Bentley achieves UNECE cybersecurity certification with zero faults

Bentley Motors and MHP Consulting UK have completed a project to ensure Bentley's vehicles comply with the United Nations Economic Commission for Europe (UNECE) vehicle regulations on cybersecurity and software updates.

The collaboration resulted in Bentley achieving certification with zero non-conformities following a 24-month process. This work focused on implementing robust Cybersecurity and Software Update Management Systems (CSMS & SUMS), enabling Bentley's GT range to meet the highest standards set out by the UNECE's World Forum for Harmonisation of Vehicle Regulations (WP.29).

UNECE vehicle regulations

As connected vehicles become increasingly prevalent and cyber threats escalate, manufacturers must demonstrate effective systems to protect both vehicles and their users. As of July 2024, original equipment manufacturers (OEMs) such as Bentley are required to comply with UNECE's cybersecurity (R155) and software update (R156) regulations to sell vehicles in its 56 member states.

Beyond compliance, OEMs must maintain the necessary management systems across their organisations and pass audits by technical services to continue operations in UNECE regions. Bentley, which already had advanced systems in place, worked with MHP Consulting to ensure alignment with these regulations for regulatory approvals.

Two-stage project

The Bentley-MHP project was implemented in two primary phases. During Phase 1, the focus was on shaping the required CSMS and SUMS in accordance with UNECE requirements. Bentley and MHP Consulting engaged a technical service to develop and embed concepts and processes that reinforced Bentley's strategic regulatory compliance.

MHP Consulting documented the drive towards compliance, capturing key actions and behaviours, while Bentley interacted with external auditors and regulatory authorities. Audit preparations included the development of a detailed audit strategy with a comprehensive 'dress rehearsal', integration of new requirements into existing processes, alignment with group-wide policies such as ISO21434 and R155/156, the onboarding of relevant IT tools, and clear managerial support.

A structured governance model meant policies and practices met industry benchmarks, resulting in a certification audit with no identified non-conformities.

Phase 2 involved operationalising and executing the management systems established in Phase 1. The project developed a strong programme governance structure, prepared for surveillance audits, and demonstrated the successful running of the relevant IT tools across Bentley's business. Extensive internal training, communication campaigns such as CS Tech Talks and monthly reports, and use of programme management tools aimed to embed cybersecurity culture as a routine part of operations.

Management perspectives

Chris Cole, Product Line Director at Bentley Motors, said:

"We're proud of this close collaboration with MHP Consulting UK, and the fact that Bentley has met the cybersecurity legislative requirements set out by the United Nations Economic Commission for Europe. Not only have our joint teams achieved certification with zero non-conformities, they have pushed the boundaries of innovation, further entrenching cybersecurity as a cultural imperative into the Bentley brand. This is a major achievement for our team and ultimately means that our GT range of vehicles meets the highest cybersecurity and software update management systems."

Bodo Philipp, CEO of MHP Consulting UK, also commented on the significance of the achievement:

"Achieving UNECE compliance is crucial for an OEM's market access, and can therefore mean a bottom-line impact of millions, even billions, depending on the brand. It is key for OEMs to work with proven experts that can help them to navigate the regulatory landscape successfully – especially as the industry becomes more and more dependent on data, internet access and connected services." He adds: "Our teams have done incredibly successful transformative work together. They've led the charge on this initiative, and have set new standards within Bentley – a fantastic achievement. Well done!"

Long-term integration

The achievement allows Bentley's GT vehicles to be sold across the UNECE's 56 member states and is intended to ensure cybersecurity is integrated throughout its business. The systems and governance developed during the project are designed to support ongoing compliance and to protect Bentley's vehicles and customers from evolving cyber threats.