Architecture & Design - RFQX Security Architecture Package

Design Items8component/interface allocations

Unlinked Design Items0must be zero

SSRs Without Design0architecture coverage

Diagrams16Mermaid/source diagrams

Security Review Open8design not final

Assumption Based0customer confirmation pending

Architecture / Design Decision Impact

Downstream engineering artifacts remain provisional until customer clarification closure evidence is complete.

BLOCKED BY CUSTOMER DECISIONP1 OPENSECURITY REVIEW OPENNO AUTO CLOSURE

472open clarification questions

6P1 decisions

0answered by additional PDFs

6security weak areas

Open Customer Decisions & Clarifications

Architecture / Detailed Design Items

This table is horizontally scrollable. Use the bottom scrollbar to view all columns.

Design Item ID	Title	Type	Description	Linked System Requirement IDs	Rationale	Impacted Components	Open Issues	Decision Impact	Diagram Reference
AD-001	Application Software	component	Architecture allocation for Application Software supporting 16 supplier system requirement(s).	SSR-CON-003; SSR-COM-006; SSR-SYS-003; SSR-COM-008; SSR-BOOT-001; SSR-UPD-001; SSR-DAI-004; SSR-SDT-001; SSR-TOOL-003; SSR-BOOT-005; SSR-VV-003; SSR-DAI-005; SSR-RBAC-004; SSR-DIAG-006; SSR-RBAC-006; SSR-COM-011	Grouped from allocated architecture elements in supplier system requirements and requirement-to-architecture traceability.	Bootloader and Application State Handling; Data Authenticity and Integrity Verification; Diagnostic Services; OEM/Customer Review Interface; Secure Communication and Boundary Control; Secure Data Transfer / Data Security Container; Secure Diagnostics / RBAC; Secure communication and freshness protection	Bootloader and Application State Handling; Cybersecurity Concept and Evidence; Data Authenticity and Integrity Verification; Diagnostic Services	SECURITY REVIEW OPEN	Architecture Cockpit Overview
AD-002	Backend and IT Systems	component	Architecture allocation for Backend and IT Systems supporting 13 supplier system requirement(s).	SSR-COM-004; SSR-DAI-003; SSR-TOOL-002; SSR-DIAG-002; SSR-BOOT-004; SSR-UPD-003; SSR-VV-002; SSR-COM-009; SSR-RBAC-003; SSR-DAI-006; SSR-KEY-003; SSR-VV-004; SSR-COM-012	Grouped from allocated architecture elements in supplier system requirements and requirement-to-architecture traceability.	Bootloader and Application State Handling; Data Authenticity and Integrity Verification; Diagnostic Services; Key and Certificate Handling; OEM/Customer Review Interface; Secure Communication and Boundary Control; Secure Diagnostics / RBAC; Secure communication and freshness protection	Bootloader and Application State Handling; Data Authenticity and Integrity Verification; Diagnostic Services; Key and Certificate Handling	SECURITY REVIEW OPEN	Capability-to-Component Map
AD-003	Compliance Process	component	Architecture allocation for Compliance Process supporting 3 supplier system requirement(s).	SSR-VIH-002; SSR-SYS-002; SSR-DIAG-004	Grouped from allocated architecture elements in supplier system requirements and requirement-to-architecture traceability.	Diagnostic Services; System Function; Vulnerability and Incident Handling	Diagnostic Services; System Function; Vulnerability and Incident Handling	SECURITY REVIEW OPEN	Interface Trust Boundary Map
AD-004	Engineering Toolchain	component	Architecture allocation for Engineering Toolchain supporting 1 supplier system requirement(s).	SSR-TOOL-001	Grouped from allocated architecture elements in supplier system requirements and requirement-to-architecture traceability.	Tooling / IT / Evidence Storage	Tooling / IT / Evidence Storage	SECURITY REVIEW OPEN	Security Capability Map
AD-005	External Interfaces	interface	Architecture allocation for External Interfaces supporting 4 supplier system requirement(s).	SSR-VIH-004; SSR-DAI-002; SSR-COM-007; SSR-DIAG-001	Grouped from allocated architecture elements in supplier system requirements and requirement-to-architecture traceability.	Data Authenticity and Integrity Verification; Diagnostic Services; External Interfaces; Vulnerability and Incident Handling	Data Authenticity and Integrity Verification; Diagnostic Services; Secure Communication and Boundary Control; Vulnerability and Incident Handling	SECURITY REVIEW OPEN	Update and Diagnostics Flow
AD-006	Hardware Platform	component	Architecture allocation for Hardware Platform supporting 9 supplier system requirement(s).	SSR-HW-001; SSR-PROD-001; SSR-COM-001; SSR-LIFE-001; SSR-COM-005; SSR-BOOT-002; SSR-UPD-004; SSR-SDT-002; SSR-DIAG-005	Grouped from allocated architecture elements in supplier system requirements and requirement-to-architecture traceability.	Diagnostic Services; Hardware / HSM / Secure Storage; Lifecycle / Field Return / Decommissioning; OEM/Customer Review Interface; Secure Communication and Boundary Control; Secure Data Transfer / Data Security Container; Secure software update and flash readiness; Supplier Development and Production Hardening	Bootloader and Application State Handling; Diagnostic Services; Hardware / HSM / Secure Storage; Lifecycle / Field Return / Decommissioning	SECURITY REVIEW OPEN	Key and Certificate Flow
AD-007	Security Services	component	Architecture allocation for Security Services supporting 12 supplier system requirement(s).	SSR-CON-001; SSR-VIH-001; SSR-CON-002; SSR-DAI-001; SSR-KEY-001; SSR-LOG-001; SSR-RBAC-001; SSR-RBAC-002; SSR-KEY-004; SSR-RBAC-007; SSR-DAI-009; SSR-COM-013	Grouped from allocated architecture elements in supplier system requirements and requirement-to-architecture traceability.	Cybersecurity Concept and Evidence; Data Authenticity and Integrity Verification; Key and Certificate Handling; Secure Diagnostics / RBAC; Secure communication and freshness protection; Secure software update and flash readiness; Security Logging and Event Handling; Security evidence and traceability	Cybersecurity Concept and Evidence; Data Authenticity and Integrity Verification; Key and Certificate Handling; Secure Communication and Boundary Control	SECURITY REVIEW OPEN	Decision Dependency Map
AD-008	System Core	component	Architecture allocation for System Core supporting 15 supplier system requirement(s).	SSR-SYS-001; SSR-COM-002; SSR-COM-003; SSR-VIH-003; SSR-VV-001; SSR-LIFE-002; SSR-UPD-002; SSR-BOOT-003; SSR-DIAG-003; SSR-DAI-007; SSR-TOOL-004; SSR-RBAC-005; SSR-KEY-002; SSR-DAI-008; SSR-COM-010	Grouped from allocated architecture elements in supplier system requirements and requirement-to-architecture traceability.	Bootloader and Application State Handling; Data Authenticity and Integrity Verification; Diagnostic Services; Key and Certificate Handling; Lifecycle / Field Return / Decommissioning; OEM/Customer Review Interface; Secure Communication and Boundary Control; Secure Diagnostics / RBAC	Bootloader and Application State Handling; Data Authenticity and Integrity Verification; Diagnostic Services; Key and Certificate Handling	SECURITY REVIEW OPEN	Product/System Context Diagram

