The SOQRATES working group as an innovation task force of Tier 1 and OEMs have elaborated in the last 13 years experiences about combining ASPICE assessments with ISO 26262 functional safety audits and assessments. In a recent update in 2024 the working group mapped now all ISO 26262 objectives from parts 2,3,4,5,6,8,9 of the ISO 26262 to the different ASPICE practices. This work was then also integrated into the assessment portal Capability Adviser and used in assessments. This paper describes this newest mapping and also outlines more exactly where ASPICE and functional safety are overlapping and which level of detail or parts an ASPI E assessment would not cover and an additional safety assessment report is required.

ABSTRACT In the EU blueprint project FLAMENCO (Forward Looking Approaches for Green Mobility Ecosystem Network Collaboration), an innovation agent task force has been founded, which acts as an expert panel to elaborate a skills set of an innovation agent for automotive and establishes an innovation capability assessment model based on the ISO 560xx Innovation Management Systems norm series. In 2024, a new EU project TRIREME (Digital & Green Skills Towards Future of the Mobility Ecosystem, 2024–2027) started, which builds on this existing innovation agent task force and provides resources to elaborate MOOcs (Massive Open Online Courses) per chapter of the ISO 5600x norm applying new tools like AI. The MOOC is then configured in a European Skills Hub of the ASA (Automotive Skills Alliance). ASA represents the pact for skills partner in the EU Erasmus+ program for the automotive sector. The research work about the use of AI (artificial intelligence) for the implementation of specific ISO 560xx chapters will be published. This paper is about the results of the work on the ISO 56006 Strategic Intelligence Management implementation using AI in the TRIREME project.

ABSTRACT Automotive SPICE for Cybersecurity incorporates the Cybersecurity Risk Management process (MAN.7), aligning with the Risk Assessment methods defined in ISO/SAE 21434:2021 (Clause 15). Both standards provide guidance on conducting Threat Analysis and Risk Assessments (TARA). However, they do not specify how to integrate the determination of attack feasibility when multiple TARAs emerge across different development phases. This paper explores how the concept of freedom from interference can facilitate a unified approach to determining attack feasibility in such scenarios.

Automotive SPICE® for Cybersecurity contains Cybersecurity Risk Management process (MAN.7) corresponding to Risk Assessment Methods (ISO/SAE 21434:2021-clause 15). Both standards describe how a Threat Analysis and Risk Assessment (TARA) should be carried out. However, they leave open how, in the event that several TARAs arise at different levels/different points in a life cycle model or a supply chain, these can be synchronized. This paper will outline different scenarios how to perform and synchronize different TARAs performed.

Abstract Cybersecurity has become one of the most crucial challenges in the automotive development lifecycle. The upcoming ISO/SAE 21434 standard provides only a generic framework that is insufficient to derive concrete design methods. This article proposes an actionable cybersecurity development lifecycle model that provides concrete action and work product guidance aligned with the ISO/SAE 21434 and Automotive SPICE® extension for cybersecurity. The model has been inspired by action research in “next” industry practice pilot projects, which ensures that it is actionable. It has been augmented by insights gained from literature research in cybersecurity development for embedded systems. The proposed lifecycle model complements the ISO/SAE 21434 standard and provides the basis for the company‐specific process and practice specifications. It has been validated through the integration of cybersecurity‐related aspects in an electric power steering system. A core characteristic of the model is the central role of threat modeling, vulnerability analyses, and cybersecurity requirements derivation on both system and subsystem levels. Without concrete practice guidelines, the ISO/SAE 21434 is very difficult to understand and apply at this stage. This contribution aims to fill this gap through a model inspired by cutting‐edge embedded cybersecurity practices interpreted for the current and near‐future automotive electronic architectures.

Abstract In August 2021 the ISO 21434:2021 standard for Road vehicles—Cybersecurity Engineering has been published. At the same time the blue book from VDA (Verein der Deutschen Automobilgesellschaft; German Automotive Association) for Automotive SPICE cybersecurity assessments has been released. In addition in the period September–December 2021 the training material for iNTACS (INTernational Assessor Certification Schema) certified Automotive SPICE for cybersecurity assessors has been developed. Since February 2022 the upgrade training of assessors worldwide has started. Beside the ASPICE (Automotive SPICE) for cybersecurity blue book also a red book from VDA has been published. The red book describes the questions to check in an ACSMS (Automotive CyberSecurity Management System) audit. This paper explains the main strategy and content for ASPICE for Cybersecurity assessments and how such assessments are integrated to the overall ACSMS strategy. Also, the paper outlines an example method and tool used in ASPICE for cybersecurity assessments and how such assessment results will look like.

Abstract The Verein der Deutschen Automobilindustrie (VDA) guidelines used for the interpretation of Automotive SPICE 3.1 contain many rules and recommendations and assessors apply them to check the consistency of ratings in an assessment. The VDA guidelines contain detailed procedures and templates to be used in planning, performing and reporting an assessment. However, an assessment is only a small part compared with the support and effort needed to implement improvements and to establish a company‐wide process improvement programme based on best practices. Whereas the VDA guidelines define the assessment process in detail, the ISO norm ISO/IEC 33014:2013 (Information technology—Process assessment—Guide for process improvement) defines a process improvement process. This paper analyses the ISO/IEC 33014:2013 norm and interprets it for the automotive sector and describes a state of the art improvement strategy typical of the automotive industry. Also, the SOQRATES group experiences about good and bad practices in implementing improvement programmes are shared and mapped onto the SPI manifesto principles. The paper concludes with a recommendation to add an improvement strategy‐related appendix to the VDA guidelines.

Abstract Until 2019 the VDA (German Automotive Association) did not accept online assessments. Then the pandemic of COVID‐19 led to a situation where for a certain time, travel and cooperation on site were not allowed any more. The VDA then allowed online assessments and hybrid assessments. Hybrid means that part of the assessment team is on place and part of the team is online connected. However, also full online assessments were allowed. In 2022, the impact of COVID‐19 decreased and still the online setup of assessments maintained. This paper will discuss this situation and outline a study from Valeo, which gives feedback about these online assessments and their effectiveness.

Abstract Didactic, teacher‐centred approaches and rote learning have long been discredited and gradually replaced by participative, interactive and creative learning sessions. Formal classroom sessions are being replaced or augmented by self‐directed study increasingly in distance mode. The evolution and affordability of technologies enables massive participation in studies, not only for short training for professional updating but also for longer study periods and attainment of qualifications. The rapid changes in society and technology demand that everybody continuously updates their knowledge and skills in their area of expertise and gain knowledge, skills and competencies in other areas for a successful life of careers and not necessarily a career for life as was the norm in the past. It is important to safeguard the quality of independent assessment and certification methods. In this paper, we consider the main delivery methods and their impact on assessment methods and associated results. With reference to the European Certification and Qualification Association framework and the recently completed European Union co‐funded Lifelong Learning Programme project VALO, we juxtapose the delivery methods used and the examination results at different partner institutions. We extract observed issues and trends, which could be principles to be adopted by future projects with regards to process improvement and performance enhancement. Copyright © 2015 John Wiley & Sons, Ltd.