, Arilou Automotive Cybersecurity, National
Motor Freight Traffic Administration.
\17\ In the draft version, this was G.26.
\18\ In the draft version, this was G.27.
---------------------------------------------------------------------------

Another commenter suggested that NHTSA remove ``that'' from ``NHTSA
recommends that:'' in section 4.3 of the Draft Best Practices. NHTSA
adopted this edit accordingly.
Some commenters suggested changes to section titles to add
additional clarity

[[Page 55462]]

for stakeholders. In two instances, NHTSA adopted those suggestions to
change section titles. Section 4.2.7 was originally titled
``Penetration Testing and Documentation'' in the draft guidance and is
now titled ``Cybersecurity Testing and Vulnerability Identification''
in the final guidance. NHTSA felt that the new title was appropriately
general. Similarly, section 4.2.4 was originally titled ``Unnecessary
Risk Removal'' and is now ``Removal or Mitigation of Safety-Critical
Risks.'' The new title better describes the section.
SAE suggested changes to [T.4] \19\ that changed the existing text
to ``Cryptographic credentials that provide an authorized, elevated
level of access to vehicle computing platforms should be protected from
unauthorized disclosure or modification''. NHTSA welcomes this change
because it additionally emphasizes the consequences of modifying
platform credentials.
---------------------------------------------------------------------------

\19\ In the draft version, this was T.3.
---------------------------------------------------------------------------

Several commenters recommended minor amendments to [T.5] \20\ ``Any
credential obtained from a single vehicle's computing platform should
not provide access to multiple vehicles.'' The technical guidance now
reads ``other vehicles'' rather than ``multiple vehicles'' as was
included in the draft guidance. NHTSA feels that the use of the word
``other'' more clearly focuses the issues involved in using universally
applicable credentials.
---------------------------------------------------------------------------

\20\ In the draft version, this was T.4.
---------------------------------------------------------------------------

National Motor Freight Traffic Association (NMFTA) recommended
minor amendments to general practice [G.6] ``Manufacturers should
consider the risks associated with sensor vulnerabilities and potential
sensor signal manipulation efforts such as GPS spoofing, road sign
modification, Lidar/Radar jamming and spoofing, camera blinding, or
excitation of machine learning false positives.'' The general guidance
now reads ``. . . camera blinding, and excitation . . .'' rather than
``. . . camera blinding, or excitation. . . .'' NHTSA agrees with
NMFTA's comment that the use of ``or'' rather than ``and'' incorrectly
suggests that manufacturers could focus on any one of the presented
spoofing issues rather than considering all the spoofing issues.
SAE suggested that [G.10] needed to focus on hardware and software
rather than just software. In the Draft Best Practices, general
practice [G.10] stated ``Manufacturers should maintain a database of
operational software components used in each automotive ECU, each
assembled vehicle, and a history log of version updates applied over
the vehicle's lifetime.'' NHTSA agrees that software inventory
management alone is not sufficient and made changes to [G.10] to
include a discussion of inventory management of both hardware and
software. Robert Bosch GmbH (Bosch) additionally suggested that the
subject of [G.10] needed to be ``Suppliers and vehicle manufacturers''
rather than ``Manufacturers.'' NHTSA agrees with the change because it
maintains the desired generality while directing the reader to specific
entities.
In the Draft Best Practices, general practice [G.30] \21\ stated
``Organizations should document the details of each identified and
reported vulnerability, exploit, or incident applicable to their
products. These documents should include information from onset to
disposition with sufficient granularity to support response
assessment.'' Underwriters Laboratories (UL) suggested rephrasing the
second sentence as: ``The nature of the vulnerability and the rationale
for how the vulnerability is managed should also be documented.'' NHTSA
agrees that UL's suggested wording is an improvement. NHTSA also felt
that [G.30] \22\ could be better expressed as two separate general
practices and made a new general practice to reflect UL's wording.
---------------------------------------------------------------------------