Organized Diagrams

Architecture Cockpit Overview

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart LR subgraph Vehicle["Vehicle / drivetrain domain"] Drivetrain["GW AMT drivetrain"] Network["Vehicle network (CAN / PWM)"] end subgraph ECA["ECA ECU domain"] App["Clutch actuation application"] Sec["Security services"] Boot["Bootloader / update logic"] end subgraph Diagnostic["Diagnostic / service domain"] Tester["Diagnostic tester"] end subgraph OEM["OEM backend / security operations domain"] Backend["Update and evidence backend"] PKI["Key and certificate provisioning"] SecOps["Security operations"] end subgraph Supplier["Supplier engineering domain"] Engineering["Supplier ALM / CI / evidence"] end Drivetrain --> Network Network <-->|commands, status, freshness| App Tester -->|authenticated UDS| Sec Backend -->|signed software / IVD| Boot PKI -->|trust material| Sec Boot --> App Sec --> App App -->|events| SecOps Engineering -->|software and evidence| Backend

Mermaid source

flowchart LR
  subgraph Vehicle["Vehicle / drivetrain domain"]
    Drivetrain["GW AMT drivetrain"]
    Network["Vehicle network (CAN / PWM)"]
  end
  subgraph ECA["ECA ECU domain"]
    App["Clutch actuation application"]
    Sec["Security services"]
    Boot["Bootloader / update logic"]
  end
  subgraph Diagnostic["Diagnostic / service domain"]
    Tester["Diagnostic tester"]
  end
  subgraph OEM["OEM backend / security operations domain"]
    Backend["Update and evidence backend"]
    PKI["Key and certificate provisioning"]
    SecOps["Security operations"]
  end
  subgraph Supplier["Supplier engineering domain"]
    Engineering["Supplier ALM / CI / evidence"]
  end
  Drivetrain --> Network
  Network <-->|commands, status, freshness| App
  Tester -->|authenticated UDS| Sec
  Backend -->|signed software / IVD| Boot
  PKI -->|trust material| Sec
  Boot --> App
  Sec --> App
  App -->|events| SecOps
  Engineering -->|software and evidence| Backend

Capability-to-Component Map

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart LR subgraph Capabilities["System capabilities"] Actuation["Clutch actuation"] Diagnostics["Secure diagnostics"] UpdateCap["Secure update"] Keys["Key and certificate handling"] Evidence["Cybersecurity evidence"] end subgraph Components["Architecture components"] App["Application software"] DiagSrv["Diagnostic server"] Boot["Bootloader / update logic"] Sec["Security services"] Tooling["Engineering evidence toolchain"] end Actuation --> App Diagnostics --> DiagSrv Diagnostics --> Sec UpdateCap --> Boot UpdateCap --> Sec Keys --> Sec Evidence --> Tooling Evidence --> Sec

Mermaid source

flowchart LR
  subgraph Capabilities["System capabilities"]
    Actuation["Clutch actuation"]
    Diagnostics["Secure diagnostics"]
    UpdateCap["Secure update"]
    Keys["Key and certificate handling"]
    Evidence["Cybersecurity evidence"]
  end
  subgraph Components["Architecture components"]
    App["Application software"]
    DiagSrv["Diagnostic server"]
    Boot["Bootloader / update logic"]
    Sec["Security services"]
    Tooling["Engineering evidence toolchain"]
  end
  Actuation --> App
  Diagnostics --> DiagSrv
  Diagnostics --> Sec
  UpdateCap --> Boot
  UpdateCap --> Sec
  Keys --> Sec
  Evidence --> Tooling
  Evidence --> Sec

Interface Trust Boundary Map

Linked architecture/design evidence. See design item table for SSR allocations.

