CIO Review APAC

Software update management system -- a key prerequisite for software-defined vehicle

CIO Review APAC | Monday, January 15, 2024

Until five years ago, carmakers were hesitant to introduce cybersecurity measures in vehicles despite being aware of their necessity due to cost issues.

However, when the European Union introduced cybersecurity regulations in 2022, it became virtually impossible to enter the European market without meeting the new standards. The change has made cybersecurity an essential element to ensure the survival of carmakers.

Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.

The advancements in vehicle software, diversification of vehicles’ functions and increase in communication have made software-defined vehicles a hot topic for the car industry, and cybersecurity is the final element in building SDVs.

The fact that United Nations Economic Commission for Europe World Forum for Harmonization of Vehicle Regulations adopted UN Regulation No. 155, No. 156 in June 2020 to lay the foundations for the cybersecurity ecosystem is widely known.

This final article in our series on automotive cybersecurity focuses on the last stage of the strategic approach to cybersecurity regulations. It specifically addresses the concept of Software Update Management System, exploring associated challenges and the strategies to effectively manage them.

1. Software updates and SUMS

As the automotive industry shifts toward SDVs, demand is on the rise for post-production software updates. These updates are key to improving vehicle features and extending customer service. Polestar Korea's response to a dashboard speed display issue last year is a case in point. The company promptly addressed the discrepancy of 1 to 3 kilometers per hour through a voluntary recall and free over-the-air updates, enhancing customer convenience and trust.

The significance of software updates further aligns with the global regulatory focus. In June 2020, the aforementioned global forum on motor vehicle regulations adopted UN Regulation No. 156 to ensure safe software update policies and procedures. Compliance with this regulation requires automakers to obtain Software Update Management System certification and Vehicle Type Approval. Encompassing a wide range of products from passenger vehicles to agricultural machinery, Regulation No. 156 places particular emphasis on Article 7 ("general specifications") for automakers, detailing requirements for SUMS and vehicle types.

2. Requirements for SUMS

The establishment of SUMS requires adherence to Article 7, Section 1 subparagraph 1, focusing on the initial assessment process. This involves secure documentation of all software versions and the management of Regulation X Software Identification Number, which is crucial for identifying and managing software versions for regulatory compliance. A vehicle with a RXSWIN must meet several criteria: consistency with type approved software, interdependency with other System, identification of vehicles requiring updates, compatibility between new software and vehicle configuration and the ability to record and assess the update’s impact on type-approved System.

3. Requirements for vehicle type

For vehicle types, the focus is on software and over-the-air updates. Under Article 7, Section 2, subparagraph 1 of Regulation No. 156, manufacturers must ensure the authenticity and integrity of updates, while preventing compromised or invalid ones. They must also guarantee that each vehicle type’s RXSWIN is uniquely identifiable. When updating RXSWIN to modify type approved software, automakers must either extend the existing type approval or seek a new one based on the impact of the changes. Additionally, they need to ensure that RXSWIN is accessible through standardized System like the on-board diagnostics interface and protected from unauthorized modifications

For vehicles with over-the-air updates, manufacturers must adhere to guidelines stated in Article 7, Section 2, subparagraph 2. These include the ability of the vehicle to restore its system post-update and maintain sufficient power to ensure proper execution of the update. Automakers are required to inform users before initiating an update, prohibit driving if the update cannot be safely launched, and disable any features that may compromise vehicle safety or interrupt the update process. Upon completion of the update, users should be clearly informed about the outcomes and any changes made.

4. Strategies for SUMS certification preparation

In preparing for SUMS certification, automakers must first evaluate the impact of software updates on each type approval by establishing an effective evaluation process and procedure. Depending on the update's impact, a normal software update may suffice, but thorough validation may be essential in cases of significant changes. This can be a time-consuming and complex process, given the interconnected nature of various vehicle System and domains.

Fescaro, a leading cybersecurity specialist, has developed an automated vehicle software update management system to facilitate this process. Fescaro’s system enables automakers to verify the integrity of each update and evaluate its implications on vehicle type approval, contributing to their path to successful SUMS certification.

The next step involves applying a feature within the cybersecurity-specialized electronic control unit. This system manages software configuration and certification information linking vehicle domains and electronic control units. It plays a crucial role in fulfilling SUMS certification and type approval requirements by enabling vehicle validation, managing software updates, and ensuring safe over-the-air execution.

