ISO/PAS 5112:2022

Road vehicles — Guidelines for auditing cybersecurity engineering

In addition to the guidelines in ISO 19011, this document provides guidelines to organizations that contribute to the achievement of road vehicle cybersecurity throughout the supply chain on: — managing an audit programme for a cybersecurity management system (CSMS); — conducting organizational CSMS audits; — competencies of CSMS auditors; and — providing evidence during CSMS audits. Elements of the CSMS are based on the processes described in ISO/SAE 21434. This document is applicable to those needing to understand or conduct internal or external audits of a CSMS or to manage a CSMS audit programme. This document does not provide guidelines on cybersecurity assessments.

Véhicules routiers — Lignes directrices pour l’audit de l’ingénierie de la cybersécurité

General Information

• Status: Published
• Publication Date: 30-Mar-2022
• ICS: 03.120.20 - Product and company certification. Conformity assessment
• ICS: 43.040.15 - Car informatics. On board computer systems
• Technical Committee: ISO/TC 22/SC 32 - Electrical and electronic components and general system aspects
• Drafting Committee: ISO/TC 22/SC 32/WG 11 - Cybersecurity
• Current Stage: 6060 - International Standard published
• Start Date: 31-Mar-2022
• Due Date: 07-May-2022
• Completion Date: 31-Mar-2022

Standards Content (Sample)

PUBLICLY ISO/PAS
AVAILABLE 5112
SPECIFICATION
First edition
2022-03
Road vehicles — Guidelines for
auditing cybersecurity engineering
Véhicules routiers — Lignes directrices pour l’audit de l’ingénierie de
la cybersécurité
Reference number
© ISO 2022
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Principles of auditing .2
5 Managing an audit programme .2
5.1 General . 2
5.2 Establishing audit programme objectives . 2
5.3 Determining and evaluating audit programme risks and opportunities . 3
5.4 Establishing the audit programme . 3
5.4.1 Roles and responsibilities of the individual(s) managing the audit
programme . 3
5.4.2 Competence of individual(s) managing audit programme. 3
5.4.3 Establishing extent of audit programme . 3
5.4.4 Determining audit programme resources . 4
5.5 Implementing audit programme . 4
5.5.1 General . 4
5.5.2 Defining the objectives, scope and criteria for an individual audit . 4
5.5.3 Selecting and determining audit methods . 4
5.5.4 Selecting audit team members . 5
5.5.5 Assigning responsibility for an individual audit to the audit team leader . 5
5.5.6 Managing audit programme results . 5
5.5.7 Managing and maintaining audit programme records . 5
5.6 Monitoring audit programme . . 5
5.7 Reviewing and improving audit programme . 5
6 Conducting an audit .5
6.1 General . 5
6.2 Initiating audit . 5
6.2.1 General . 5
6.2.2 Establishing contact with auditee . 5
6.2.3 Determining feasibility of audit . 5
6.3 Preparing audit activities . 5
6.3.1 Performing review of documented information . 5
6.3.2 Audit planning . 6
6.3.3 Assigning work to audit team . 6
6.3.4 Preparing documented information for audit . 6
6.4 Conducting audit activities . 6
6.4.1 General . 6
6.4.2 Assigning roles and responsibilities of guides and observers . . 6
6.4.3 Conducting opening meeting . 6
6.4.4 Communicating during audit. 6
6.4.5 Audit information availability and access . 7
6.4.6 Reviewing documented information while conducting audit. 7
6.4.7 Collecting and verifying information. 7
6.4.8 Generating audit findings . 7
6.4.9 Determining audit conclusions . 8
6.4.10 Conducting closing meeting . 8
6.5 Preparing and distributing audit report . 8
6.5.1 Preparing audit report . 8
6.5.2 Distributing audit report . 8
6.6 Completing audit . 9
iii
6.7 Conducting audit follow-up . 9
7 Competence and evaluation of auditors . 9
7.1 General . 9
7.2 Determining auditor competence . 9
7.2.1 General . 9
7.2.2 Personal behaviour . 9
7.2.3 Knowledge and skills . 9
7.2.4 Achieving auditor competence . 10
7.2.5 Achieving audit team leader competence . 10
7.3 Establishing auditor evaluation criteria . 10
7.4 Selecting appropriate auditor evaluation method . 10
7.5 Conducting auditor evaluation . 10
7.6 Maintaining and improving auditor competence . 10
Annex A (informative) Audit questionnaire .11
Annex B (informative) Auditor competences .19
Bibliography .21
iv
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.
...