Product and cybersecurity architecture understanding package generated from Markdown-derived requirements.
This table is horizontally scrollable. Use the bottom scrollbar to view all columns.
| Capability | Product Role | Architecture Component | Interfaces | Security Relevance | Evidence Status | Open Decision |
|---|---|---|---|---|---|---|
| Clutch Actuation Control | Core actuator control | Application Software / System Core | Vehicle Network Interface (CAN) | Safety-relevant command/status handling | Confirmed | Confirm final variant scope |
| Vehicle Integration and CAN Communication | Vehicle command/status exchange | External Interfaces / Application Software | Vehicle Network Interface (CAN), PWM wake-up | Message authenticity/freshness allocation | Confirmed | Confirm signal catalog and SecOC/SDT scope |
| Secure Diagnostics and Role-Based Access | Controlled service and engineering access | Diagnostic Server / Security Services | Diagnostic Tester Interface | Privileged access control | Inferred | Confirm roles, service list and lockout policy |
| Secure Software Update and Flash | Maintain trusted ECU software | Bootloader / Update Logic | Update / Flash Interface, Diagnostic Tester Interface | Software authenticity and integrity | Inferred | Confirm signing chain, rollback and ownership |
| Key and Certificate Handling | Trust-material lifecycle | Security Services / Hardware Platform | PKI / Provisioning Interface | Root of trust for diagnostics, update and secure communication | Inferred | Confirm HSM capability, key hierarchy and PKI ownership |
| Secure Data Transfer / Communication Boundary | Protected security-relevant data exchange | Security Services / External Interfaces | Vehicle Network Interface, Secure Data Transfer Interface | Authenticity, integrity and freshness | Inferred | Confirm protected signals and freshness model |
| Security Logging and Event Handling | Security evidence and response input | Security Services / Backend and IT Systems | Logging / Event Reporting Interface | Auditability and incident support | Inferred | Confirm event set, storage and reporting path |
| Cybersecurity Lifecycle and Evidence | Approval-ready security case | Compliance Process / Engineering Toolchain | Supplier Evidence, OEM Approval Interface | Traceable residual-risk argument | Confirmed | Confirm DIA split and approval authority |
Purpose: Core actuator control
Component mapping: Application Software / System Core
Interface mapping: Vehicle Network Interface (CAN)
Security mapping: Safety-relevant command/status handling
Evidence strength: Confirmed
Open decision: Confirm final variant scope
Purpose: Vehicle command/status exchange
Component mapping: External Interfaces / Application Software
Interface mapping: Vehicle Network Interface (CAN), PWM wake-up
Security mapping: Message authenticity/freshness allocation
Evidence strength: Confirmed
Open decision: Confirm signal catalog and SecOC/SDT scope
Purpose: Controlled service and engineering access
Component mapping: Diagnostic Server / Security Services
Interface mapping: Diagnostic Tester Interface
Security mapping: Privileged access control
Evidence strength: Inferred
Open decision: Confirm roles, service list and lockout policy
Purpose: Maintain trusted ECU software
Component mapping: Bootloader / Update Logic
Interface mapping: Update / Flash Interface, Diagnostic Tester Interface
Security mapping: Software authenticity and integrity
Evidence strength: Inferred
Open decision: Confirm signing chain, rollback and ownership
Purpose: Trust-material lifecycle
Component mapping: Security Services / Hardware Platform
Interface mapping: PKI / Provisioning Interface
Security mapping: Root of trust for diagnostics, update and secure communication
Evidence strength: Inferred
Open decision: Confirm HSM capability, key hierarchy and PKI ownership
Purpose: Protected security-relevant data exchange
Component mapping: Security Services / External Interfaces
Interface mapping: Vehicle Network Interface, Secure Data Transfer Interface
Security mapping: Authenticity, integrity and freshness
Evidence strength: Inferred
Open decision: Confirm protected signals and freshness model
Purpose: Security evidence and response input
Component mapping: Security Services / Backend and IT Systems
Interface mapping: Logging / Event Reporting Interface
Security mapping: Auditability and incident support
Evidence strength: Inferred
Open decision: Confirm event set, storage and reporting path
Purpose: Approval-ready security case
Component mapping: Compliance Process / Engineering Toolchain
Interface mapping: Supplier Evidence, OEM Approval Interface
Security mapping: Traceable residual-risk argument
Evidence strength: Confirmed
Open decision: Confirm DIA split and approval authority
flowchart LR
subgraph Capabilities["System capabilities"]
Actuation["Clutch actuation"]
Diagnostics["Secure diagnostics"]
UpdateCap["Secure update"]
Keys["Key and certificate handling"]
Evidence["Cybersecurity evidence"]
end
subgraph Components["Architecture components"]
App["Application software"]
DiagSrv["Diagnostic server"]
Boot["Bootloader / update logic"]
Sec["Security services"]
Tooling["Engineering evidence toolchain"]
end
Actuation --> App
Diagnostics --> DiagSrv
Diagnostics --> Sec
UpdateCap --> Boot
UpdateCap --> Sec
Keys --> Sec
Evidence --> Tooling
Evidence --> Sec
This feature model groups Markdown-derived requirement clusters into system-security architecture domains. It is not a flat requirement repeat.