The cybersecurity-specialized electronic control unit also performs essential security functions, enabling effective compliance with Regulation No. 155’s cybersecurity management system requirements. These functions include protecting the in-vehicle network, detecting abnormal messages in real time and monitoring security information and event management – all of which are instrumental in addressing potential cyberthreats.

5. Key insights of SUMS certification

Achieving SUMS certification requires a comprehensive assessment of the software update’s impact and software configuration management.

However, tracking each type approval, vehicle and electronic control unit poses a real challenge. The key to successful SUMS certification lies in "orchestration" – an integrated approach enhancing workflow productivity. The diagram below illustrates an example of orchestration in the certification process, which involves a seamless integration of vehicle software management System with a cybersecurity-specialized electronic control unit:

An example of orchestration in the SUMS certification process (Fescaro)

Understanding the automotive industry’s complex value chain and the vehicle’s production cycle is equally crucial. This understanding forms the basis for a system that responds effectively to customer needs and regulatory requirements. Close coordination with tier companies, through workshops and seminars, may also facilitate the certification process and ensure regulation compliance.

This article concludes our series on the automotive cybersecurity certification process under UN regulations. A leader in vehicle cybersecurity certification consulting with expertise in all four major certification processes, Fescaro remains committed to providing well-organized, high-level assistance to automakers and tier companies in the field.

(Ku Seong-seo is Fescaro's head of global business sales)

Fescaro is a vehicle cybersecurity specialist that has gone through all major certification processes (CSMS, ISO/SAE 21434, VTA, SUMS). It is the only company in Korea to have obtained what is referred to in the field as the "grand slam of vehicle cybersecurity certification consulting.” - Ed.

 