Mermaid source

flowchart TB
  subgraph ECU["ECA ECU trust boundary"]
    App["Application software"]
    Sec["Security services"]
    Boot["Bootloader / update logic"]
  end
  Vehicle["Vehicle network boundary"] -->|CAN / PWM / protected data| App
  Tester["Diagnostic service boundary"] -->|UDS Auth 0x29| Sec
  Backend["OEM backend boundary"] -->|signed update / logs| Boot
  PKI["PKI provisioning boundary"] -->|keys / certificates| Sec
  Tooling["Supplier engineering boundary"] -->|software / evidence| Backend
  App -->|security events| Backend

Security Capability Map

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart LR subgraph Protect["Protected areas"] Data["Vehicle data"] Software["ECU software"] Diag["Diagnostic access"] Trust["Keys and certificates"] Evidence["Security evidence"] end subgraph Capabilities["Security capabilities"] Comms["Secure communication"] UpdateSec["Secure update"] RBAC["Diagnostics RBAC"] KeyMgmt["Key / certificate management"] Audit["Logging and evidence"] end Comms --> Data UpdateSec --> Software RBAC --> Diag KeyMgmt --> Trust Audit --> Evidence

Mermaid source

flowchart LR
  subgraph Protect["Protected areas"]
    Data["Vehicle data"]
    Software["ECU software"]
    Diag["Diagnostic access"]
    Trust["Keys and certificates"]
    Evidence["Security evidence"]
  end
  subgraph Capabilities["Security capabilities"]
    Comms["Secure communication"]
    UpdateSec["Secure update"]
    RBAC["Diagnostics RBAC"]
    KeyMgmt["Key / certificate management"]
    Audit["Logging and evidence"]
  end
  Comms --> Data
  UpdateSec --> Software
  RBAC --> Diag
  KeyMgmt --> Trust
  Audit --> Evidence

Update and Diagnostics Flow

Linked architecture/design evidence. See design item table for SSR allocations.

sequenceDiagram participant Tester as Diagnostic Tester participant Sec as ECA Security Services participant Boot as Bootloader / Update Logic participant App as Clutch Actuation Application participant Backend as OEM Update Backend Tester->>Sec: Start UDS session and authenticate Sec-->>Tester: Authorized diagnostic role Backend->>Boot: Signed software package and IVD Boot->>Sec: Validate signature, certificate and integrity Sec-->>Boot: Validation result Boot->>App: Activate accepted software App-->>Tester: Status, DTCs and update result

Mermaid source

sequenceDiagram
  participant Tester as Diagnostic Tester
  participant Sec as ECA Security Services
  participant Boot as Bootloader / Update Logic
  participant App as Clutch Actuation Application
  participant Backend as OEM Update Backend
  Tester->>Sec: Start UDS session and authenticate
  Sec-->>Tester: Authorized diagnostic role
  Backend->>Boot: Signed software package and IVD
  Boot->>Sec: Validate signature, certificate and integrity
  Sec-->>Boot: Validation result
  Boot->>App: Activate accepted software
  App-->>Tester: Status, DTCs and update result

Key and Certificate Flow

Linked architecture/design evidence. See design item table for SSR allocations.

Mermaid source

flowchart LR
  OEMPKI["OEM / TRATON PKI"] -->|certificate profile and trust anchors| Provisioning["Provisioning process"]
  Supplier["Supplier engineering"] -->|CSR / ECU identity evidence| Provisioning
  Provisioning -->|keys, certificates, trust anchors| ECU["ECA ECU security services"]
  ECU -->|certificate validation| Diagnostics["Authenticated diagnostics"]
  ECU -->|signature validation| Update["Secure update / flash"]
  ECU -->|MAC / freshness material| Comms["Secure communication"]
  ECU -->|lifecycle evidence| Review["OEM review and residual-risk decision"]

Decision Dependency Map

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart TB Boundary["P1: item boundary and variants"] --> TARA["TARA / asset allocation"] Interfaces["P1: interface and signal scope"] --> Comms["SecOC / SDT allocation"] Diagnostics["P1: diagnostic role model"] --> DiagSec["Secure diagnostics baseline"] Update["P1: update and signing ownership"] --> UpdateSec["Secure update baseline"] PKI["P1: PKI, HSM and key hierarchy"] --> Crypto["Crypto and trust baseline"] TARA --> Closure["Architecture / security baseline closure"] Comms --> Closure DiagSec --> Closure UpdateSec --> Closure Crypto --> Closure

Mermaid source

flowchart TB
  Boundary["P1: item boundary and variants"] --> TARA["TARA / asset allocation"]
  Interfaces["P1: interface and signal scope"] --> Comms["SecOC / SDT allocation"]
  Diagnostics["P1: diagnostic role model"] --> DiagSec["Secure diagnostics baseline"]
  Update["P1: update and signing ownership"] --> UpdateSec["Secure update baseline"]
  PKI["P1: PKI, HSM and key hierarchy"] --> Crypto["Crypto and trust baseline"]
  TARA --> Closure["Architecture / security baseline closure"]
  Comms --> Closure
  DiagSec --> Closure
  UpdateSec --> Closure
  Crypto --> Closure

