How Bentley Motors achieved UNECE Cybersecurity & Software compliance with MHP Consulting

Bentley Motors and MHP Consulting UK have collaborated to establish robust Cybersecurity and Software Update Management Systems (CSMS & SUMS) for the Bentley landscape, achieving compliance with the UNECE (United Nations Economic Commission for Europe) World Forum for Harmonization of Vehicle Regulations (WP.29). We caught up with both parties to find out more.

In the age of connected vehicles and increasing cyber threat, it is vital for OEMs to demonstrate they have robust processes and systems in place to protect vehicles and individuals interacting with them. The UNECE regulations strive to thoroughly address this issue.

As of July 2024, OEMs must adhere to these regulations in order to sell any vehicle and product within its 56 member states. In addition to achieving compliance, OEMs are required to introduce the necessary related supporting management systems across their organisations to maintain that level of conformity.

For Bentley Motors, product cyber security is something that has become exceptionally important to the business, and to this end, Product Line Director, Chris Cole, took responsibility for developing the company’s capabilities around this issue back in 2021.

“As our cars have progressively become more connected to the global network, we recognised very early on – ahead of any legislative requirements – the importance of making sure connection to the wider world was exceptionally safe for our customers and for us as a business,” he said.

The UNECE regulation is the first formal requirement for automotive OEMs to demonstrate capabilities for what’s referred to as cyber security management and software update management systems.

This brings a completely new dimension to the way that Bentley develop new cars and manage them through their lifecycle, and because the company want to be leading the way in this area, the relationship with MHP was established.

Chris continued: “We recognised the need to get some help inside Bentley and bring the very latest knowledge and understanding around product specific cyber security to the table. We went through a significant programme over a two and a half year period, with MHP leading the way for us to grow those capabilities.

“It affected every aspect of operations, from concept and product design, vehicle manufacturer, all the way through to service and after sales support.”

As a result of the collaboration, Bentley were the first OEM to achieve certification for the new regulations for both cyber security and software updates, and also the first to achieve that with no non-conformities.

“We have been continually developing that capability in order for us to really set ourselves as the safest cars against our competitors in the luxury segment,” added Chris. “That’s the overarching objective. Since we achieved the first accreditation, I’m pleased to say that it’s becoming just a normal part of the way that Bentley operates.

“However, it is an exceptionally demanding capability to stay on top of as the threat to vehicles through cyber attack morphs and changes over time, and we’ve got to be very agile in our response to those.”

The evolution of the cyber security landscape

Since first connecting its cars to the internet in 2018, Bentley has progressively grown its capabilities to the point where every Bentley manufactured today has connectivity built in. However, that increase in both functionality and the number of cars connected, has brought with it the added requirement for Bentley to ensure that connection to the car is entirely safe.

There have been numerous examples of the devastating impact that cyber attacks can have on business systems (take the recent M&S breach as an example). Chris continued: “Imagine that every car is like an iPad on wheels. That means any level of threat can be connected through to the remote device (the vehicle). As such, we’ve got to protect that just as much as we protect our core company systems.

“We have to provide exactly that same level of encryption, protection and proof that we can mitigate an attack. This becomes increasingly important as we provide more connected services into the vehicle.”

Chris explained that one of the benefits that Bentley has been able to take advantage of since becoming part of VW in 1998, is access to the very latest thinking, benchmarks and best practice from across the group. “Within these new, cutting-edge, emerging parts of the automotive world, MHP (which works across all VW brands) bring not only their external expertise, but also the knowledge from the rest of the company – it’s a perfect synergetic relationship.”

He explained that having that expertise in-house has been so much easier for Bentley (than having to compete for the very latest external consulting information), and that first-hand knowledge was an integral part of the company achieving the formal accreditation for its products’ cyber capabilities.

Bentley knew assistance was needed to achieve compliance with the regulation and were confident that MHP brought not only the technical and process expertise, but the understanding of the legislation and how it could be applied in the best way for Bentley to make it purposeful for its customers.

However, Bentley also didn’t want to become dependent on MHP, so selected a fairly small team – 12 to 15 people at its peak – who buddied with others in Bentley to work on a project management framework for a whole new way of working; how to understand the requirements of the legislation, the subject of cyber security, and how to start implementing that through processes, roles and skills.

“MHP brought to us this very structured method of running the project,” added Chris. “We did this in two phases, the first of which was establishing all the documentation and having the evidence ready. And the second was to actually certify the vehicles. It was during this second phase where we ‘let go’ of MHP and demonstrated we could do this for ourselves. By this time we’d also been through recruitment and established whole new departments to run this capability going forward.”

Within any digital transformation, we often talk about board level buy-in and an interesting angle that Bentley explored was employing MHP to educate the highest levels of the business around product cyber security. A key individual within MHP – one who has even influenced the legislative landscape within Europe and the US – brought to life the potential threat and the hazard that Bentley has to manage.