\21\ In the draft version, this was G.29.
\22\ In the draft version, this was G.29.
---------------------------------------------------------------------------

SAE suggested changes to [G.41] \23\ in the Draft Best Practices,
which stated ``The automotive industry should consider the incremental
risks that could be presented by these devices when connected with
vehicle systems and provide reasonable protections.'' The commenter
suggested removing the word ``incremental,'' changing ``automotive
industry'' to ``automotive manufacturers,'' and changing ``these
devices'' to ``user owned or aftermarket devices.'' NHTSA declines to
change ``automotive industry'' to ``automotive manufacturers'' because
the goal of this guidance document is to retain broad utility for the
entire automotive industry, not just manufacturers. NHTSA agreed to
remove the word ``incremental'' from the general practice and to
replace the term ``these devices'' with a more accurate phrase, ``user
owned or aftermarket devices.''
---------------------------------------------------------------------------

\23\ In the draft version, this was G.39.
---------------------------------------------------------------------------

In the Draft Best Practices, [T.11] \24\ stated ``Critical safety
messages, particularly those passed across non-segmented communication
buses, should employ a message authentication method to limit the
possibility of message spoofing.'' SAE felt that [T.11] \25\ needed to
be reworded as: ``Employ best practices for communication of critical
information over shared and possibly insecure channels. Limit the
possibility of replay, integrity compromise, and spoofing. Physical and
logical access should also be highly restricted.'' NHTSA adopted SAE's
suggested language for technical practice because the new wording
expresses more general guidance than the draft version while
encompassing the draft version's meaning.
---------------------------------------------------------------------------

\24\ In the draft version, this was T.10.
\25\ In the draft version, this was T.10.
---------------------------------------------------------------------------

There were many other suggestions for minor wording or phrasing
changes that NHTSA considered. NHTSA adopted those that would not
change the underlying intent of that particular section of the guidance
document, but many suggestions from commenters would have worked to
either limit or narrow the scope of the guidance. As such, those
suggestions were not adopted since they would be contrary to the intent
and goals of this document.

d. Commenter Requested Additional References to ISO/SAE 21434

ISO/SAE 21434 is a newly developed standard titled ``Road
Vehicles--Cybersecurity Engineering.'' \26\ This standard serves as an
overarching industry consensus standard for vehicle cybersecurity, and
it is extensively referenced in NHTSA's ``Cybersecurity Best Practices
for the Safety of Modern Vehicles.'' Many commenters pointed out that
NHTSA referenced the earlier Draft International Standard (DIS) version
of ISO/SAE 21434, and suggested that NHTSA needed to update the
references in the final Best Practices to the final ISO/SAE 21434
version, which was due to be released in Fall 2021. NHTSA followed this
advice. In the final Best Practices, NHTSA has changed the latest the
guidance to reflect the content of the latest ``FDIS'' or ``Final Draft
International Standard'' version of ISO/SAE 21434.
---------------------------------------------------------------------------

\26\ ISO/SAE 21434:2021 Road vehicles--Cybersecurity
engineering, available at: https://www.iso.org/standard/70918.html
and https://www.saemobilius.sae.org.
---------------------------------------------------------------------------

While NHTSA extensively referenced ISO/SAE 21434, the commenters
pointed out areas where NHTSA could have included a reference to a
relevant section of ISO/SAE 21434 and did not. As an example,
commenters pointed out that [G.12] and [G.37] \27\ could refer to the
relevant clauses of ISO/SAE 21434. NHTSA adopted these suggestions and
added a reference to ISO/SAE 21434

[[Page 55463]]

clause 6 in [G.12]. General practice [G.37] \28\ now references
requirements in clauses 5 and 6 of ISO/SAE 21434. Another commenter
corrected NHTSA's reference to ISO/SAE 21434 in a footnote to general
practice [G.16]. NHTSA accepted that correction.
---------------------------------------------------------------------------