Feature ID: FEAT-X001
Define supplier-controlled software behavior that realizes the extracted system and security requirements inside the ECU or application scope.
Gives the product a concrete software responsibility instead of treating the RFQ as only a document checklist.
Application logic, protocol handling, state handling, error handling, and allocation of software-side requirements.
The exact application function, user-facing behavior, timing budget, and production ECU variant are not confirmed.
Vehicle network, internal security services, diagnostics, backend/tooling where called by requirements.
Application state, protocol messages, configuration, diagnostic responses, security-relevant processing results.
Software behavior is where malformed input handling, authorization decisions, freshness checks, and protected data processing become enforceable.
Medium
Inferred from Requirements
Evidence Basis:
Feature ID: FEAT-X002
Address the extracted requirement cluster named Secure communication.
Provides a traceable product capability from the current requirements.
Scope is limited to requirements extracted from cleaned Markdown.
Detailed behavior needs customer confirmation.
Unknown until interface allocation is confirmed.
Unknown or requirement-specific data.
Security relevance needs detailed review.
Medium
Needs Customer Clarification
Evidence Basis:
Feature ID: FEAT-X003
Capture the expected behavior of the Electric Clutch Actuator ECU boundary before decomposing it into hardware, software, tooling, and operations.
Keeps the system-level intent visible while detailed requirements remain traceable.
System behavior, stakeholder approvals, compliance obligations, timing/state requirements, and customer-facing deliverables.
The package does not prove the complete vehicle function or end-user feature set.
OEM/customer interface, vehicle network, supplier engineering flow, evidence flow.
Requirements, system states, approvals, evidence, release information.
System behavior defines where security objectives attach and where residual risks must be agreed.
Medium
Inferred from Requirements
Evidence Basis:
Feature ID: FEAT-X004
Represent ECU hardware, platform, connector, memory, and security hardware obligations implied by the source requirements.
Makes clear that the cybersecurity concept must be allocated across both hardware and software.
ECU platform support, hardware protection, debug/physical exposure concerns, and implementation allocation.
The exact MCU, HSM, memory map, connector pinout, and production hardware variant are not confirmed.
Internal hardware/software interface, diagnostic access boundary, physical/service access.
Keys, certificates, firmware, platform state, debug/service data.
Hardware is part of key protection, secure boot, anti-tamper posture, and diagnostic attack resistance.
Medium
Inferred from Requirements
Evidence Basis:
Feature ID: FEAT-X005
Identify communication touchpoints where the product exchanges data with vehicle, backend, customer, supplier, diagnostic, or tooling actors.
Creates the bridge from requirements to attack surface review.
External message paths, data exchanged, interface purpose, and protection needs.
Protocol stack, exact network topology, endpoint ownership, and message catalog are not fully confirmed.
Vehicle network, diagnostic tool, backend/cloud, OEM/customer, development/evidence tooling.
Messages, signals, requests/responses, certificates, software packages, logs, security events.
Interfaces are the main places where authentication, authorization, encryption, freshness, replay protection, and logging must be designed.
Medium
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X006
Protect vehicle or client/server data exchanges against unauthorized origin, modification, replay, and stale state.
Turns SecOC/SDT-style requirements into a coherent communication security behavior.
Authentication/encryption, verify/decrypt processing, counters, replay checks, and discard behavior for invalid traffic.
Exact algorithms, key lengths, message IDs, and bus allocation need customer confirmation.
Vehicle network, ECU-to-ECU communication, client/server SDT flows.
Protected signals, counters, request/response payloads, authentication tags.
This feature directly protects integrity, authenticity, freshness, and in some cases confidentiality of vehicle data.
Medium
Inferred from Requirements
Evidence Basis:
Feature ID: FEAT-X007
Control diagnostic access so service and engineering tools cannot become an uncontrolled security bypass.
Allows maintenance while preserving ECU security goals.
Diagnostic authentication, access control, request validation, negative responses, and secure sessions.
Exact diagnostic roles, tester certificates, and service whitelist are not fully confirmed.
Diagnostic tool, UDS services, ECU diagnostic server, security services.
Diagnostic requests, responses, session state, credentials, certificates, unlock state.