“This locked in cyber’s importance right from the earliest stage,” Chris added. “The board’s recognition that this was a really high priority helped with the brand and how the customer can now feel totally protected when they own a Bentley.”

UNECE Vehicle Regulation impact

The regulation is essentially split into two parts. One is focused on the cyber security system, the other on the software update management system over the air. Regarding cyber security, companies are required to establish a holistic cyber security management system which will require a complete threat and a risk assessment across the entire ecosystem and value chain.

This will then involve the implementation of preventive, detection and response measures for any potential threats that could take place, which then need to be applied along the entire value chain – not only production. This means that components need to be developed by an OEM’s suppliers using the same measures.

In the software update management system, only authentic role-based individuals can access the closed ecosystem of the car. Any software being put into the vehicle has to be signed off, verified, 100% traceable and developed according to the regulation. All of this, ultimately, needs to be showcased and documented in order to pass the audit.

Chris added: “This is an extensive process. It affects nearly every part of the business, from concepts all the way through to maintaining cars. And while the car is connected, we have an obligation to maintain its cyber protection.

“So to put that into context, over 80% of the cars that Bentley has built over the last century are still in use today, and we’ve had cars connected from about 2018 – we’ve got to be prepared to support cyber protection throughout their entire connected life.

“In addition, in our production facility at Crewe, we’ve had to introduce an entirely new way of authenticating individuals, to give them permission to access ECUs and software on the vehicles. So you can imagine what that means for the thousands of people that are associated with manufacturing a Bentley. Particular roles are now part of a secure process, and that’s not only engineers in product development. It’s equally the people building and commissioning the cars, and maintaining them through their lifecycle.”

Challenges and hurdles to UNECE cybersecurity compliance

A key issue, Chris explained, was that Bentley had to meet the requirements of the new legislation for 2024 model year. Failure to do so would simply mean that the company would have been unable to sell its cars in the UN’s 56 member states. Fortunately, the company started early and thus had a head-start. “It was like an Olympic event,” he commented. “It was fundamental and it also helped with executive sponsorship. We had to make sure that we were going through a process of programme delivery to support these new capabilities.”

There was also significant changes around process, tool sets and people, again an area where MHP had a key role to play. Bentley had to conduct an overall end-to-end assessment of all processes to establish which had to be changed and where entirely new processes had to be added. This was in order to effectively manage proactive threat detection and end-to-end software configuration and control through the life of the car.

“That identified hundreds of processes that either had to be adapted or created from scratch. We went through a really heavy, controlled method of measuring the maturity of those processes as we built them,” Chris continued.

“With that, the people impacts were significant. Entirely new roles were created. Every single employee at Bentley went through a basic awareness of what product cyber security meant. All the individual roles were then categorised, and we had to conduct training programmes for each one. Nearly every department that managed parts of product development, purchasing or manufacturing had to respond to these process changes and new IT tool sets.”

OEM top tips

Chris continued: “We are in a great position to understand all the different brands within the group and MHP has also provided a tremendous amount of best practice. You cannot underestimate the level of importance of this topic and how it will continuously evolve and iterate as the threat changes over time.”

The ultimate goal, of course, is to ensure that no car or vehicle is deployed as an attack vector and used as a weapon. As such Chris stressed that it is incumbent on all of industry, not only Bentley and the Volkswagen Group, to share experiences and keep on top of the threat. Cyber security can also be used as a competitive advantage and Bentley is using its UNECE credentials for brand building and making sure its customers feel totally safe.

“The industry has a responsibility to prevent cyber security breaches from occurring, and thankfully, so far, that’s been the case. Moving forward, it is vital that the issue has the same level of priority as a company’s business strategy.

“You then also need to be prepared to continually iterate as both your software complexity growths and the threat level increases. That’s what we do within the VW Group, but we’ll also reach back whenever necessary to MHP for the latest intelligence and best practice, whether it’s from within the group or outside.”

The future for connected vehicles and cyber security

Chris explained that as Bentley continue to grow the capability of the car through its connectivity, it will only increase the necessity to check for threats more broadly. Particularly as autonomous driving functionality evolves and becomes more ubiquitous. “That means we’ll have to build on our threat detection, encryption and all our end-to-end methods of working to protect that,” he said.

He added that the company is starting to see the challenges beginning to be understood by different governments which will also usher in completely new legislative requirements. “We’re now embarking on a whole programme to deal with China’s cyber security measures and we have Japan, South Korea and the US in the pipeline as well.

“Meeting UNECE requirements was just the first step for us. The evolving landscape, in terms of the threats, capabilities and the legislative environment, just means that this is a continuous journey for us.”