\27\ In the draft version, this was G.35.
\28\ In the draft version, this was G.35.
---------------------------------------------------------------------------

NHTSA also included the website https://www.saemobilius.sae.org as
a source for ISO/SAE 21434 in addition to the previously referenced
https://www.iso.org.

e. Commenter Requested Additional References to Other Standards

Another category of comments requested that NHTSA provide new
references to additional source material that were favored by the
commenter. In many cases, NHTSA was able to incorporate these
suggestions. NHTSA added only those references and referenced materials
that the agency found were: (1) Sufficiently high level; (2) Specific
to automotive industry or could be obviously applied to the automotive
industry; (3) Not under development; and/or (4) Not duplicative of
information or references already included in the Draft Best Practices.
For example, one commenter stated that NHTSA should add references
to the NIST cryptography standards to supplement technical practice
[T.4],\29\ dealing with cryptographic credentials. NHTSA decided that
this modification met the criteria described above, and the agency
adopted this suggestion by adding a technical practice [T.3] and a
reference to NIST's Federal Information Processing Standards (FIPS) 140
Series. The FIPS 140 series is a set of documents updated by NIST that
describes minimum standards for cryptography.
---------------------------------------------------------------------------

\29\ In the draft version, this was T.3.
---------------------------------------------------------------------------

Another commenter stated that NHTSA should reference ISO 24089
``Road vehicles--Software update engineering'' in the Best Practices.
NHTSA did not incorporate this comment because ISO 24089 is under
development at this time. NHTSA may revisit this decision in future
iterations of its cybersecurity best practices after ISO 24089 is
finalized.
NMFTA requested that NHTSA reference the Cybersecurity and
Infrastructure Security Agency's (CISA's) binding operational directive
20-01 in general practice [G.27]'s \30\ discussion of vulnerability
reporting. NHTSA agreed with this change and felt that it provided
support for the guidance.
---------------------------------------------------------------------------

\30\ In the draft version, this was G.26.
---------------------------------------------------------------------------

In response to a comment from SAE, NHTSA also added a reference to
a NIST white paper titled ``Mitigating the Risk of Software
Vulnerabilities by Adopting a Secure Software Development Framework
(SSDF)'' for general practice [G.22], dealing with best practices for
secure software development.
Responding to a comment from NMFTA, NHTSA added a footnote
reference to the SAE CyberAuto Challenge and the Cyber Truck Challenge
as examples for general practice [G.40],\31\ dealing with educational
efforts targeted at workforce development in the field of automotive
cybersecurity. NHTSA also used this additional footnote to call out
NHTSA's efforts to fund and develop cybersecurity curricula.
---------------------------------------------------------------------------

\31\ In the draft version, this was G.38.
---------------------------------------------------------------------------

Other commenters requested that NHTSA add in references to the
World Forum for Harmonization of Vehicle Regulation's (WP.29) United
Nations (UN) Regulation 155--``Cyber security and cyber security
management system.'' In most cases, the public comments recommended
high-level alignment, without further specifying the sources of
potential misalignment that may have been a concern. UN ECE 155 is a
type-approval regulation \32\ that establishes not only recommended
practices but also sufficiency standards for approval. Standards for
type approval are well beyond the scope and intent of NHTSA's Best
Practices document. Therefore, NHTSA did not explicitly reference the
UN ECE 155. NHTSA could revisit this topic in future iterations based
on more specific public feedback.
---------------------------------------------------------------------------