More in News

The phrase “Shopify support in Asia” can conceal a difficult procurement problem. Asia is not a single ecommerce market, and a merchant asking for construction assistance may have requirements tied to one country and not the region as a whole. Support providers consequently face a basic question before development begins: which local conditions actually matter to the store being built? That question changes the shape of the engagement. A provider serving a merchant in one Asian market may have a different brief from a provider supporting a business that plans to sell across several markets. Treating both assignments as the same type of Shopify construction work can create unnecessary complexity. Payment is one area where this complexity becomes visible. Merchants need a checkout arrangement that fits the markets they serve. Delivery information presents another practical consideration because the store has to communicate what customers can reasonably expect. These elements sit close to the customer’s buying decision, yet they are often handled as technical configuration rather than as part of the broader construction brief. Language and presentation can also affect the build. A storefront intended for one audience may not communicate in the same way when it is expanded into another market. Product descriptions, navigation and other customer-facing information can require attention before the merchant treats the new storefront as ready for launch. This places more responsibility on the discovery stage of a Shopify support project. Providers need enough information from merchants to understand where the store will operate and what the business expects from the site. Merchants, in turn, have to be specific about where they intend to sell rather than assuming that a standard Shopify setup will cover every requirement. A merchant may begin in one Asian market and later add another. If the original construction work was built around narrow assumptions, later expansion can require more rework than expected.  That does not make a bigger setup automatically preferable. It simply means expansion plans should be considered before technical decisions become difficult to change. For service providers, this creates a competitive distinction based less on the ability to produce storefronts and more on the ability to handle market-specific requirements without overbuilding the project. Buyers may want providers that can explain what needs to change for a particular market and what can remain consistent. Shopify support across Asia is therefore likely to remain a locally influenced service category.  The platform provides a common foundation, but the construction work around that foundation depends on where a merchant intends to sell. The real question for buyers is not whether a provider covers Asia in broad terms. It is whether the provider understands the specific market requirements behind the merchant’s expansion plan. ...Read more
A Shopify store can be launched from almost anywhere, but selling into an Asian market often introduces practical work that sits outside the storefront itself. Merchants may have a functioning online shop and still face questions around local payment methods, delivery arrangements or how the site should be presented to customers in a particular country. That gap is creating a distinct role for Shopify construction support services across Asia. The issue is less about building an online store from scratch and more about adapting a commerce operation to the market where it will actually sell. A store designed for one market may not transfer cleanly into another. Product information may need adjustment. Checkout expectations can differ. Delivery information has to reflect the merchant’s actual fulfillment arrangements rather than the assumptions built into an original store. This gives construction support providers a more practical brief. Their work can involve setting up or modifying the Shopify environment around the merchant’s intended market rather than treating the website as a standalone design project. For businesses entering Asia, that distinction matters because technical completion does not necessarily mean commercial readiness. The regional dimension also affects how merchants approach support. A business may understand its products well but have less familiarity with the online buying conditions in a particular Asian market. Support providers can become useful during the points where a merchant has to translate its existing commerce model into a local storefront. That may involve reviewing how information is presented or helping configure functions around the way the business intends to receive orders. Smaller merchants face their own constraints. They may not have internal staff dedicated to Shopify development, leaving the same people responsible for product decisions and website administration.  When a market expansion requires changes to the store, technical work can compete directly with everyday commerce activity. While external construction support can reduce that burden, the quality of the engagement depends heavily on how clearly the merchant defines its local requirements. There is also a question of ownership. Merchants should understand which parts of the store are being changed and how those changes will be maintained after the initial work is complete. A technically finished storefront can become difficult to manage if the original setup depends too heavily on outside intervention. For buyers of Shopify construction support in Asia, geographic knowledge is becoming a useful consideration alongside development ability. The central question is no longer simply whether a provider can build a Shopify store. It is whether the provider understands what has to change when that store is being built for a specific market. ...Read more
The cost of Shopify construction support in Asia is not limited to the initial development engagement. Merchants also have to consider what happens when the store requires changes after launch. A small modification can become more expensive when the person making it is unfamiliar with the original setup, particularly when the merchant has relied on outside support from the beginning. This creates a different purchasing question for businesses considering Shopify support services. Instead of comparing providers only on the basis of construction work, buyers have reason to examine how future changes will be handled. The issue becomes particularly relevant for smaller businesses that may not employ a dedicated technical team. Shopify itself provides a relatively accessible route into online commerce, but accessibility does not remove the need for ongoing technical decisions. Store owners may change products, adjust pricing information or alter the way customers move through the purchasing process. Each modification can introduce dependencies within the existing store. What this means is that for a support provider, the construction phase can influence the merchant’s future workload. A store that is clearly structured and documented may be easier for another developer to modify later.  A setup that is difficult to understand can leave the merchant dependent on the original provider for relatively routine changes. Buyers may not notice this distinction during procurement because both arrangements can produce a functioning storefront at launch. The concern becomes more pronounced when merchants operate across Asian markets. A business serving customers in more than one country may require separate adjustments to the same Shopify environment. Changes made for one market can create additional work elsewhere if the underlying structure has not been planned carefully. That does not mean merchants should automatically choose the most elaborate construction approach. Additional customization can increase the amount of work required to maintain a store. The more useful question is whether the technical structure matches the merchant’s actual plans. A small business serving one market may have very different requirements from a retailer preparing to expand across several markets. Support arrangements also deserve equal attention. A merchant may need occasional development assistance rather than a permanent service relationship. Others may prefer an ongoing arrangement because their storefront changes frequently.  The commercial difference can be significant over time, particularly when the business is still refining its online sales model. For buyers, the takeaway is to treat Shopify construction as part of a longer cost decision rather than a one-time website expense. The initial quotation still matters, but so does the amount of technical dependence created by the work. In Asia’s varied commerce markets, that consideration can influence the true cost of maintaining a Shopify presence long after the original store has gone live. ...Read more