Product/System Context Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart LR OEM["OEM customer / vehicle manufacturer"] Supplier["Supplier security engineering"] subgraph Vehicle["Vehicle or ECU context"] ECU["Electric Clutch Actuator ECU"] Network["Vehicle networks and other ECUs"] end Backend["Backend / cloud / IT systems"] Diag["Diagnostic and service tools"] Dev["Development / ALM / evidence tools"] SecOps["Security operations / monitoring"] OEM -->|requirements, approval, residual risk| Supplier Supplier -->|software, security concept, evidence| OEM ECU <--> |signals, messages, SecOC or SDT data| Network Diag -->|UDS, authentication, programming| ECU Backend -->|updates, certificates, logs| ECU Dev -->|builds, tests, traceability| Supplier ECU -->|security events and evidence| SecOps SecOps -->|vulnerability and incident feedback| Supplier

Mermaid source

flowchart LR
  OEM["OEM customer / vehicle manufacturer"]
  Supplier["Supplier security engineering"]
  subgraph Vehicle["Vehicle or ECU context"]
    ECU["Electric Clutch Actuator ECU"]
    Network["Vehicle networks and other ECUs"]
  end
  Backend["Backend / cloud / IT systems"]
  Diag["Diagnostic and service tools"]
  Dev["Development / ALM / evidence tools"]
  SecOps["Security operations / monitoring"]
  OEM -->|requirements, approval, residual risk| Supplier
  Supplier -->|software, security concept, evidence| OEM
  ECU <--> |signals, messages, SecOC or SDT data| Network
  Diag -->|UDS, authentication, programming| ECU
  Backend -->|updates, certificates, logs| ECU
  Dev -->|builds, tests, traceability| Supplier
  ECU -->|security events and evidence| SecOps
  SecOps -->|vulnerability and incident feedback| Supplier

External Actors and Interfaces Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

Mermaid source

flowchart LR
  ECU["Electric Clutch Actuator ECU"]
  OEM["OEM customer"]
  Diag["Diagnostic tool"]
  Net["Vehicle network"]
  Backend["Backend / cloud / IT"]
  PKI["PKI / provisioning"]
  ALM["Development and evidence tools"]
  SecOps["Security operations"]
  OEM <--> |requirements, approval, evidence| ECU
  Diag -->|UDS, Auth 0x29, programming| ECU
  Net <--> |SecOC / SDT messages, counters| ECU
  Backend <--> |software update, logs, config| ECU
  PKI -->|certificates, keys, trust anchors| ECU
  ALM -->|builds, tests, traceability| ECU
  ECU -->|events, vulnerabilities| SecOps

Logical Architecture Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart TB subgraph Product["Electric Clutch Actuator ECU boundary"] Core["System core"] App["Application software"] Security["Security services"] Platform["Hardware platform"] DiagSrv["Diagnostic server"] Update["Boot / update / IVD handling"] Logging["Logging and audit"] end External["External interfaces"] Backend["Backend and IT systems"] Tools["Engineering toolchain"] Compliance["Compliance and evidence process"] External --> Core Core --> App App --> Security Security --> Platform DiagSrv --> Security Update --> Security Security --> Logging Backend --> Update Tools --> Compliance Compliance --> Security

Mermaid source

flowchart TB
  subgraph Product["Electric Clutch Actuator ECU boundary"]
    Core["System core"]
    App["Application software"]
    Security["Security services"]
    Platform["Hardware platform"]
    DiagSrv["Diagnostic server"]
    Update["Boot / update / IVD handling"]
    Logging["Logging and audit"]
  end
  External["External interfaces"]
  Backend["Backend and IT systems"]
  Tools["Engineering toolchain"]
  Compliance["Compliance and evidence process"]
  External --> Core
  Core --> App
  App --> Security
  Security --> Platform
  DiagSrv --> Security
  Update --> Security
  Security --> Logging
  Backend --> Update
  Tools --> Compliance
  Compliance --> Security

Cybersecurity Architecture Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart LR subgraph Product["Electric Clutch Actuator ECU trust boundary"] Auth["Authentication and authorization"] Crypto["Crypto, key and certificate handling"] DiagSec["Secure diagnostics"] Comms["Secure communication freshness and replay protection"] Boot["Secure boot and platform integrity"] Update["Secure update / flash / IVD"] Log["Logging and audit"] end Diag["Diagnostic tool"] -->|authenticated UDS| DiagSec Vehicle["Vehicle network"] -->|SecOC or SDT data| Comms Backend["Backend / IT"] -->|updates and certificates| Update PKI["PKI"] -->|trust anchors and certificates| Crypto Boot --> Crypto Auth --> DiagSec Crypto --> Comms Update --> Boot Log --> SecOps["Security operations"] Evidence["Evidence repository"] --> Customer["OEM customer approval"] Log --> Evidence

Mermaid source

flowchart LR
  subgraph Product["Electric Clutch Actuator ECU trust boundary"]
    Auth["Authentication and authorization"]
    Crypto["Crypto, key and certificate handling"]
    DiagSec["Secure diagnostics"]
    Comms["Secure communication freshness and replay protection"]
    Boot["Secure boot and platform integrity"]
    Update["Secure update / flash / IVD"]
    Log["Logging and audit"]
  end
  Diag["Diagnostic tool"] -->|authenticated UDS| DiagSec
  Vehicle["Vehicle network"] -->|SecOC or SDT data| Comms
  Backend["Backend / IT"] -->|updates and certificates| Update
  PKI["PKI"] -->|trust anchors and certificates| Crypto
  Boot --> Crypto
  Auth --> DiagSec
  Crypto --> Comms
  Update --> Boot
  Log --> SecOps["Security operations"]
  Evidence["Evidence repository"] --> Customer["OEM customer approval"]
  Log --> Evidence