Diagnostics can alter state, extract data, or trigger programming; it needs strong access control and audit.
Medium
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X008
Prove the identity or validity of tools, communication partners, data sources, software, or ECU-related entities.
Prevents unauthenticated entities from driving privileged behavior.
Entity authentication, message/source authentication, service authentication, and authentication failure handling.
The final identity model and trust anchors require customer confirmation.
Diagnostic, vehicle network, backend/update, certificate/key provisioning.
Credentials, certificates, authentication tags, session state.
Authentication is a prerequisite for authorization, secure diagnostics, secure update, and protected communication.
Medium
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X009
Manage certificate formats, validation, trust anchors, and certificate-related lifecycle behavior.
Supports scalable trust for diagnostics, update, backend, and vehicle communication.
X.509/certificate handling, validation expectations, and certificate-based trust decisions.
CA hierarchy, enrollment, revocation, storage, and renewal process need confirmation.
PKI, diagnostic tools, backend/update services, ECU security services.
Certificates, chains, trust anchors, validity metadata.
Incorrect certificate handling can defeat authentication and secure communication.
Medium
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X010
Protect cryptographic keys across generation, storage, use, update, and retirement.
Keeps communication, diagnostics, update, and platform integrity controls trustworthy.
Key storage, use restrictions, provisioning assumptions, and cryptographic material handling.
Key hierarchy, HSM APIs, rotation, ownership, and recovery are not fully confirmed.
Security services, hardware platform/HSM, PKI/provisioning, backend/update.
Symmetric keys, private keys, public keys, certificates, key identifiers.
Key compromise collapses multiple controls at once.
Medium
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X011
Record security-relevant actions and decisions for investigation, compliance, and operational feedback.
Supports accountability and incident analysis.
Security event capture, audit evidence, and traceability to requirements or validation results.
Log format, storage, retention, privacy, and upload path require customer confirmation.
ECU logging, backend/security operations, ALM/evidence flow.
Security events, diagnostic attempts, update results, audit records.
Logging is how misuse, failed controls, and residual-risk evidence become visible.
High
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X012
Represent backend, IT, server, portal, and offboard workflows referenced by the requirements.
Shows that security architecture extends beyond the ECU boundary where update, evidence, monitoring, or supplier workflows are involved.
Backend connectivity, IT systems, supplier/OEM portals, storage of evidence or operational security data.
Cloud provider, API contracts, hosting ownership, and network zones are not confirmed.
Backend/cloud, supplier IT, OEM/customer systems, ECU/update path.
Software packages, certificates, logs, vulnerability data, evidence, configuration.
Backend compromise can affect update integrity, certificate lifecycle, evidence integrity, and operational response.
Medium
Inferred from Requirements
Evidence Basis:
Feature ID: FEAT-X013
Capture engineering, build, test, and evidence tooling needed to produce and prove the cybersecurity work products.
Makes development and verification responsibilities visible in the architecture package.
ALM, build/test tooling, verification evidence, traceability artifacts, review workflows.
Tool names, integrations, access model, and retention policy are not confirmed.
Supplier engineering, ALM, CI/test environment, OEM/customer evidence handoff.
Requirements, test reports, traceability, artifacts, build outputs.
Toolchain integrity affects trust in delivered software and evidence.
Medium
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X014
Provide a lifecycle path for handling confirmed or suspected cybersecurity incidents.
Connects product security signals to customer and supplier response obligations.
Incident identification, escalation, documentation, and customer communication assumptions.
Severity model, reporting timelines, and operational owner are not confirmed.
Security operations, OEM/customer, supplier support, backend/tooling.
Incident records, logs, evidence, mitigation status.
Incident response limits damage and provides evidence after preventive controls fail.
High
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X015
Ensure software update, flash, and IVD-related flows preserve authenticity, integrity, and regulatory evidence.
Supports UNECE-style software update obligations and safe maintenance of E/E components.
Update package handling, flash/programming paths, integrity validation data, and update evidence.
Update transport, campaign management, rollback policy, and production signing chain need confirmation.
Backend/update infrastructure, diagnostic/programming tool, ECU boot/update manager, PKI.
Software packages, signatures, IVD data, certificates, programming requests, update logs.
Unauthorized or corrupted software undermines ECU authenticity and all data security goals.
High
Inferred from Requirements
Evidence Basis:
Feature ID: FEAT-X016
Identify, assess, treat, verify, and communicate vulnerabilities and risks over releases.
Keeps the system secure beyond a single development milestone.
Risk assessment, vulnerability evaluation, penetration-test readiness, mitigation tracking, release impact review.
Customer-specific vulnerability intake SLAs and tool workflow are not confirmed.