\32\ UN ECE 155 is a regulation established under the United
Nations Economic Commission for Europe (UNECE) 1958 Agreement
concerning the Adoption of Uniform Technical Prescriptions for
Wheeled Vehicles, Equipment and Parts which can be Fitted and/or be
Used on Wheeled Vehicles and the Conditions for Reciprocal
Recognition of Approvals Granted on the Basis of these Prescriptions
(Available at https://unece.org/trans/main/wp29/wp29regs), and the
United States is not party to this agreement. Further, UN Regulation
155 is a regulation for type approving authorities, and the United
States is not a country that engages in type approval of motor
vehicles or motor vehicle equipment.
---------------------------------------------------------------------------

f. Commenter Requested Clarification of Entity Designations

Several comments pointed out that the NHTSA's Cybersecurity Best
Practices seemed to falsely suggest that the Auto-ISAC is a standard
setting organization (SSO). NHTSA has modified general practices [G.18]
and [G.23] in an effort to correct this impression. Even so, these
modifications should not be interpretated as anything more than textual
clarifications. The modifications do not represent any change in
NHTSA's position that guidance to industry, whether from a SSO or not,
can be valuable to encourage progress in cybersecurity practices of the
automotive industry.

g. Commenters Requested Changes in Scope

Many commenters requested a variety of changes in scope for the
Draft Best Practices. Commenters diverged in their requests for changes
to the scope. NHTSA did not incorporate most of the requested scope
changes because NHTSA carefully considered the scope of the Draft Best
Practices document at the development and drafting stages, and NHTSA
believes that the existing scope of the document is most compatible
with its mission and goals for this document. For example, narrowing
the scope might imply inaccurately that NHTSA does not intend this
guidance to be useful to all its regulated entities, and broadening the
scope might exceed the agency's intended audience.
While most comments concerning the document's scope were not
incorporated, NHTSA responded to the National Automobile Dealers
Association's comments concerning the critical role of automotive
dealers by adding the word ``maintenance'' to the following text of the
Scope, which was an explicit clarification that scope includes that
function: ``Importantly, all individuals and organizations involved in
the design, manufacturing, assembly and maintenance of a motor vehicle
have a critical role to play with respect to vehicle cybersecurity.''
Many commenters felt that NHTSA needed to address heavy trucks more
explicitly and directly, but NHTSA believes this would be unnecessary
since the scope of the Draft Best Practices already includes heavy
trucks.
Other commenters felt that NHTSA needed to more explicitly address
vehicles equipped with Automated Driving Systems (ADS), asserting that
these vehicles would have cybersecurity needs much different from
modern vehicles. NHTSA believes that the underlying technical sources
of cybersecurity vulnerabilities as well as risk-based approaches and
toolsets to address them are unlikely to be substantially different for
vehicles equipped with ADS. Therefore, at the levels of guidance
included, the Draft Best Practices already covers vehicles equipped
with ADS, and NHTSA believes that any more specificity for ADS is
unnecessary at this time.

[[Page 55464]]

However, the Agency believes that the societal risk tolerance
associated with cybersecurity risks for vehicles equipped with ADS may
be significantly lower than for traditional vehicles, and, thus, the
Agency will continue to monitor factors around these recommendations
with incoming research results and consider them in future updates.
Some commenters stated that NHTSA should explicitly address
enterprise information technology (IT) issues. While NHTSA agrees that
enterprise IT security is an important topic, NHTSA specifically
avoided making suggestions regarding internet infrastructure that do
not directly touch vehicles. NHTSA recognizes that a hypothetical
situation, such as the theft of vehicle code signing keys from a poorly
secured, internet-connected server, could be an example of an
enterprise IT security issue that could impact a vehicle. However, as
part of this document's scope, NHTSA focuses primarily on those
cybersecurity issues that directly impact vehicles, and thus occupant
and road user, safety. In addition to cybersecurity safety issues,
NHTSA is invested in vehicle theft prevention and engages in activities
to reduce motor vehicle theft through its Vehicle Theft Prevention
Program.
Another set of commenters requested that NHTSA expand the scope of
the Draft Best Practices to address a variety of consumer privacy
issues. Many of these commenters indicated that they believed that a
substantial part of cybersecurity implicates privacy and privacy cannot
be separated from cybersecurity. In this vein, some comments suggested
that NHTSA needed to address a concept called the confidentiality,
integrity, and availability triad, aka ``CIA triad.'' \33\ While NHTSA
agrees about the general importance of the topic of consumer
confidentiality, NHTSA's Best Practices retains its intended focus on
cybersecurity, particularly those cybersecurity issues that could
impact the safety of the vehicle or equipment safety. NHTSA believes
this focus most closely aligns with its safety mission. We believe
privacy issues can and should be addressed elsewhere.
---------------------------------------------------------------------------

