Software Update Management System (SUMS)
A system for the secure and safe management of software updates, including over-the-air (OTA) updates, throughout a vehicle's lifetime.
How the laws define this
Both instruments agree that a Software Update Management System is an essential mechanism for ensuring the safe and secure management of vehicle software updates throughout a vehicle's complete lifespan, from production through end-of-life, specifically to preserve cybersecurity and software integrity. However, the instruments diverge in their operational scope and focus. UN Regulation No. 155 characterizes SUMS primarily as a system focused on mitigating post-production cybersecurity risks and explicitly references over-the-air (OTA) updates. Conversely, UNECE WP.29 UN Regulation No. 156 defines SUMS far more broadly as a comprehensive manufacturer framework encompassing processes, governance structures, and personnel responsibilities. While UN Regulation No. 155 centers on post-production risk mitigation, UNECE WP.29 UN Regulation No. 156 extends the requirement to cover full lifecycle traceability, type approval compliance, risk assessment, change management, documentation, and post-update verification across development, approval, delivery, and installation stages.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
Definitions (2)
A system, as defined in UN Regulation No. 156, for the secure and safe management of software updates, including over-the-air (OTA) updates, throughout a vehicle's lifetime. This system is crucial for mitigating cybersecurity risks identified post-production and ensuring the ongoing security of vehicle software.
SUMS refers to the comprehensive set of processes, responsibilities, and governance structures implemented by a vehicle manufacturer to ensure that all software updates are developed, approved, delivered, installed, and validated in a secure, safe, and traceable manner. This system is critical for maintaining the vehicle's integrity, cybersecurity posture, and continued compliance with type approval requirements from production to end-of-life. It encompasses risk assessment, change management, documentation, and post-update verification.