OEM/customer, supplier security team, development tooling, incident process.
Vulnerability records, risk treatment decisions, mitigation evidence, release notes.
Unmanaged vulnerabilities become residual risk without ownership.
High
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X017
Maintain a verifiable chain from cybersecurity requirements to controls, implementation, validation, residual risk, and customer agreement.
Turns the RFQ into an auditable security engineering package instead of disconnected controls.
Cybersecurity concept, risk assessment input, control derivation, verification/validation evidence, residual risk documentation.
Final TARA results and customer-approved risk treatment are not claimed.
OEM/customer, supplier engineering, ALM/evidence repository, security review process.
Requirements, risks, controls, test reports, residual-risk decisions, review evidence.
Evidence discipline is required to prove that controls exist and reduce risk sufficiently.
High
Explicit Requirement
Evidence Basis:
Feature ID: FEAT-X018
Provide proof that requirements, controls, architecture decisions, verification, validation, and residual risk remain connected.
Gives reviewers a way to audit security decisions before accepting the architecture.
Traceability matrices, evidence reports, human-review queues, quality gates, and open decisions.
Customer acceptance workflow and evidence repository ownership are not confirmed.
ALM/evidence repository, OEM/customer review, supplier security process.
Requirement IDs, source sections, controls, test reports, decisions, open questions.
Without evidence traceability, control implementation cannot be credibly argued.
Medium
Inferred from Requirements
Evidence Basis:
| Feature | Domain | Interfaces | Evidence basis | Classification |
|---|---|---|---|---|
| Application software behavior | Core Product Capabilities | Vehicle network, internal security services, diagnostics, backend/tooling where called by requirements. | REQ-AUTO-00006; REQ_SEC_0007; REQ-AUTO-00129; REQ-AUTO-00178; REQ-AUTO-00180; REQ-AUTO-00238; REQ-AUTO-00244; REQ-AUTO-00266; REQ-AUTO-00277; REQ-AUTO-00286 (showing 10 of 179) | Inferred from Requirements |
| Secure communication | Core Product Capabilities | Unknown until interface allocation is confirmed. | REQ-AUTO-00455 | Needs Customer Clarification |
| System behavior | Core Product Capabilities | OEM/customer interface, vehicle network, supplier engineering flow, evidence flow. | REQ-AUTO-00004; REQ-AUTO-00005; REQ-AUTO-00021; REQ_SEC_0020; REQ_SEC_0012; REQ_SEC_0013; REQ-AUTO-00028; REQ_SEC_0014; REQ-AUTO-00030; REQ_SEC_0028 (showing 10 of 388) | Inferred from Requirements |
| Hardware platform support | Vehicle/ECU Integration Capabilities | Internal hardware/software interface, diagnostic access boundary, physical/service access. | REQ_SEC_0025; REQ_SEC_0010; REQ_SEC_0011; REQ_SEC_0026; REQ_SEC_0047; REQ_SEC_0049; REQ_SEC_0050; REQ-AUTO-00060; REQ-AUTO-00061; REQ-AUTO-00065 (showing 10 of 45) | Inferred from Requirements |
| External interfaces | Communication and Connectivity Capabilities | Vehicle network, diagnostic tool, backend/cloud, OEM/customer, development/evidence tooling. | REQ_SEC_0036; REQ-AUTO-00066; REQ-AUTO-00078; REQ-AUTO-00138; REQ-AUTO-00139; REQ-AUTO-00141; REQ-AUTO-00143; REQ-AUTO-00145; REQ-AUTO-00146; REQ-AUTO-00177 (showing 10 of 44) | Explicit Requirement |
| Secure communication and freshness protection | Communication and Connectivity Capabilities | Vehicle network, ECU-to-ECU communication, client/server SDT flows. | REQ-AUTO-00410; REQ-AUTO-00867; REQ-AUTO-00889; REQ-AUTO-00890; REQ-AUTO-00992; REQ-AUTO-00993; REQ-AUTO-00994; REQ-AUTO-00995; REQ-AUTO-00997; REQ-AUTO-00999 (showing 10 of 90) | Inferred from Requirements |
| Diagnostic security | Diagnostic and Maintenance Capabilities | Diagnostic tool, UDS services, ECU diagnostic server, security services. | req-6.20; REQ-AUTO-00282; REQ-AUTO-00290; REQ-AUTO-00299; REQ-AUTO-00310; REQ-AUTO-00315; REQ-AUTO-00318; REQ-AUTO-00350; REQ-AUTO-00370; REQ-AUTO-00372 (showing 10 of 30) | Explicit Requirement |