Enterprises across the Asia-Pacific (APAC) region are undergoing rapid digital transformation, making SAP change management services a critical component of successful system implementation and optimization. The complexity of modern SAP environments demands more than just technical execution. It requires structured approaches that address organizational readiness, user adoption, and process alignment. Effective change management ensures smooth transitions, minimal operational disruption, and strong stakeholder engagement to support strategic business goals. In response to this growing demand, top SAP partners are expanding their change management capabilities, offering specialized expertise to help organizations navigate complex transitions. Evolving Dynamics of SAP Change Management Across APAC The APAC region continues to witness a significant transformation in enterprise IT operations, with SAP change management services emerging as a key enabler in digital modernization. The demand for efficient change management is propelled by the widespread adoption of SAP systems across various industries, such as manufacturing, retail, telecommunications, and public services. As businesses integrate more advanced SAP solutions like S/4HANA and cloud-based applications, the emphasis on effective change management strategies has intensified. Organizations now prioritize smooth transitions that minimize disruption and ensure consistent operational performance. This has led to increased investments in structured SAP change management services to align enterprise objectives with technological progress. Key Barriers and Strategic Responses in Implementation Despite the growing recognition of SAP change management services, organizations in APAC often encounter several challenges during the implementation and transformation phases. A common issue is resistance to change among internal stakeholders, particularly when process redesigns or new system functionalities disrupt established routines. Successful service providers employ structured communication strategies and role-based training programs to address this. These approaches are designed to build end-user confidence, clarify the benefits of changes, and enhance system adoption across departments. A significant challenge stems from the complexity of managing SAP environments in multi-entity, multi-country enterprises. Differences in regulatory requirements, language, and organizational culture often complicate change management execution. This challenge is mitigated through tailored localization strategies, where SAP change initiatives are adapted to regional compliance standards and cultural nuances, ensuring smoother transitions and broader acceptance. Technical bottlenecks also pose obstacles, particularly when transitioning from legacy systems or integrating SAP with third-party solutions. Change management services increasingly incorporate early-stage impact assessments and sandbox testing. These measures help identify dependencies and risks, allowing for the refinement of system changes before full-scale deployment. Automation tools in transport management, version control, and audit tracking significantly reduce manual errors and support regulatory alignment. Stakeholder engagement is another area where challenges may emerge, especially in decentralized organizational structures. In these situations, inconsistent messaging and priorities can hinder alignment. The solution lies in establishing change networks, cross-functional teams of change agents and sponsors who advocate for and reinforce the transition across various departments and regions. These internal champions facilitate communication and monitor the effectiveness of the adoption process. Limited visibility into post-implementation outcomes often reduces the perceived value of change management efforts. This is countered through continuous feedback mechanisms and performance-tracking dashboards, which allow organizations to monitor adoption rates, identify pain points, and adjust strategies accordingly. Such real-time insights enhance the responsiveness of change initiatives and ensure that business objectives are met. Emerging Possibilities and Innovations Fueling Growth APAC's SAP change management landscape is rapidly advancing, presenting considerable opportunities for organizations aiming to future-proof their operations. Integrating artificial intelligence and machine learning into change management tools has revolutionized how enterprises manage transformation projects. Predictive analytics can now anticipate user adoption challenges, recommend personalized interventions, and automate repetitive change tasks, thereby improving efficiency and accuracy in execution. The increasing popularity of agile methodologies reshapes how SAP changes are planned and delivered. Instead of traditional waterfall approaches, iterative cycles enable faster response to business needs, improved stakeholder involvement, and more dynamic adaptation to shifting requirements. This agile-driven environment enhances organizational resilience and ensures that SAP systems evolve with strategic priorities. The expansion of cloud-based SAP solutions is also broadening the scope of change management services in APAC. As businesses migrate to the cloud, there is a rising demand for scalable and remote-friendly change strategies that accommodate hybrid work environments. Virtual training modules, cloud-native collaboration platforms, and real-time support services are now integral to change management frameworks, offering greater flexibility and user reach. Data-driven decision-making is increasingly becoming a key element in successful SAP change initiatives. By leveraging data visualization and user behavior analytics, change leaders can gain actionable insights into system performance and user engagement. These insights help fine-tune change strategies and reinforce user confidence, ultimately accelerating the return on investment from SAP transformations. Cross-industry collaboration is another area that is fostering advancement in the field. By adopting standardized best practices and sharing case studies across verticals, organizations in APAC benefit from a collective knowledge base that accelerates learning and reduces common pitfalls. Industry forums, digital learning hubs, and peer-to-peer support communities are instrumental in disseminating these innovations. The rise of a change-centric culture within enterprises is creating a lasting impact. Organizations that embrace continuous improvement, empower internal change champions, and prioritize transparent communication are better positioned to leverage the full potential of their SAP ecosystems. As this cultural shift gains momentum across the APAC region, it strengthens the strategic value of SAP change management services and aligns them with long-term organizational growth. ...Read more
Top