Customer Proposal Summary - RFQX Security Architecture Package

Executive Takeaway

The customer proposal summary is ready for review, not approval. It consolidates supplier positions, customer actions, and unresolved responsibility decisions so the customer can respond without losing evidence traceability.

Rows with clarification or partial acceptance require customer decisions before baseline agreement.
Security capability dependencies show where ECU-side implementation depends on customer-owned policy, PKI, backend, or approval authority.

Total Customer Items1789customer-facing rows

Requirements1042baseline candidates

Information476not baseline requirements

Unknown / Review Needed0review

Proposal Ready1789supplier proposal present

Accepted by Supplier145clear scope

Accepted with Assumption310customer confirmation needed

Partially Accepted241shared responsibility

Rejected by Supplier0supplier rationale

Clarification Needed208customer answer needed

Open Points9decision topics

High Estimation Impact267planning drivers

Cybersecurity Concept Impact96security concept

Customer Feedback Received0matched rows

Agreement Baseline StatusNot establishedNo customer feedback has been ingested.

Supplier Position Summary

Supplier Position	Count	Meaning	Customer Action Needed
Informational Only	819	Context only.	Confirm if binding.
Accept with Assumption	310	Implement under stated assumption.	Confirm or correct assumption.
Partially Accept	241	ECU part only; customer part remains open.	Confirm responsibility split.
Needs Customer Clarification	208	Blocked pending customer answer.	Answer linked open point.
Accept	145	Supplier will implement.	Confirm responsibility and method.
Reference / Document Information	63	Review.	Review.
Needs Internal Review	3	Supplier review remains open.	No customer action yet.

Open Point Customer Answers

OP-001: Confirm the exact ECU designation/variant and the agreed item definition and boundary used for the risk analysis (TARA).

Topic: ECU designation, variant and item definition for TARA | Owner: OEM / Customer | Status: Open | Related requirements: 8

Decision detail

Why it matters: The item definition fixes the scope of the whole cybersecurity case; without it, assets, goals and effort cannot be frozen.

Required decision: Confirm the exact ECU designation/variant and the agreed item definition and boundary used for the risk analysis (TARA).

Impact if unresolved: TARA scope and effort stay open; downstream assets, goals and design may rework.

High

OP-002: Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.

Topic: Diagnostic security role model and service authorization | Owner: Shared (OEM policy / Supplier ECU) | Status: Open | Related requirements: 37

Decision detail

Why it matters: Diagnostic access is a primary attack surface; authorization scope drives security access design and verification effort.

Required decision: Confirm the diagnostic role model, the authorized services per role, and which party owns the diagnostic authorization policy.

Impact if unresolved: Security-access design and verification scope cannot be frozen; risk of an unprotected diagnostic service.

High

OP-003: Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.

Topic: Key and certificate ownership, provisioning and lifecycle | Owner: OEM / Customer (PKI) + Supplier (ECU) | Status: Open | Related requirements: 19

Decision detail

Why it matters: Key lifecycle responsibility determines ECU storage requirements, provisioning interfaces and production-line dependencies.

Required decision: Confirm ownership and provisioning flow for keys/certificates (generation, injection, storage, renewal, revocation) between OEM and supplier.

Impact if unresolved: ECU secure-storage and provisioning design is blocked; production-line and PKI dependencies stay open.

High

OP-004: Confirm the update chain ownership (backend/campaign vs. ECU programming) and the authenticity/integrity scheme to be applied.

Topic: Secure software update / backend campaign responsibility | Owner: Shared (OEM backend / Supplier ECU) | Status: Open | Related requirements: 25

Decision detail

Why it matters: Update is a high-impact attack surface; the backend/ECU split decides which controls and evidence the supplier must deliver.

Required decision: Confirm the update chain ownership (backend/campaign vs. ECU programming) and the authenticity/integrity scheme to be applied.

Impact if unresolved: Update-control scope and evidence ownership stay open; risk of an unprotected update path.

High

OP-005: Confirm which signals/PDUs require SecOC/SDT, the freshness scheme, and the key distribution for protected communication.

Topic: Secure on-board communication (SecOC/SDT) signal allocation | Owner: OEM / Customer | Status: Open | Related requirements: 24

Decision detail

Why it matters: Communication protection allocation drives CAN matrix changes, key needs and runtime budget; it cannot be inferred safely.

Required decision: Confirm which signals/PDUs require SecOC/SDT, the freshness scheme, and the key distribution for protected communication.

Impact if unresolved: Protected-signal design, key needs and runtime budget stay open; risk of unprotected critical signals.

High

OP-006: Confirm the split of monitoring, triage, vulnerability handling and field response between OEM PSIRT and supplier.

