United Nations

Conclusion and Recommendation for further proceedings

1. 
   The paper provides a framework by which the security of systems may be considered and the decisions made documented.
   
2. 
   It can be concluded that principles/objectives are an appropriate way to provide guidelines on what is required to mitigate against cyber security vulnerabilities. Specifying technical solutions is deemed inappropriate as these would not stand the test of time, and would stifle innovation and competition.
   
3. 
   This paper is the outcome of adopting a risk management approach assessing the potential cyber security vulnerabilities of the present and emerging vehicle ecosystem. The assessment has drawn upon bodies of work and the knowledge and experience of stakeholders. As such, it is recommended it is accepted as complete by the IWG on ITS/AD and the Task Force is disbanded.
   
4. 
   The risks and mitigations identified in this paper are not exhaustive and may not be applicable for the implementation of specific products or services. It is recommended that the reader should consider the applicability of the examples provided and whether there might be better solutions for the examples identified.
   
5. 
   This paper does not define where the responsibility lies for undertaking or funding the mitigations that address the principles/objectives. The question of how long after vehicle introduction it would be viable or reasonable to provide cyber security updates is unresolved.
   
6. 
   This paper address how to assess adoption of the principles/objectives.
   
7. 
   During the course of the threat analysis, risks were identified that were deemed to be outside the scope of this paper. However, these risks should not be overlooked, and it is therefore recommended that these should be passed onto the appropriate UN body for consideration.
   
8. 
   It should be noted the domain of cyber security is highly dynamic. It is recommended that there is a need to periodically review this paper to ensure it addresses new and emerging threats and mitigations, and is updated where necessary. The IWG on ITS/AD needs to oversee and initiate the reviews, re-establishing the Task Force as required.