| Authentication | Cybersecurity Capabilities | Diagnostic, vehicle network, backend/update, certificate/key provisioning. | REQ_SEC_0008; REQ-AUTO-00333; REQ-AUTO-00334; REQ-AUTO-00832; REQ-AUTO-00892; REQ-AUTO-00895; REQ-AUTO-00907; REQ-AUTO-00933; REQ-AUTO-00934; REQ-AUTO-00935 (showing 10 of 30) | Explicit Requirement |
| Certificate handling | Cybersecurity Capabilities | PKI, diagnostic tools, backend/update services, ECU security services. | REQ-AUTO-00818; REQ-AUTO-00821; REQ-AUTO-00839; REQ-AUTO-00951; REQ-AUTO-00953 | Explicit Requirement |
| Key management | Cybersecurity Capabilities | Security services, hardware platform/HSM, PKI/provisioning, backend/update. | REQ_SEC_0016; REQ_SEC_0019; REQ_UDS-0068; REQ_UDS-0070; REQ_UDS-0092; REQ-AUTO-00875; REQ-AUTO-00991; REQ-AUTO-01014; REQ-AUTO-01017; REQ-AUTO-01022 (showing 10 of 13) | Explicit Requirement |
| Logging and audit trail | Cybersecurity Capabilities | ECU logging, backend/security operations, ALM/evidence flow. | REQ_SEC_0051 | Explicit Requirement |
| Backend and IT integration | Backend/IT/Tooling Capabilities | Backend/cloud, supplier IT, OEM/customer systems, ECU/update path. | REQ-AUTO-00081; REQ-AUTO-00090; REQ-AUTO-00091; req.10.5; REQ-AUTO-00101; REQ-AUTO-00104; req-5.10; req-6.4; REQ-AUTO-00112; REQ-AUTO-00114 (showing 10 of 209) | Inferred from Requirements |
| Engineering tooling | Backend/IT/Tooling Capabilities | Supplier engineering, ALM, CI/test environment, OEM/customer evidence handoff. | REQ-AUTO-00093; REQ-AUTO-00094; REQ-AUTO-00098 | Explicit Requirement |
| Incident response | Operational and Lifecycle Capabilities | Security operations, OEM/customer, supplier support, backend/tooling. | REQ_SEC_0045 | Explicit Requirement |
| Secure software update and flash readiness | Operational and Lifecycle Capabilities | Backend/update infrastructure, diagnostic/programming tool, ECU boot/update manager, PKI. | REQ-AUTO-00203; REQ-AUTO-00290; REQ_UDS-0051; REQ-AUTO-00297; REQ-AUTO-00302; REQ-AUTO-00303; REQ-AUTO-00306; REQ-AUTO-00307; REQ-AUTO-00311; REQ-AUTO-00312 (showing 10 of 121) | Inferred from Requirements |
| Vulnerability management | Operational and Lifecycle Capabilities | OEM/customer, supplier security team, development tooling, incident process. | REQ_SEC_0002; REQ-AUTO-00051 | Explicit Requirement |
| Cybersecurity requirement handling | Compliance and Evidence Capabilities | OEM/customer, supplier engineering, ALM/evidence repository, security review process. | REQ-AUTO-00001; REQ_SEC_0001; REQ_SEC_0003; REQ_SEC_0022; REQ-AUTO-00009; REQ_SEC_0023; REQ-AUTO-00011; REQ_SEC_0024; REQ_SEC_0004; REQ_SEC_0005 (showing 10 of 18) | Explicit Requirement |
| Security evidence and traceability | Compliance and Evidence Capabilities | ALM/evidence repository, OEM/customer review, supplier security process. | REQ-AUTO-00001; REQ_SEC_0001; REQ-AUTO-00005; REQ_SEC_0024; REQ_SEC_0004; REQ_SEC_0005; REQ_SEC_0007; REQ-AUTO-00076; REQ-AUTO-00150; REQ-AUTO-00172 (showing 10 of 47) | Inferred from Requirements |
| Feature | Security capabilities | Evidence basis | Confidence | Classification |
|---|---|---|---|---|
| Application software behavior | Authorization; Secure communication; Logging and audit; Secure diagnostics | REQ-AUTO-00006; REQ_SEC_0007; REQ-AUTO-00129; REQ-AUTO-00178; REQ-AUTO-00180; REQ-AUTO-00238; REQ-AUTO-00244; REQ-AUTO-00266; REQ-AUTO-00277; REQ-AUTO-00286 (showing 10 of 179) | Medium | Inferred from Requirements |
| Secure communication | Needs Customer Clarification | REQ-AUTO-00455 | Medium | Needs Customer Clarification |
| System behavior | Compliance and evidence management; Vulnerability and incident handling | REQ-AUTO-00004; REQ-AUTO-00005; REQ-AUTO-00021; REQ_SEC_0020; REQ_SEC_0012; REQ_SEC_0013; REQ-AUTO-00028; REQ_SEC_0014; REQ-AUTO-00030; REQ_SEC_0028 (showing 10 of 388) | Medium | Inferred from Requirements |
| Hardware platform support | Secure boot and platform integrity; Key management; Secure diagnostics | REQ_SEC_0025; REQ_SEC_0010; REQ_SEC_0011; REQ_SEC_0026; REQ_SEC_0047; REQ_SEC_0049; REQ_SEC_0050; REQ-AUTO-00060; REQ-AUTO-00061; REQ-AUTO-00065 (showing 10 of 45) | Medium | Inferred from Requirements |
