Overview - Automotive SPICE® (ASPICE) for Cybersecurity

Explore the drivers of automotive complexity, from driver assistance to automated features, and learn why SPICE standards guide processes, requirements, and supplier selection for safe, sustainable, high-quality development.

Trace the history of automotive spice (asepsis) from its 2005 release by Automotive Special Interest Group to ISO 33 zero series, and its process reference model and process assessment model.

Explore the structure of Automotive SPICE for cybersecurity, including process groups, capability levels, and the new SCC processes, and how they align with the V model and ISO lifecycle.

Compare ASPICE for cybersecurity with ISO/SAE 21434:2021 to show how cyber security requirements shape vehicle development and risk management for all roles.

Learn how to locate and download the Automotive SPICE for cybersecurity document. See differences between versions 3.1 and 4.0, language options, and the cybersecurity process groups and work products.

Explore the structure of the ASPICE process description template, including the process reference model, process id, purpose, outcomes, base practices, and output information items mapping to process outcomes.

Understand acq.2 supplier request and selection in automotive spice, from evaluating candidates against defined criteria to issuing requests for quotation and negotiating a cyber security interface agreement.

Learn automotive cybersecurity risk management by identifying, prioritizing, and treating risks with Tara and threat analysis and risk assessment, then monitoring mitigations across the project life cycle.

Derive cybersecurity goals and requirements from identified risks, and map them to threat scenarios. Ensure bidirectional traceability and consistency across system and software levels, with stakeholder acceptance.

Allocate cybersecurity requirements elicitation inputs to system and software elements, refine architectural design, select controls, analyze vulnerabilities, and ensure bidirectional traceability and communication of risk treatment.

Identify and verify the cybersecurity risk treatment against requirements using the v-model, applying verification methods like testing and reviews, maintaining traceability and clear independence levels.

Explore risk treatment validation in automotive ASPICE for cybersecurity, confirming that validation covers cybersecurity goals on the right side of the V-model with defined independence.

Explore ASPICE capability levels from zero to five and the two dimensions of the process reference model and outcomes, clarifying how attributes and generic practices guide process performance.

Explore the process attribute template used in the ACB standard to describe process attributes, their scope, and achievements, with base and generic practices and output information items, for cybersecurity ASPICE.

Learn how an Automotive SPICE assessment is performed, with defined scope and external assessors, rating capabilities as not achieved, partially achieved, largely achieved, or fully achieved.

Thank you for participating in the automotive spice for cybersecurity course. Explore topics like the cyber security standard, ISO 2143 for the functional safety standard in other courses.

Trace the motivation and history of the ISO cyber security standard for road vehicles, from 2016 to 2021, and introduce basic terms, definitions, and references.

Define cyber security for road vehicles per ISO standards, clarifying assets, threat scenarios, and damage scenarios, and explain the goal to minimize risk and introduce risk concepts.

Define risk as a function of severity and probability across safety and cybersecurity contexts, comparing exposure and controllability under ISO standards, and illustrate with tram and rain scenarios.

Define cyber security per ISO 2143 four and distinguish assets, threat scenarios, and damage scenarios, then explain how risk reduction aims to protect assets and minimize consequences.

Explore how the cyber security assurance level (cal) classifies threat scenarios and guides risk reduction, development and verification methods, and cybersecurity assessment approaches from concept to level four in Aspice.

Discover legal aspects of standards, differentiate mandatory law from optional best practices, and understand burden of proof in product liability, state-of-the-art updates, and demonstrating correct implementation before release.

Explore the ISO 21434 structure from organizational to life-cycle cybersecurity management. Navigate chapters five to fifteen, including project-dependent, distributed, and continuous cybersecurity activities, risk assessment, validation, and product life-cycle considerations.

Understand how ASPICE problem resolution management identifies, records, analyzes, and tracks problems, prioritizes them by severity and urgency, and coordinates short- and long-term solutions with stakeholder alerts.