Trust Boundary Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart TB subgraph Product["Inside product boundary"] ECU["ECU software and hardware"] Sec["Security services"] end subgraph Vehicle["Vehicle / network boundary"] Net["Other ECUs and vehicle buses"] end subgraph Backend["Backend / cloud boundary"] Cloud["Update, PKI, logs, portals"] end subgraph Diagnostic["Diagnostic access boundary"] Tool["Service and engineering tools"] end subgraph Tooling["Development / tooling boundary"] ALM["ALM, CI, test, evidence"] end subgraph Customer["Customer / OEM boundary"] OEM["Approval and residual risk"] end Unknown["Unknown deployment zones"] Tool -->|trusted diagnostic session unknown details| ECU Net -->|vehicle data| ECU Cloud -->|update, certificates, events| Sec ALM -->|evidence and artifacts| OEM ECU -->|security evidence| OEM Unknown -. clarification needed .-> ECU

Mermaid source

flowchart TB
  subgraph Product["Inside product boundary"]
    ECU["ECU software and hardware"]
    Sec["Security services"]
  end
  subgraph Vehicle["Vehicle / network boundary"]
    Net["Other ECUs and vehicle buses"]
  end
  subgraph Backend["Backend / cloud boundary"]
    Cloud["Update, PKI, logs, portals"]
  end
  subgraph Diagnostic["Diagnostic access boundary"]
    Tool["Service and engineering tools"]
  end
  subgraph Tooling["Development / tooling boundary"]
    ALM["ALM, CI, test, evidence"]
  end
  subgraph Customer["Customer / OEM boundary"]
    OEM["Approval and residual risk"]
  end
  Unknown["Unknown deployment zones"]
  Tool -->|trusted diagnostic session unknown details| ECU
  Net -->|vehicle data| ECU
  Cloud -->|update, certificates, events| Sec
  ALM -->|evidence and artifacts| OEM
  ECU -->|security evidence| OEM
  Unknown -. clarification needed .-> ECU

High-Level Data Flow Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

Mermaid source

flowchart LR
  Req["Customer requirements"] -->|traceability evidence| ALM["ALM / evidence repository"]
  ALM -->|security concept and VnV reports| OEM["OEM customer"]
  Diag["Diagnostic tool"] -->|UDS requests, credentials| ECU["Electric Clutch Actuator ECU"]
  ECU -->|diagnostic responses, logs| Diag
  Net["Vehicle network"] <--> |signals, SDT / SecOC data, counters| ECU
  Backend["Backend / update service"] -->|software package, signature, IVD| ECU
  PKI["PKI"] -->|certificates and trust anchors| ECU
  ECU -->|security events, vulnerabilities| SecOps["Security operations"]
  SecOps -->|incident and mitigation feedback| ALM

Security Concept Overview Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart TB Assets["Assets: ECU software, data, keys, evidence"] Surfaces["Attack surfaces: diagnostics, vehicle network, update, backend, tooling"] Goals["Security goals: authenticity, integrity, freshness, confidentiality, availability"] Caps["Capabilities: IAM, crypto, secure diagnostics, secure update, logging"] Mech["Mechanisms: certificates, keys, SecOC/SDT, secure boot, audit"] Evidence["Evidence: traceability, VnV, residual risk, customer approval"] Assets --> Surfaces Surfaces --> Goals Goals --> Caps Caps --> Mech Mech --> Evidence

Mermaid source

flowchart TB
  Assets["Assets: ECU software, data, keys, evidence"]
  Surfaces["Attack surfaces: diagnostics, vehicle network, update, backend, tooling"]
  Goals["Security goals: authenticity, integrity, freshness, confidentiality, availability"]
  Caps["Capabilities: IAM, crypto, secure diagnostics, secure update, logging"]
  Mech["Mechanisms: certificates, keys, SecOC/SDT, secure boot, audit"]
  Evidence["Evidence: traceability, VnV, residual risk, customer approval"]
  Assets --> Surfaces
  Surfaces --> Goals
  Goals --> Caps
  Caps --> Mech
  Mech --> Evidence

Feature-to-Component Mapping Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart LR subgraph Features["Feature domains"] CoreF["Core product capabilities"] CommF["Communication and connectivity"] DiagF["Diagnostics and maintenance"] CyberF["Cybersecurity capabilities"] OpsF["Operations and evidence"] end subgraph Components["Architecture elements"] Core["System core"] App["Application software"] Sec["Security services"] HW["Hardware platform"] Ext["External interfaces"] Back["Backend / IT"] Tool["Engineering toolchain"] Comp["Compliance process"] end CoreF --> Core CoreF --> App CommF --> Ext CommF --> Sec DiagF --> Sec DiagF --> App CyberF --> Sec CyberF --> HW OpsF --> Back OpsF --> Tool OpsF --> Comp

Mermaid source

flowchart LR
  subgraph Features["Feature domains"]
    CoreF["Core product capabilities"]
    CommF["Communication and connectivity"]
    DiagF["Diagnostics and maintenance"]
    CyberF["Cybersecurity capabilities"]
    OpsF["Operations and evidence"]
  end
  subgraph Components["Architecture elements"]
    Core["System core"]
    App["Application software"]
    Sec["Security services"]
    HW["Hardware platform"]
    Ext["External interfaces"]
    Back["Backend / IT"]
    Tool["Engineering toolchain"]
    Comp["Compliance process"]
  end
  CoreF --> Core
  CoreF --> App
  CommF --> Ext
  CommF --> Sec
  DiagF --> Sec
  DiagF --> App
  CyberF --> Sec
  CyberF --> HW
  OpsF --> Back
  OpsF --> Tool
  OpsF --> Comp