| External interfaces | Secure communication; Authentication; Certificate lifecycle; Logging and audit | REQ_SEC_0036; REQ-AUTO-00066; REQ-AUTO-00078; REQ-AUTO-00138; REQ-AUTO-00139; REQ-AUTO-00141; REQ-AUTO-00143; REQ-AUTO-00145; REQ-AUTO-00146; REQ-AUTO-00177 (showing 10 of 44) | Medium | Explicit Requirement |
| Secure communication and freshness protection | Secure communication; Cryptographic protection; Key management | REQ-AUTO-00410; REQ-AUTO-00867; REQ-AUTO-00889; REQ-AUTO-00890; REQ-AUTO-00992; REQ-AUTO-00993; REQ-AUTO-00994; REQ-AUTO-00995; REQ-AUTO-00997; REQ-AUTO-00999 (showing 10 of 90) | Medium | Inferred from Requirements |
| Diagnostic security | Secure diagnostics; Authentication; Authorization; Logging and audit | req-6.20; REQ-AUTO-00282; REQ-AUTO-00290; REQ-AUTO-00299; REQ-AUTO-00310; REQ-AUTO-00315; REQ-AUTO-00318; REQ-AUTO-00350; REQ-AUTO-00370; REQ-AUTO-00372 (showing 10 of 30) | Medium | Explicit Requirement |
| Authentication | Identity and access control; Certificate lifecycle; Secure communication | REQ_SEC_0008; REQ-AUTO-00333; REQ-AUTO-00334; REQ-AUTO-00832; REQ-AUTO-00892; REQ-AUTO-00895; REQ-AUTO-00907; REQ-AUTO-00933; REQ-AUTO-00934; REQ-AUTO-00935 (showing 10 of 30) | Medium | Explicit Requirement |
| Certificate handling | Key and certificate management; Identity and access control; Secure communication | REQ-AUTO-00818; REQ-AUTO-00821; REQ-AUTO-00839; REQ-AUTO-00951; REQ-AUTO-00953 | Medium | Explicit Requirement |
| Key management | Cryptographic protection; Key and certificate management | REQ_SEC_0016; REQ_SEC_0019; REQ_UDS-0068; REQ_UDS-0070; REQ_UDS-0092; REQ-AUTO-00875; REQ-AUTO-00991; REQ-AUTO-01014; REQ-AUTO-01017; REQ-AUTO-01022 (showing 10 of 13) | Medium | Explicit Requirement |
| Logging and audit trail | Logging and audit; Security monitoring and detection | REQ_SEC_0051 | High | Explicit Requirement |
| Backend and IT integration | Backend/cloud security; Secure update; Logging and audit | REQ-AUTO-00081; REQ-AUTO-00090; REQ-AUTO-00091; req.10.5; REQ-AUTO-00101; REQ-AUTO-00104; req-5.10; req-6.4; REQ-AUTO-00112; REQ-AUTO-00114 (showing 10 of 209) | Medium | Inferred from Requirements |
| Engineering tooling | Development and toolchain security; Compliance and evidence management | REQ-AUTO-00093; REQ-AUTO-00094; REQ-AUTO-00098 | Medium | Explicit Requirement |
| Incident response | Vulnerability and incident handling; Logging and audit | REQ_SEC_0045 | High | Explicit Requirement |
| Secure software update and flash readiness | Secure software update; Secure boot and platform integrity; Key and certificate management | REQ-AUTO-00203; REQ-AUTO-00290; REQ_UDS-0051; REQ-AUTO-00297; REQ-AUTO-00302; REQ-AUTO-00303; REQ-AUTO-00306; REQ-AUTO-00307; REQ-AUTO-00311; REQ-AUTO-00312 (showing 10 of 121) | High | Inferred from Requirements |
| Vulnerability management | Vulnerability and incident handling; Compliance and evidence management | REQ_SEC_0002; REQ-AUTO-00051 | High | Explicit Requirement |
| Cybersecurity requirement handling | Compliance and evidence management; Vulnerability and incident handling | REQ-AUTO-00001; REQ_SEC_0001; REQ_SEC_0003; REQ_SEC_0022; REQ-AUTO-00009; REQ_SEC_0023; REQ-AUTO-00011; REQ_SEC_0024; REQ_SEC_0004; REQ_SEC_0005 (showing 10 of 18) | High | Explicit Requirement |
| Security evidence and traceability | Compliance and evidence management; Development and toolchain security | REQ-AUTO-00001; REQ_SEC_0001; REQ-AUTO-00005; REQ_SEC_0024; REQ_SEC_0004; REQ_SEC_0005; REQ_SEC_0007; REQ-AUTO-00076; REQ-AUTO-00150; REQ-AUTO-00172 (showing 10 of 47) | Medium | Inferred from Requirements |
