100M lines of code. Hundreds of ECUs. Dozens of suppliers. One OEM accountable under UN R155.
Partner with Siemens and Black Duck to turn cybersecurity evidence into customer trust, regulator & investor confidence, and procurement advantage.
UN R155 makes cybersecurity evidence a launch requirement. Since July 2024, new vehicles in the EU must demonstrate a certified Cybersecurity Management System before road approval. The OEM owns that proof, even when the software comes from Tier 1, Tier 2, and Tier 3 suppliers. ISO/SAE 21434 defines the engineering discipline, but UN R155 demands proof that it works across the full supplier chain: TARA evidence, cybersecurity interface agreements, ECU SBOMs, vulnerability handling, approvals, remediation records, and lifecycle traceability.
X-DLM™ connects Siemens Polarion and Black Duck into one governed evidence system: Siemens brings lifecycle governance credibility to automotive engineering and quality programs; Black Duck brings software supply chain credibility across security, legal, procurement, and diligence.
X-DLM™ helps OEMs and suppliers produce type-approval-ready cybersecurity evidence before supplier gaps become launch risk.
and
Software-defined vehicles have made cybersecurity a type-approval prerequisite. And the OEM's supplier chain is the audit's primary focus.
Lines of code in a modern electric vehicle — spread across 100+ ECUs from Tier 1, 2, and 3 suppliers. UN R155 makes the OEM responsible for cybersecurity evidence of all of it.
Countries where UNECE R155/R156 type approval compliance is mandatory — including all EU member states, Japan, South Korea, Australia, and others. The market access consequence of non-conformity is global.
Of automotive cyberattacks exploit weaknesses in software systems — including open-source ECU dependencies from suppliers who have never run a vulnerability scan. Source: Upstream 2024 Automotive Cybersecurity Report.
Automotive codebases with high or critical open source exposure, per OSSRA 2026. In supplier-heavy vehicle programs, unmanaged software risk becomes launch risk.
Sources: Upstream Automotive Cybersecurity Report 2024. UNECE WP.29 R155 enforcement timeline. OSSRA 2026. FIDO Alliance Automotive Cybersecurity White Paper.
UN R155 Active · ISO 21434 Required · EU CRA Sept 2026 — All Simultaneously
Automotive cybersecurity is now a prerequisite for market entry in every major vehicle market. Not a feature. A condition of sale.
UNECE R155 / R156
Type Approval Gate
UN R155 mandates a certified Cybersecurity Management System (CSMS) for every new vehicle type across 54+ markets. Type approval is denied without it. R155 requires OEMs to prove cybersecurity governance cascades through the entire supply chain — including Tier 1, 2, and 3 supplier cybersecurity interface agreements and TARA evidence.
ISO/SAE 21434
Engineering Evidence Standard
ISO 21434 provides the engineering framework that R155 type approval auditors evaluate. It governs TARA (Threat Analysis and Risk Assessment), cybersecurity goals, requirements, verification, and post-development monitoring. Tier 1 suppliers who cannot produce ISO 21434-aligned evidence are a risk in the OEM's CSMS certification file.
EU CRA
Parallel Software Obligations
EU CRA now adds SBOM and vulnerability reporting obligations for vehicle software as Products with Digital Elements — from September 2026. A vehicle software team must answer to R155, ISO 21434, and EU CRA simultaneously — one evidence system must cover all three.
Brand authority buyers recognize
Backed by Siemens lifecycle governance and Black Duck AppSec intelligence.
Siemens Polarion ALM
Polarion provides the lifecycle system of record for requirements, tests, approvals, traceability, workflow automation, audit evidence, and regulated software delivery.
Black Duck Software Composition Analysis
Black Duck identifies open source and third-party components across source, binaries, containers, firmware, snippets, AI-generated code, and C/C++ environments without package managers.
Your next vehicle launch depends on CSMS evidence.
X-DLM™ connects ECU scanning, SBOMs, TARA traceability, and type-approval proof.
Book a 15–30 minute discovery call. We show exactly how X-DLM™ connects Black Duck ECU scanning and Siemens Polarion to produce ISO 21434 TARA traceability, UN R155 CSMS evidence, SBOM data across the supply chain, and EU CRA conformity documentation — before your next type approval audit.
The X-DLM™ automotive trust equation