Requirement-to-Architecture Traceability Overview Diagram

Linked architecture/design evidence. See design item table for SSR allocations.

flowchart LR Source["Cleaned Markdown requirements"] --> Req["Extracted requirements"] Req --> Features["Feature model"] Req --> Interfaces["Interface model"] Req --> Caps["Security capabilities"] Req --> Arch["Architecture views"] Features --> Trace["Traceability gate"] Interfaces --> Trace Caps --> Trace Arch --> Trace Trace --> Review["Human review and customer clarifications"]

Mermaid source

flowchart LR
  Source["Cleaned Markdown requirements"] --> Req["Extracted requirements"]
  Req --> Features["Feature model"]
  Req --> Interfaces["Interface model"]
  Req --> Caps["Security capabilities"]
  Req --> Arch["Architecture views"]
  Features --> Trace["Traceability gate"]
  Interfaces --> Trace
  Caps --> Trace
  Arch --> Trace
  Trace --> Review["Human review and customer clarifications"]

System Requirements Without Architecture / Design Coverage

All rendered system requirements have an architecture/design allocation.

Design Evidence Appendix

Show architecture overview

High-Level Architecture

Component Table

Component	Responsibility	Interfaces	Security Role	Evidence Status	Open Decision
Vehicle / Drivetrain Domain	Provides CAN/PWM commands and receives ECA status/fault data	Vehicle Network Interface	Primary external runtime boundary	Confirmed	Confirm network topology and protected signals
ECA ECU Application Software	Controls clutch actuation and reports status	CAN, internal security services, diagnostics	Validates commands and enforces fail-safe behaviour	Confirmed	Confirm final function allocation
ECA ECU Security Services	Provides auth, crypto, key/certificate, logging and secure communication services	Diagnostics, update, PKI, vehicle network	Central protection layer	Inferred	Confirm concrete mechanisms and HSM support
Bootloader / Update Logic	Handles flash, IVD and software validity checks	Update / Flash, diagnostics, security services	Protects software authenticity and integrity	Inferred	Confirm signing chain and rollback policy
Diagnostic / Service Domain	Performs service, programming and authenticated diagnostic access	Diagnostic Tester Interface	Privileged access boundary	Inferred	Confirm role model and service whitelist
OEM Backend / Security Operations	Owns approval, monitoring, update/key decisions and residual-risk workflow	OEM Evidence, logging, update, PKI	Offboard security governance boundary	Inferred	Confirm ownership split
Supplier Engineering Domain	Produces software, evidence, traceability and review artifacts	ALM, CI/test, OEM evidence handoff	Protects evidence and release integrity	Confirmed	Confirm evidence repository authority

Executive Architecture Interpretation

Classification: Inferred from Requirements

The architecture should be read as an ECU/component security architecture with a supplier evidence wrapper around it. The product boundary contains system core behavior, application software, hardware platform, security services, diagnostic/update handling, and logging. Outside the boundary are vehicle networks, diagnostic tools, backend/IT systems, PKI/provisioning, development/ALM tooling, security operations, and OEM/customer approval.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0004; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010 (sample: 10 of 641)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 163)
Confidence level: Low
Classification: Inferred from Requirements

System Boundary

Classification: Inferred from Requirements

The system boundary is the Electric Clutch Actuator ECU security scope plus supplier-controlled lifecycle evidence. Exact vehicle-function allocation remains open.

External Actors

Classification: Inferred from Requirements

OEM/customer, vehicle network/other ECUs, diagnostic/service tools, backend/cloud/IT systems, PKI/provisioning, development/ALM tooling, and security operations.

Major Subsystems

Classification: Inferred from Requirements

System Core, Application Software, Hardware Platform, Security Services, External Interfaces, Backend and IT Systems, Engineering Toolchain, and Compliance Process.

Main Interfaces

Classification: Inferred from Requirements

OEM/customer cybersecurity approval and evidence interface; Diagnostic/service tool to ECU interface; Vehicle network secure data communication interface; Secure update, flash, and IVD interface; Certificate and key provisioning interface; Backend/cloud/IT operational interface; Development, ALM, and evidence tooling interface; Security operations and vulnerability reporting interface; Application software to security services interface; Hardware platform and key storage interface

Main Data Flows

Classification: Inferred from Requirements

Requirements/evidence flow, diagnostic access flow, vehicle data flow, secure update/flash flow, key/certificate flow, security event/logging flow, and vulnerability/incident flow.

Security Architecture Logic

Classification: Recommendation

Protect the highest-risk boundaries first: diagnostics, vehicle network communication, update/flash, key/certificate handling, and backend/tooling evidence. Use traceability and customer approval to keep inferred architecture distinct from confirmed requirements.

What Is Explicitly Required

Classification: Explicit Requirement

Cybersecurity concept documentation, risk assessment input, control derivation and traceability, verification/validation evidence, diagnostic/security controls, key/certificate handling, logging/audit elements, vulnerability and incident handling elements.

What Is Inferred

Classification: Inferred from Requirements

Layered ECU security services, backend/update actors, PKI/provisioning flow, security operations flow, and componentized architecture views.

Key Assumptions

Classification: Expert Assumption

The item is treated as one or more ECUs/E/E components until the customer confirms the exact product item definition.