REQ-AUTO-00006: Review possible noise/boilerplate contamination.REQ_SEC_0040: Confirm whether this statement is a binding requirement.REQ_SEC_0041: Confirm whether this statement is a binding requirement.req-6.3: Confirm whether this statement is a binding requirement.REQ-AUTO-00146: Review possible noise/boilerplate contamination.Req.ID-Description-6.22.1: Confirm whether this statement is a binding requirement.REQ-AUTO-00171: Confirm whether this statement is a binding requirement.REQ-AUTO-00175: Confirm whether this statement is a binding requirement.REQ-AUTO-00190: Confirm whether this statement is a binding requirement. | Clarify ambiguous or incomplete source wording.REQ-AUTO-00246: Confirm whether this statement is a binding requirement.REQ-AUTO-00249: Confirm whether this statement is a binding requirement.REQ-AUTO-00250: Confirm whether this statement is a binding requirement.REQ-AUTO-00272: Confirm whether this statement is a binding requirement.REQ-AUTO-00278: Confirm whether this statement is a binding requirement.REQ-AUTO-00279: Confirm whether this statement is a binding requirement.REQ-AUTO-00284: Confirm whether this statement is a binding requirement.REQ-AUTO-00292: Confirm whether this statement is a binding requirement.REQ_UDS-0051: Confirm whether this statement is a binding requirement.REQ-AUTO-00294: Confirm whether this statement is a binding requirement.REQ_UDS-0051: Confirm whether this statement is a binding requirement.REQ-AUTO-00298: Confirm whether this statement is a binding requirement.REQ-AUTO-00317: Clarify ambiguous or incomplete source wording.REQ-AUTO-00335: Confirm whether this statement is a binding requirement.REQ-AUTO-00337: Confirm whether this statement is a binding requirement.REQ-AUTO-00338: Confirm whether this statement is a binding requirement.REQ_UDS-0051: Confirm whether this statement is a binding requirement.REQ-AUTO-00343: Confirm whether this statement is a binding requirement.REQ-AUTO-00378: Confirm whether this statement is a binding requirement.REQ-AUTO-00420: Confirm whether this statement is a binding requirement.REQ-AUTO-00480: Confirm whether this statement is a binding requirement.REQ-AUTO-00485: Confirm whether this statement is a binding requirement.REQ-AUTO-00488: Review possible noise/boilerplate contamination.REQ-AUTO-00492: Confirm whether this statement is a binding requirement.REQ_UDS-0003: Confirm whether this statement is a binding requirement.REQ_UDS-0004: Confirm whether this statement is a binding requirement.REQ_UDS-0006: Confirm whether this statement is a binding requirement.REQ_UDS-0007: Confirm whether this statement is a binding requirement.REQ_UDS-0008: Confirm whether this statement is a binding requirement.REQ_UDS-0010: Confirm whether this statement is a binding requirement.REQ_UDS-0014: Confirm whether this statement is a binding requirement.REQ_UDS-0015: Confirm whether this statement is a binding requirement.REQ_UDS-0016: Confirm whether this statement is a binding requirement.REQ_UDS-0017: Confirm whether this statement is a binding requirement.REQ_UDS-0020: Confirm whether this statement is a binding requirement.REQ_UDS-0339: Confirm whether this statement is a binding requirement.REQ_UDS-0340: Confirm whether this statement is a binding requirement.REQ_UDS-0341: Confirm whether this statement is a binding requirement.REQ_UDS-0023: Confirm whether this statement is a binding requirement.REQ_UDS-0025: Confirm whether this statement is a binding requirement.REQ_UDS-0030: Confirm whether this statement is a binding requirement.REQ_UDS-0032: Confirm whether this statement is a binding requirement.REQ_UDS-0033: Confirm whether this statement is a binding requirement.REQ_UDS-0036: Confirm whether this statement is a binding requirement.REQ_UDS-0037: Confirm whether this statement is a binding requirement.REQ_UDS-0038: Confirm whether this statement is a binding requirement.REQ_UDS-0041: Confirm whether this statement is a binding requirement.REQ_UDS-0045: Confirm whether this statement is a binding requirement.REQ_UDS-0049: Confirm whether this statement is a binding requirement.REQ_UDS-0051: Clarify ambiguous or incomplete source wording.REQ_UDS-0305: Confirm whether this statement is a binding requirement.REQ_UDS-0306: Confirm whether this statement is a binding requirement.REQ_UDS-0316: Confirm whether this statement is a binding