INF.11 General Vehicle

The intended use of a vehicle MUST be planned before the vehicle is procured. The functional requirements for vehicles and, in particular, the requirements for information security and data protection of the IT components installed in them MUST be determined. The following aspects MUST be taken into account:

• operational scenarios of the vehicles
• the immediate operational environment of the vehicles
• the entire lifecycle of the vehicles

The vehicles MUST also have adequate locking systems unless they can be continuously secured by other safeguards or arrangements. During planning, consideration SHOULD be given to the fact that many vehicles can transmit data to the vehicle manufacturer and other third parties.

Vehicles and their IT components MUST be maintained in line with the manufacturer's specifications. This MUST take into account that conventional maintenance intervals may not correspond to the updates provided for integrated IT components. Those who are allowed to install such updates MUST be clearly defined along with the environment required for this purpose. Over-the-air (OTA) updates MUST also be installed in a regulated manner.

Maintenance and repair work MUST be carried out by authorised and qualified personnel in a secure environment. The manner in which external companies are to be dealt with SHOULD be clarified prior to such maintenance. If vehicle maintenance takes place at external organisations, checks SHOULD be carried out to ensure that all the unnecessary portable IT systems belonging to the vehicle are removed.

When vehicles are put back into operation, a checklist MUST be used to verify that all the complaints and deficiencies in question have been rectified. The functionality of the IT components involved MUST also be checked.

Before any activity is carried out in a vehicle that may have an impact on the security of the information processed in the vehicle, it MUST be determined whether the activity is permissible. In this context, the information that may be transported and processed MUST be clearly regulated. In addition, the protective safeguards to be taken MUST be specified. This MUST apply to any kind of information, including that which is exchanged in conversations in vehicles. The framework conditions that are required for employees to access specific types of information at their organisation MUST be clarified.

Furthermore, the extent to which infotainment systems, applications, and other vehicle services may be used MUST be regulated. The manner in which interfaces are to be secured MUST also be specified. Existing business and service directives MUST describe how IT carried in vehicles may be used and stored.

All the security requirements relevant to IT within vehicles SHOULD be documented in a security policy that is mandatory for employees. The policy SHOULD be known to all the relevant employees in the organisation in question and should form the basis of their handling of vehicles. The policy SHOULD clearly define responsibilities for individual tasks. The security policy SHOULD be reviewed and updated as appropriate.

For each vehicle, an inventory list SHOULD be drawn up that contains the following:

• the IT components permanently installed or associated with the vehicle (e.g. handheld radios in emergency vehicles)
• the specialised procedures that are executed on the vehicle's integrated IT components
• instructions and operational documentation
• the mobile devices linked to the infotainment system

The inventory list SHOULD be updated regularly and as appropriate. It SHOULD be checked that all inventoried IT components belonging to the vehicle are still present. In addition, the inventory list SHOULD be used to check that no mobile devices have been connected to the infotainment system without authorisation.

Instructions in the form of checklists SHOULD be available for all the fundamental situations related to vehicle information security. The instructions SHOULD be integrated into the corresponding security policy and made available in suitable checklists while the vehicle in question is in use. This SHOULD also account for the possibility that the vehicle may be stolen. In particular, the instructions SHOULD address the following scenarios:

• failure of vehicle IT components
• emergency situations such as accidents
• unauthorised vehicle entry
• theft of a vehicle or objects stored therein that are relevant to information security

The responsibilities for each task SHOULD be documented in the checklists. The instructions SHOULD be followed by vehicle users in the corresponding situations. The checklists SHOULD be used to document how users proceeded in such situations.

An organisation SHOULD supplement its instructions on vehicle use with guidelines on when, how, and where vehicles may be parked or docked properly. These guidelines SHOULD mainly define environments that adequately protect vehicles from unauthorised access or damage. Furthermore, the information and IT systems that may be kept in vehicles SHOULD be considered. Sufficient safeguards SHOULD be taken to protect access.

Vehicle cargo SHOULD be securely stowed. It SHOULD be ensured that sensitive information cannot be viewed, overheard, or stolen by unauthorised persons from outside vehicles. Employees SHOULD be made aware of the basic operation of vehicles and the IT components involved. Employees SHOULD also be informed of the security risks at hand.

Vehicles and the IT components installed in them SHOULD be adequately protected against weather-related influences. Additional protective safeguards SHOULD be taken depending on the type of vehicle, location, and operational environment. Appropriate protective safeguards SHOULD be taken to address extreme weather conditions that occur at short notice.

These protective safeguards SHOULD be documented in the form of checklists in instructions on vehicle use.

Before vehicles are deployed, the manner in which they will be supplied with fuel during operations SHOULD be planned. Vehicles SHOULD always be sufficiently supplied with fuel during operations.

When vehicles are decommissioned, no sensitive information SHOULD remain in them. Before vehicles are decommissioned for the last time, the corresponding inventory list SHOULD be used to check that no inventoried items or any other relevant objects have been left behind.

Preparatory safeguards SHOULD be taken within the organisation in question in case there is a problem with a driver or a vehicle. Depending on the importance of vehicles, replacement vehicles SHOULD be available. Alternatively, a framework agreement SHOULD be concluded with a suitable external organisation. Replacement drivers SHOULD also be available.

An alarm system SHOULD be in place. Land-based vehicles SHOULD also have an immobiliser. If a vehicle is abandoned, the alarm and immobiliser SHOULD be activated. Alternatively, vehicles SHOULD be guarded.

Depending on the type of vehicle, appropriate safeguards SHOULD be taken to protect vehicles from potential third-party interference (such as radio interference) in the planned operational environment.

Vehicles and their IT components SHOULD be secured in such a way that sensitive information cannot be read, manipulated, or deleted by unauthorised persons. In this context, the manufacturer safeguards SHOULD be checked and adapted if necessary.

All internal and external physical interfaces of vehicles SHOULD be physically secured against unauthorised use and external influences.

Vehicles SHOULD have a fire extinguishing system capable of extinguishing a fire from the outside and inside. Alternatively, suitable fire-fighting equipment SHOULD be stored in vehicles.

In general, an organisation SHOULD ensure that no information is exchanged in an unauthorised and undefined manner between

• in-vehicle networks (IVNs, which are typically connected to the networks of vehicle manufacturers) and
• mission-specific IT components.

Gateways with standardised protocols (e.g. in line with Standard CiA 447) SHOULD be used for this purpose. The gateways SHOULD be approved by the vehicle manufacturer.