\33\ https://en.wikipedia.org/wiki/Information_security.
---------------------------------------------------------------------------

Finally, many commenters expressed concern that NHTSA's
Cybersecurity Best Practices focused on the automotive industry at the
expense of advising the consumer. NHTSA's intended audience for the
Best Practices is the regulated industry. The primary responsibility
for vehicle and equipment safety, including that of vehicle software
and any cybersecurity protections applied, is industry, and NHTSA
retains this focus in the final version. NHTSA is interested in
consumer education topics, but the agency believes that an educated
consumer provides an additional layer of protection that does not
change the best practices recommendations to the automotive industry.

h. Right To Repair

Many comments discussed right-to-repair issues. Some of the right-
to-repair comments suggested that NHTSA assign software rights to
various parties. As stated in the Draft Best Practices and
elsewhere,\34\ NHTSA considers serviceability to be so important that
in the Best Practices retain a separate section on the issue that
includes the general practice [G.45]: \35\ ``The automotive industry
should provide strong vehicle cybersecurity protections that do not
unduly restrict access by alternative third-party repair services
authorized by the vehicle owner.'' Providing any party with a
particular access or right to vehicle software is outside the scope and
intent of this document, even though NHTSA's interest in facilitating
serviceability without undue restrictions remains the same. The Best
Practices do not hinder industry's ability to facilitate appropriate
levels of access to any party while achieving cybersecurity goals.
---------------------------------------------------------------------------

\34\ https://www.nhtsa.gov/sites/nhtsa.gov/files/documents/nhtsa_testimony_in_response_to_ma_committee_letter_july_20_2020.pdf.
\35\ In the draft version, this was G.43.
---------------------------------------------------------------------------

IV. Economic Analysis for Cybersecurity Best Practices for the Safety
of Modern Vehicles

NHTSA is finalizing its Cybersecurity Best Practices for the Safety
of Modern Vehicles, which is non-binding (i.e., voluntary) guidance
provided to serve as a resource for industry on safety-related
cybersecurity issues for motor vehicles and motor vehicle equipment. As
guidance, the document touches on a wide array of issues related to
safety-related cybersecurity practices, and provides recommendations to
industry on the following topics: (1) General Cybersecurity Best
Practices, (2) Education, (3) Aftermarket/User Owned Devices, (4)
Serviceability, and (5) Technical Vehicle Cybersecurity Best Practices.
NHTSA considered the potential benefits and costs that may occur if
companies in the automotive industry decide to integrate the
recommendations in the Best Practices into their business practices.
The following is a summary of the considerations that NHTSA evaluated
for purposes of this section.
First, although as guidance the Best Practices is voluntary, NHTSA
expects that many entities will conform their practices to the
recommendations endorsed by NHTSA. NHTSA believes that the
Cybersecurity Best Practices for the Safety of Modern Vehicles serve as
means of facilitating common understanding across industry regarding
best practices for cybersecurity.
Second, the diversity among the entities to which the Best
Practices apply is vast. The recommendations found in Cybersecurity
Best Practices for the Safety of Modern Vehicles are necessarily
general and flexible enough to be applied to any industry entity,
regardless of size or staffing. The recommendations contained within
the best practices are intended to be applicable to all individuals and
organizations involved in the design, development, manufacture, and
assembly of a motor vehicle and its electronic systems and software.
These entities include, but are not limited to, small and large volume
motor vehicle and motor vehicle equipment designers, suppliers,
manufacturers, modifiers, and alterers. NHTSA recognizes that there is
a great deal of organizational diversity among the intended audience,
resulting in a variety of approaches, organizational sizes, and
staffing needs. NHTSA also expects that these entities have varying
levels of organizational maturity related to cybersecurity, and varying
levels of potential cybersecurity risks. These expectations, combined
with NHTSA's lack of detailed knowledge of the organizational maturity
and implementation of any recommendations contained within the
guidance, make it difficult for NHTSA to develop a reasonable
quantification of the per-organization cost of implementing the
recommendations.
Third, any costs associated with applying the Best Practices would
be limited to the incremental cost of applying the new recommendations
included in the document (as opposed to those in the 2016 Best
Practices). The updated Cybersecurity Best Practices for the Safety of
Modern Vehicles document highlights a total of 70 enumerated best
practices, 21 of which could be considered ``new'' relative to the
first version published in 2016.
Fourth, costs could be limited by organizations who have
implemented some of the recommendations prior to this request for
comment. NHTSA is unaware of the extent to which various entities have
already implemented NHTSA's recommendations, and