requirement.REQ_UDS-0328: Confirm whether this statement is a binding requirement.REQ-AUTO-00563: Confirm whether this statement is a binding requirement.REQ_UDS-0073: Confirm whether this statement is a binding requirement.REQ_UDS-0074: Confirm whether this statement is a binding requirement.REQ_UDS-0078: Confirm whether this statement is a binding requirement.REQ-AUTO-00588: Confirm whether this statement is a binding requirement.REQ_UDS-0345: Confirm whether this statement is a binding requirement.REQ_UDS-0346: Confirm whether this statement is a binding requirement.REQ_UDS-0347: Confirm whether this statement is a binding requirement.REQ_UDS-0348: Confirm whether this statement is a binding requirement.REQ_UDS-0349: Confirm whether this statement is a binding requirement.REQ_UDS-0093: Confirm whether this statement is a binding requirement.REQ_UDS-0259: Confirm whether this statement is a binding requirement.REQ_UDS-0094: Confirm whether this statement is a binding requirement.REQ_UDS-0095: Confirm whether this statement is a binding requirement.REQ-AUTO-00629: Confirm whether this statement is a binding requirement.REQ-AUTO-00634: Clarify ambiguous or incomplete source wording.REQ_UDS-0103: Confirm whether this statement is a binding requirement.REQ_UDS-0104: Confirm whether this statement is a binding requirement.REQ_UDS-0105: Confirm whether this statement is a binding requirement.REQ_UDS-0107: Confirm whether this statement is a binding requirement.REQ-AUTO-00652: Confirm whether this statement is a binding requirement.REQ_UDS-0113: Confirm whether this statement is a binding requirement.REQ_UDS-0114: Confirm whether this statement is a binding requirement.REQ_UDS-0116: Confirm whether this statement is a binding requirement.REQ_UDS-0117: Confirm whether this statement is a binding requirement.REQ_UDS-0118: Confirm whether this statement is a binding requirement.REQ_UDS-0120: Confirm whether this statement is a binding requirement.REQ_UDS-0295: Confirm whether this statement is a binding requirement.REQ_UDS-0123: Confirm whether this statement is a binding requirement.REQ_UDS-0134: Confirm whether this statement is a binding requirement.REQ_UDS-0135: Confirm whether this statement is a binding requirement.REQ_UDS-0136: Confirm whether this statement is a binding requirement.REQ-AUTO-00704: Confirm whether this statement is a binding requirement.REQ_UDS-0163: Confirm whether this statement is a binding requirement.REQ_UDS-0167: Confirm whether this statement is a binding requirement.REQ_UDS-0169: Confirm whether this statement is a binding requirement.REQ_UDS-0208: Confirm whether this statement is a binding requirement.REQ_UDS-0209: Confirm whether this statement is a binding requirement.REQ_UDS-0215: Confirm whether this statement is a binding requirement.REQ_UDS-0217: Confirm whether this statement is a binding requirement.REQ_UDS-0218: Confirm whether this statement is a binding requirement.REQ_UDS-0220: Confirm whether this statement is a binding requirement.REQ_UDS-0221: Confirm whether this statement is a binding requirement.REQ_UDS-0222: Confirm whether this statement is a binding requirement.REQ_UDS-0339: Confirm whether this statement is a binding requirement.REQ_UDS-0003: Confirm whether this statement is a binding requirement.REQ-AUTO-00785: Confirm whether this statement is a binding requirement.REQ-AUTO-00843: Confirm whether this statement is a binding requirement.REQ-AUTO-00859: Confirm whether this statement is a binding requirement.REQ-AUTO-00866: Review possible noise/boilerplate contamination.REQ-AUTO-00880: Confirm whether this statement is a binding requirement.REQ-AUTO-00932: Confirm whether this statement is a binding requirement.REQ-AUTO-00947: Confirm whether this statement is a binding requirement.REQ-AUTO-00988: Confirm whether this statement is a binding requirement.REQ-AUTO-00996: Confirm whether this statement is a binding requirement.REQ-AUTO-01013: Confirm whether this statement is a binding requirement.REQ-AUTO-01056: Confirm whether this statement is a binding requirement.