Open Architecture Decisions

Classification: Needs Customer Clarification

Confirm item definition, network topology, diagnostic roles, update mechanism, PKI ownership, HSM capability, backend ownership, and final TARA outputs.

Recommended Next Design Steps

Classification: Recommendation

Hold an item-definition workshop, confirm boundary diagrams, allocate interfaces and assets, perform TARA, confirm security mechanisms, and update traceability with customer-approved decisions.

Show design drill-down

Design Drill-Down

System Context

Overview

Classification: Inferred from Requirements

System Context is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010; RFQX-1001379436-P10-000-01-0011; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019 (sample: 18 of 1009)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 228)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010; RFQX-1001379436-P10-000-01-0011 (sample: 10 of 1009)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 228)
Confidence level: Low
Classification: Inferred from Requirements

Logical Components

Overview

Classification: Inferred from Requirements

Logical Components is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019; RFQX-1001379436-P10-000-01-0022; RFQX-1001379436-P10-000-01-0023; RFQX-1001379436-P10-000-01-0024; RFQX-1001379436-P10-000-01-0025 (sample: 18 of 207)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 101)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015 (sample: 10 of 207)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 101)
Confidence level: Low
Classification: Inferred from Requirements

External Interfaces

Overview

Classification: Inferred from Requirements

External Interfaces is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019; RFQX-1001379436-P10-000-01-0023; RFQX-1001379436-P10-000-01-0024; RFQX-1001379436-P10-000-01-0025 (sample: 18 of 214)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 103)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014 (sample: 10 of 214)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 103)
Confidence level: Low
Classification: Inferred from Requirements

Internal Interfaces

Overview

Classification: Inferred from Requirements

Internal Interfaces is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019; RFQX-1001379436-P10-000-01-0023; RFQX-1001379436-P10-000-01-0024; RFQX-1001379436-P10-000-01-0025 (sample: 18 of 227)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 110)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014 (sample: 10 of 227)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 110)
Confidence level: Low
Classification: Inferred from Requirements

Security-Relevant Interfaces

Overview

Classification: Inferred from Requirements

Security-Relevant Interfaces is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019; RFQX-1001379436-P10-000-01-0023; RFQX-1001379436-P10-000-01-0024; RFQX-1001379436-P10-000-01-0025; RFQX-1001379436-P10-000-01-0027 (sample: 18 of 203)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 96)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015 (sample: 10 of 203)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 96)
Confidence level: Low
Classification: Inferred from Requirements

Trust Boundaries

Overview

Classification: Inferred from Requirements

Trust Boundaries is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019; RFQX-1001379436-P10-000-01-0023; RFQX-1001379436-P10-000-01-0024; RFQX-1001379436-P10-000-01-0025; RFQX-1001379436-P10-000-01-0027 (sample: 18 of 194)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 93)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015 (sample: 10 of 194)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 93)
Confidence level: Low
Classification: Inferred from Requirements

Data Flows

Overview

Classification: Inferred from Requirements

Data Flows is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019; RFQX-1001379436-P10-000-01-0023; RFQX-1001379436-P10-000-01-0024; RFQX-1001379436-P10-000-01-0025; RFQX-1001379436-P10-000-01-0027 (sample: 18 of 381)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 152)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015 (sample: 10 of 381)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 152)
Confidence level: Low
Classification: Inferred from Requirements

Security Capabilities

Overview

Classification: Inferred from Requirements

Security Capabilities is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019; RFQX-1001379436-P10-000-01-0023; RFQX-1001379436-P10-000-01-0024; RFQX-1001379436-P10-000-01-0025; RFQX-1001379436-P10-000-01-0027 (sample: 18 of 194)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 93)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015 (sample: 10 of 194)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 93)
Confidence level: Low
Classification: Inferred from Requirements

Lifecycle and Operations

Overview

Classification: Inferred from Requirements

Lifecycle and Operations is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010; RFQX-1001379436-P10-000-01-0011; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019 (sample: 18 of 638)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 209)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010; RFQX-1001379436-P10-000-01-0011 (sample: 10 of 638)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 209)
Confidence level: Low
Classification: Inferred from Requirements

Tooling and Evidence Flow

Overview

Classification: Inferred from Requirements

Tooling and Evidence Flow is treated as a design view needed to understand the product before detailed requirement allocation.

Design Intent

Keep customer-confirmed requirements separate from inferred design structure while exposing the security reasoning.

Requirement Basis

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010; RFQX-1001379436-P10-000-01-0011; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019 (sample: 18 of 639)
Source document sections: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 209)

Security Relevance

This view shows where an asset, interface, trust boundary, or evidence obligation could create security risk.

Constraints

No final TARA, topology, algorithm, or implementation ownership is claimed unless a requirement explicitly supports it.

Open Questions

Confirm customer ownership, exact item boundary, allocated mechanisms, and verification evidence for this view.