[[Page 55465]]

determining the incremental costs associated with full implementation
of the recommendations is effectively impossible without detailed
insight into the organizational processes of every company.
Fifth, many of NHTSA's recommendations lean very heavily on
industry standards, such as ISO/SAE 21434. Three of the 21 ``new'' best
practices simply reference the ISO/SAE 21434 industry standard. Since
many aspects of NHTSA's recommendations are mapped to an industry
standard, costs would also be limited for those companies who are
adopting ISO/SAE 21434 already. Thus, it would be very difficult to
parse whether a company implemented ISO/SAE 21434 or whether it had
decided to adopt NHTSA's voluntary recommendations. While the Best
Practices have some recommendations \36\ that cannot be mapped to an
industry standards document at this time, most of those recommendations
involve common vehicle engineering and sound business management
practices, such as risk assessment and supply-chain management. For
these recommendations, NHTSA's inclusion in the Best Practices serve as
a reminder.
---------------------------------------------------------------------------

\36\ For example, G.6 in Section 4.2.3 recommends consideration
of sensor vulnerabilities as part of risk assessment; and G.10 and
G.11 in Section 4.2.6 recommend tracking software components on
vehicles in a manner similar to hardware components.
---------------------------------------------------------------------------

Regarding benefits, entities that do not implement appropriate
cybersecurity measures, like those guided by these recommendations, or
other sound controls, face a higher risk of cyberattack or increased
exposure in the event of a cyberattack, potentially leading to safety
concerns for the public. Implementation of the best practices can,
therefore, facilitate ``cost prevention'' in the sense that failure to
adopt appropriate cybersecurity practices could result in other direct
or indirect costs to companies (i.e., personal injury, vehicle damage,
warranty, recall, or voluntary repair/updates).
The best practices outlined in this document help organizations
measure their residual risks better, particularly the safety risks
associated with potential cybersecurity issues in motor vehicles and
motor vehicle equipment that they design and manufacture. Further, the
document provides a toolset of techniques organizations can utilize
commensurate to their measured risks and take appropriate actions to
reduce or eliminate them. Doing so could lower the future liabilities
these risks represent in terms of safety risks to public and business
costs associated with addressing them.
In addition, quantitatively positive externalities have been shown
to stem from vehicle safety and security measures (Ayres & Levitt,
1998). The high marginal cost of cybersecurity failures (crashes)
extends to third parties. Widely accepted adoption of sound
cybersecurity practices limits these potential costs and lessens
incentives for attempts at market disruption (i.e., signal
manipulation, Global Positioning System (GPS) spoofing, or reverse
engineering).

Issued in Washington, DC, under authority delegated in 49 CFR
1.95 and 501.8.
Cem Hatipoglu,
Associate Administrator, Vehicle Safety Research.
[FR Doc. 2022-19507 Filed 9-8-22; 8:45 am]
BILLING CODE 4910-59-P