Publishing and copyright information

The BSI copyright notice displayed in this document indicates when the document was last issued.

No copying without BSI permission except as permitted by copyright law.

Publication history

First published December 2018

Foreword

This PAS was sponsored by the Centre for the Protection of National Infrastructure (CPNI). Its development was facilitated by BSI Standards Limited and it was published under licence from The British Standards Institution. It came into effect on 31 December 2018.

Acknowledgement is given to the technical authors Robin Bloomfield, Eoin Butler, Peter Bishop and Robert Stroud of Adelard, and to the following organizations that were involved in the development of this PAS as members of the steering group:

•	Adelard
•	Atkins
•	Automotive Electronic Systems Innovation Network (AESIN)
•	BodVoc
•	Centre for the Protection of National Infrastructure (CPNI)
•	Defence Science and Technology Laboratory (Dstl)
•	Department for Transport (DfT)
•	Halfords Autocentres
•	Highways England
•	HORIBA MIRA
•	McLaren Automotive Ltd
•	Ricardo
•	Stagecoach Group
•	The National Cyber Security Centre (NCSC)
•	Waverley House Consultancy Ltd

Acknowledgement is also given to the members of a wider review panel who were consulted in the development of this PAS.

The British Standards Institution retains ownership and copyright of this PAS. BSI Standards Limited as the publisher of the PAS reserves the right to withdraw or amend this PAS on receipt of authoritative advice that it is appropriate to do so. This PAS will be reviewed at intervals not exceeding two years, and any amendments arising from the review will be published as an amended PAS and publicized in Update Standards.

This PAS is not to be regarded as a British Standard. It will be withdrawn upon publication of its content in, or as, a British Standard.

The PAS process enables a code of practice to be rapidly developed in order to fulfil an immediate need in industry. A PAS can be considered for further development as a British Standard, or constitute part of the UK input into the development of a European or International Standard.

Use of this document

As a code of practice, this PAS takes the form of guidance and recommendations. It should not be quoted as if it were a specification and particular care should be taken to ensure that claims of compliance are not misleading.

Any user claiming compliance with this PAS is expected to be able to justify any course of action that deviates from its recommendations.

It has been assumed in the preparation of this PAS that the execution of its provisions will be entrusted to appropriately qualified and experienced people, for whose use it has been produced.

Information about this document

The CAV principles given in this PAS are reproduced from the Department for Transport (DfT) Centre for Connected and Autonomous Vehicles (CCAV)’s “The key principles of cyber security for connected and automated vehicles” [1] and contain public sector information licensed under the Open Government Licence v.3.0.

Presentational conventions

The provisions of this PAS are presented in roman (i.e. upright) type. Its recommendations are expressed in sentences in which the principal auxiliary verb is “should”.

Commentary, explanation and general informative material is presented in smaller italic type, and does not constitute a normative element.

Where words have alternative spellings, the preferred spelling of the Shorter Oxford English Dictionary is used (e.g. “organization” rather than “organisation”).

Contractual and legal considerations

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a PAS cannot confer immunity from legal obligations.

0 Introduction

0.1 The connected automotive ecosystem

0.2 Security-informed safety

0.3 The approach taken for this PAS

0.4 How this PAS helps

1 Scope

This PAS gives recommendations for managing security risks that might lead to a compromise of safety in a connected automotive ecosystem.

The PAS covers both the entire connected automotive ecosystem and its constituent systems throughout their lifetimes (including manufacturing, supply chain and maintenance activities). The ecosystem includes vehicles (both those used on public roads, such as cars, and those used for off-road activities such as farming and mining), as well as road-side and other static infrastructure, communication channels between vehicles and infrastructure, servicing and repair facilities, digital services, data and information and other services that support the proper operation of road transport. All levels of vehicle automation and autonomy are in scope.

The PAS applies to risks that can affect a single system, a few systems, or are on a small scale. It also gives recommendations for managing systemic risks – wider risks which might appear small, but which become more significant when interdependencies are considered and where the vulnerability of a single or a few entities poses more widespread risk.

The PAS is intended to be used by manufacturers, operators and maintainers of products, systems and services used in a connected automotive ecosystem. This includes manufacturers of vehicle subsystems, vehicle manufacturers, maintenance organizations, infrastructure operators, owners of large vehicle fleets, and digital service providers.

This PAS might be of interest to regulators and other stakeholders in the connected automotive ecosystem and to users/operators of vehicles.

2 Terms, definitions and abbreviations

2.1 Terms and definitions

2.2 Abbreviations

3 Security policy, organization and culture

3.1 Policies and processes

3.2 Responsibility and accountability

3.3 Risk management

3.4 Asset management

3.5 Supply chain and other external dependencies

3.6 Security awareness and competency

3.7 Culture and communication

3.8 Protection of information

4 Security-aware development process

4.1 General

4.2 Risk assessment and requirements definition

4.3 Design considerations

4.4 Demonstration of security

4.5 Assurance

4.6 Manufacturing

4.7 Third-party components

4.8 Deployment

4.9 Operation, maintenance and decommissioning

5 Maintaining effective defences

5.1 Protect, detect, respond

5.2 Secure operation, maintenance and decommissioning

5.3 Access control

5.4 Product, system and service updates

5.5 Innovation

5.6 Discovery of vulnerabilities

5.7 Threat monitoring

5.8 Continuing risk management

6 Incident management

6.1 Planning

6.2 Detection of security issues

6.3 Assessment

6.4 Response

6.5 Post-event

7 Secure and safe design

7.1 General

7.2 Secure design principles

7.3 Secure system configuration

7.4 Behaviour on failure

7.5 Defence in depth

7.6 Use of cryptography

7.7 Protection of software

7.8 Diagnostics

7.9 Patching and updates

7.10 Protection of communications

7.11 External services and devices

7.12 Forensic recording

7.13 Secure user behaviour and interfaces

7.14 Development environment

8 Contributing to a safe and secure world

8.1 Managing risks

8.2 Compatibility and interoperability

8.3 Information sharing

8.4 Collaboration

Bibliography

PAS 11281:2018

Connected automotive ecosystems. Impact of security on safety. Code of practice

Published:

31 Dec 2018

Withdrawn:

7 Apr 2026