Evidence Basis:

Related requirements: RFQX-1001379436-P10-000-01-0001; RFQX-1001379436-P10-000-01-0002; RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0006; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010; RFQX-1001379436-P10-000-01-0011 (sample: 10 of 639)
Source document: source document page 3; source document page 5; source document page 6; source document page 7; source document page 8; source document page 9; source document page 10; source document page 11(sample: 8 of 209)
Confidence level: Low
Classification: Inferred from Requirements

Show architecture decisions

Architecture Decisions

Decision ID	Decision statement	Classification	Source requirement IDs	Source document	Confidence	Human review required	Reason for human review
ADR-001	Include `Application Software` in the customer-review baseline architecture.	Explicit Requirement	RFQX-1001379436-P10-000-01-0011; RFQX-1001379436-P10-000-01-0021; RFQX-3299216-1-0061; RFQX-3299216-1-0075; RFQX-3299216-1-0137; RFQX-3299216-1-0139; RFQX-3299216-1-0142; RFQX-3299216-1-0214; RFQX-3299216-1-0218; RFQX-3299216-1-0220; RFQX-3299216-1-0285; RFQX-3299216-1-0306 (sample: 12 of 169)	source document page 5; source document page 6; source document page 15; source document page 19(sample: 4 of 82)	High	yes	Customer clarification linked to one or more requirements.
ADR-002	Include `Backend and IT Systems` in the customer-review baseline architecture.	Explicit Requirement	RFQX-3299216-1-0024; RFQX-3299216-1-0033; RFQX-3299216-1-0036; RFQX-3299216-1-0038; RFQX-3299216-1-0039; RFQX-3299216-1-0040; RFQX-3299216-1-0043; RFQX-3299216-1-0049; RFQX-3299216-1-0052; RFQX-3299216-1-0055; RFQX-3299216-1-0058; RFQX-3299216-1-0079 (sample: 12 of 216)	source document page 9; source document page 10; source document page 11; source document page 12(sample: 4 of 103)	High	yes	Customer clarification linked to one or more requirements.
ADR-003	Include `Compliance Process` in the customer-review baseline architecture.	Explicit Requirement	RFQX-1001379436-P10-000-01-0047; RFQX-1001379436-P10-000-01-0049; RFQX-1001379436-P10-000-01-0050; RFQX-3299216-1-0070; RFQX-3299216-1-0185; RFQX-3299216-1-0189; RFQX-3299216-1-0280; RFQX-3299216-1-0281; RFQX-3299216-1-0283; RFQX-CVS123-2-0002; RFQX-CVS123-2-0320; RFQX-CVS124-0003 (sample: 12 of 55)	source document page 10; source document page 16; source document page 36; source document page 49(sample: 4 of 33)	High	no	none
ADR-004	Include `Engineering Toolchain` in the customer-review baseline architecture.	Explicit Requirement	RFQX-3299216-1-0035	source document page 10	High	no	none
ADR-005	Include `External Interfaces` in the customer-review baseline architecture.	Explicit Requirement	RFQX-1001379436-P10-000-01-0058; RFQX-3299216-1-0031; RFQX-3299216-1-0084; RFQX-3299216-1-0091; RFQX-3299216-1-0092; RFQX-3299216-1-0094; RFQX-3299216-1-0096; RFQX-3299216-1-0102; RFQX-3299216-1-0103; RFQX-3299216-1-0104; RFQX-3299216-1-0106; RFQX-3299216-1-0135 (sample: 12 of 48)	source document page 11; source document page 10; source document page 21; source document page 22(sample: 4 of 27)	High	no	none
ADR-006	Include `Hardware Platform` in the customer-review baseline architecture.	Explicit Requirement	RFQX-1001379436-P10-000-01-0022; RFQX-1001379436-P10-000-01-0029; RFQX-1001379436-P10-000-01-0030; RFQX-1001379436-P10-000-01-0036; RFQX-1001379436-P10-000-01-0060; RFQX-1001379436-P10-000-01-0062; RFQX-1001379436-P10-000-01-0063; RFQX-1001379436-P10-000-01-0065; RFQX-1001379436-P10-000-01-0066; RFQX-3299216-1-0004; RFQX-3299216-1-0019; RFQX-3299216-1-0041 (sample: 12 of 48)	source document page 7; source document page 8; source document page 11; source document page 12(sample: 4 of 39)	High	yes	Customer clarification linked to one or more requirements.
ADR-007	Include `OEM/Customer Review Interface` in the customer-review baseline architecture.	Inferred from Requirements	RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010; RFQX-1001379436-P10-000-01-0011; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019; RFQX-1001379436-P10-000-01-0021 (sample: 12 of 140)	source document page 3; source document page 5; source document page 6; source document page 7(sample: 4 of 62)	High	yes	Confirm exact OEM/customer evidence and approval workflow.
ADR-008	Include `Security Services` in the customer-review baseline architecture.	Explicit Requirement	RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0007; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015; RFQX-1001379436-P10-000-01-0016; RFQX-1001379436-P10-000-01-0017; RFQX-1001379436-P10-000-01-0018; RFQX-1001379436-P10-000-01-0019 (sample: 12 of 96)	source document page 3; source document page 5; source document page 6; source document page 7(sample: 4 of 54)	High	yes	Customer clarification linked to one or more requirements.
ADR-009	Include `System Core` in the customer-review baseline architecture.	Explicit Requirement	RFQX-1001379436-P10-000-01-0009; RFQX-1001379436-P10-000-01-0010; RFQX-1001379436-P10-000-01-0026; RFQX-1001379436-P10-000-01-0028; RFQX-1001379436-P10-000-01-0031; RFQX-1001379436-P10-000-01-0032; RFQX-1001379436-P10-000-01-0033; RFQX-1001379436-P10-000-01-0034; RFQX-1001379436-P10-000-01-0035; RFQX-1001379436-P10-000-01-0038; RFQX-1001379436-P10-000-01-0039; RFQX-1001379436-P10-000-01-0040 (sample: 12 of 354)	source document page 5; source document page 7; source document page 8; source document page 9(sample: 4 of 143)	High	no	none