Topic: Incident response and vulnerability management ownership | Owner: OEM / Customer (fleet) + Supplier (ECU) | Status: Open | Related requirements: 2

Decision detail

Why it matters: Post-SOP cybersecurity obligations (UNECE R155 / ISO 21434 clause 7) need a clear owner to bound lifecycle effort.

Required decision: Confirm the split of monitoring, triage, vulnerability handling and field response between OEM PSIRT and supplier.

Impact if unresolved: Lifecycle effort and field-response capability stay unbounded; risk of an R155 compliance gap.

Medium

OP-008: Confirm production/debug hardening expectations (debug lock, secure end-of-line, developer-access policy).

Topic: Production, development and debug-interface hardening | Owner: Shared (OEM process / Supplier ECU) | Status: Open | Related requirements: 5

Decision detail

Why it matters: Production and debug interfaces are a common attack surface; expectations drive hardware fusing and EOL process design.

Required decision: Confirm production/debug hardening expectations (debug lock, secure end-of-line, developer-access policy).

Impact if unresolved: Hardware fusing and EOL process design stay open; risk of an exposed debug/production interface.

Medium

OP-009: Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed.

Topic: Cybersecurity work products, DIA and responsibility split | Owner: OEM / Customer + Supplier (DIA) | Status: Open | Related requirements: 9

Decision detail

Why it matters: ISO 21434 work-product ownership must be agreed; otherwise the supplier may carry OEM-owned obligations or leave gaps.

Required decision: Confirm the DIA / responsibility (RASIC/CIA) split for each cybersecurity work product before supplier scope is fixed.

Impact if unresolved: Without an agreed DIA the supplier risks owning customer work products or leaving cybersecurity gaps in the case.

High

OP-011: Confirm whether each listed requirement is binding supplier scope, customer-owned scope, or evidence-only context for the ECA ECU baseline.

Topic: Document-specific scope and responsibility confirmation | Owner: OEM / Customer | Status: Open | Related requirements: 200

Decision detail

Why it matters: These requirements affect supplier proposal scope, traceability status, and effort assumptions but do not map cleanly to a predefined decision topic.

Required decision: Decide whether each listed requirement is binding supplier scope, customer-owned scope, or evidence-only context.

Impact if unresolved: Supplier position, estimation, and affected design allocation remain conditional for the listed requirements.

Medium

Security Capability Dependencies

Security Capability	Related Requirements	Supplier Proposal Summary	Customer Dependency
Diagnostic security	RFQX-3299216-1-0107, RFQX-3299216-1-0126, RFQX-CVS123-2-0010, RFQX-CVS123-2-0023, RFQX-CVS123-2-0034, RFQX-CVS123-2-0047, RFQX-CVS123-2-0052, RFQX-CVS123-2-0056 (24 total)	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.
Cybersecurity requirement handling	RFQX-1001379436-P10-000-01-0003, RFQX-1001379436-P10-000-01-0005, RFQX-1001379436-P10-000-01-0007, RFQX-1001379436-P10-000-01-0012, RFQX-1001379436-P10-000-01-0013, RFQX-1001379436-P10-000-01-0014, RFQX-1001379436-P10-000-01-0015, RFQX-1001379436-P10-000-01-0016 (21 total)	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.
Authentication	RFQX-1001379436-P10-000-01-0025, RFQX-CVS123-2-0078, RFQX-CVS123-2-0079, RFQX-CVS151-0083, RFQX-CVS31-0006, RFQX-CVS31-0017, RFQX-CVS31-0021, RFQX-CVS31-0073 (16 total)	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.
Certificate handling	RFQX-CVS151-0060, RFQX-CVS151-0066, RFQX-CVS151-0091, RFQX-CVS31-0037, RFQX-CVS31-0074, RFQX-CVS31-0075, RFQX-CVS31-0078, RFQX-CVS31-0079 (16 total)	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.
Key management	RFQX-1001379436-P10-000-01-0041, RFQX-1001379436-P10-000-01-0042, RFQX-CVS124-0160, RFQX-CVS124-0210, RFQX-CVS154-0044, RFQX-CVS31-0102, RFQX-CVS32-0007, RFQX-CVS32-0008 (14 total)	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.
Vulnerability management	RFQX-1001379436-P10-000-01-0008, RFQX-1001379436-P10-000-01-0056	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.
Incident response	RFQX-1001379436-P10-000-01-0048	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.
Logging and audit trail	RFQX-1001379436-P10-000-01-0067	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.
Secure communication	RFQX-CVS32-0120	Implement mapped ECU-side controls and provide verification evidence.	Confirm responsibility and method.

Delivery Files

File	Purpose
customer_requirement_proposal_package.csv	Full customer-facing proposal package
customer_feedback_template.csv	Customer response template
source document	Allowed decision values and return instructions