Cybersecurity
SUMS (UN R156) Software Update Management Consulting
We support SUMS process development, ISO 24089 implementation, and update verification testing.
We support SUMS process development, ISO 24089 implementation, and update verification testing.
Why You Need This
Software Updates Need
a Management System Too
Does UN R156 apply to your product?
R156 type approval requires the manufacturer's SUMS Certificate of Compliance. In Korea, the amended Motor Vehicle Management Act (in force since August 2025) also sets software update obligations.
OTA updates: what must you demonstrate?
A failed or interrupted update must restore the previous version or reach a safe state, and this is checked by vehicle testing at type approval.
Received update requirements from an OEM?
The obligation lies with the manufacturer, but ECU software is often developed by suppliers. ISO 24089 also covers suppliers.
Service Introduction
SeonENS SUMS Consulting
We address UN R156 and ISO 24089 together and tailor our support to your role as a manufacturer or supplier.
SUMS Process Development
We establish the procedures examined in the assessment: versions, RXSWIN, compatibility checks, and type approval impact assessment.
ISO 24089 Process Implementation
We define update activities and connect them with ASPICE and ISO 26262 work products.
Update Verification Testing
On HIL and bench setups, we test normal updates as well as power loss, communication loss, and tampered packages.
Cybersecurity (R155) Integration
We handle authenticity and integrity protection of update packages together with ISO/SAE 21434 activities.
Service Areas
UN R156 and ISO 24089-Based Activities
Organization Level (SUMS)
- Update policy and processes
- Version and RXSWIN management
- Type approval impact assessment
Project Level (ISO 24089)
- Update requirements definition
- Package composition and dependency management
- User information definition
Verification (Update Testing)
- Normal update and version check
- Recovery from failure or interruption
- Tampered package rejection
UN R156 Requirements Response
| Requirement | SeonENS Support |
|---|---|
| SUMS Certificate of Compliance | SUMS process development and assessment support |
| RXSWIN, type approval impact | Management system and assessment procedures |
| Update security | Linkage with ISO/SAE 21434 activities |
| Additional OTA requirements | Evidence through update verification testing |
Update Verification Testing
| Test | What We Check |
|---|---|
| Normal update | Version and RXSWIN readable through the standard interface |
| Failure, interruption | Previous version restored or safe state reached |
| Execution preconditions | No start when power is low or safe conditions are not met |
| Tampered, invalid package | Packages with a wrong signature or target rejected |
| Post-update regression | No unintended changes in functions, diagnostics, or communication |
Consulting Process
Phase 1: Current State Diagnosis
- Review of update procedures and roles
- R156 and ISO 24089 gap analysis
- Response roadmap
Phase 2: SUMS Process Development
- Policy and process establishment
- Version and RXSWIN management
- Templates and guidelines
Phase 3: Product Application and Verification
- Update requirements and package definition
- Type approval impact assessment
- Update verification testing
Phase 4: Assessment Response
- SUMS assessment response
- Type approval evidence preparation
- OEM requirement response
Expected Benefits
Practical Benefits
- Regulatory Response Foundation
- An update management system that meets R156, Korean law, and OEM requirements.
- One System with Cybersecurity
- No separate CSMS and SUMS to maintain.
- Updates Backed by Evidence
- Test results, including failure cases, kept as evidence.
Start Your SUMS Response Now
Start Your SUMS
Response Now
Tell us your target product and update method (OTA or wired), and we will propose a response plan.
Tell us your target product and update method (OTA or wired), and we will propose a response plan.