ISO/PAS 5112:2022
Road vehicles — Guidelines for auditing cybersecurity engineering
In addition to the guidelines in ISO 19011, this document provides guidelines to organizations that contribute to the achievement of road vehicle cybersecurity throughout the supply chain on:
— managing an audit programme for a cybersecurity management system (CSMS);
— conducting organizational CSMS audits;
— competencies of CSMS auditors; and
— providing evidence during CSMS audits.
Elements of the CSMS are based on the processes described in ISO/SAE 21434. This document is applicable to those needing to understand or conduct internal or external audits of a CSMS or to manage a CSMS audit programme.
This document does not provide guidelines on cybersecurity assessments.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$240.87 NZD
|
|
| HardCopy |
$277.39 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles of auditing
5 Managing an audit programme
5.1 General
5.2 Establishing audit programme objectives
5.3 Determining and evaluating audit programme risks and opportunities
5.4 Establishing the audit programme
5.4.1 Roles and responsibilities of the individual(s) managing the audit programme
5.4.2 Competence of individual(s) managing audit programme
5.4.3 Establishing extent of audit programme
5.4.4 Determining audit programme resources
5.5 Implementing audit programme
5.5.1 General
5.5.2 Defining the objectives, scope and criteria for an individual audit
5.5.3 Selecting and determining audit methods
5.5.4 Selecting audit team members
5.5.5 Assigning responsibility for an individual audit to the audit team leader
5.5.6 Managing audit programme results
5.5.7 Managing and maintaining audit programme records
5.6 Monitoring audit programme
5.7 Reviewing and improving audit programme
6 Conducting an audit
6.1 General
6.2 Initiating audit
6.2.1 General
6.2.2 Establishing contact with auditee
6.2.3 Determining feasibility of audit
6.3 Preparing audit activities
6.3.1 Performing review of documented information
6.3.2 Audit planning
6.3.3 Assigning work to audit team
6.3.4 Preparing documented information for audit
6.4 Conducting audit activities
6.4.1 General
6.4.2 Assigning roles and responsibilities of guides and observers
6.4.3 Conducting opening meeting
6.4.4 Communicating during audit
6.4.5 Audit information availability and access
6.4.6 Reviewing documented information while conducting audit
6.4.7 Collecting and verifying information
6.4.8 Generating audit findings
6.4.9 Determining audit conclusions
6.4.10 Conducting closing meeting
6.5 Preparing and distributing audit report
6.5.1 Preparing audit report
6.5.2 Distributing audit report
6.6 Completing audit
6.7 Conducting audit follow-up
7 Competence and evaluation of auditors
7.1 General
7.2 Determining auditor competence
7.2.1 General
7.2.2 Personal behaviour
7.2.3 Knowledge and skills
7.2.4 Achieving auditor competence
7.2.5 Achieving audit team leader competence
7.3 Establishing auditor evaluation criteria
7.4 Selecting appropriate auditor evaluation method
7.5 Conducting auditor evaluation
7.6 Maintaining and improving auditor competence
Annex A (informative) Audit questionnaire
Annex B (informative) Auditor competences
Bibliography
Keep me up-to-date
Register to receive notifications when updates are made to this standard.
Related Information
Similar Standards
-
AS/NZS 3842:1998
Guide 62: General requirements for bodies operating assessment and certification/registration of quality systems
-
AS/NZS 4417.1:2012
Regulatory compliance mark for electrical and electronic equipment - Part 1: Use of the mark -
AS/NZS 4417.1:2012AA
Regulatory compliance mark for electrical and electronic equipment - Part 1: Use of the mark: Amendment A -
AS/NZS 4417.2:2020
Regulatory compliance mark for electrical and electronic equipment Part 2: Specific requirements for particular regulatory applications
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles of auditing
5 Managing an audit programme
5.1 General
5.2 Establishing audit programme objectives
5.3 Determining and evaluating audit programme risks and opportunities
5.4 Establishing the audit programme
5.4.1 Roles and responsibilities of the individual(s) managing the audit programme
5.4.2 Competence of individual(s) managing audit programme
5.4.3 Establishing extent of audit programme
5.4.4 Determining audit programme resources
5.5 Implementing audit programme
5.5.1 General
5.5.2 Defining the objectives, scope and criteria for an individual audit
5.5.3 Selecting and determining audit methods
5.5.4 Selecting audit team members
5.5.5 Assigning responsibility for an individual audit to the audit team leader
5.5.6 Managing audit programme results
5.5.7 Managing and maintaining audit programme records
5.6 Monitoring audit programme
5.7 Reviewing and improving audit programme
6 Conducting an audit
6.1 General
6.2 Initiating audit
6.2.1 General
6.2.2 Establishing contact with auditee
6.2.3 Determining feasibility of audit
6.3 Preparing audit activities
6.3.1 Performing review of documented information
6.3.2 Audit planning
6.3.3 Assigning work to audit team
6.3.4 Preparing documented information for audit
6.4 Conducting audit activities
6.4.1 General
6.4.2 Assigning roles and responsibilities of guides and observers
6.4.3 Conducting opening meeting
6.4.4 Communicating during audit
6.4.5 Audit information availability and access
6.4.6 Reviewing documented information while conducting audit
6.4.7 Collecting and verifying information
6.4.8 Generating audit findings
6.4.9 Determining audit conclusions
6.4.10 Conducting closing meeting
6.5 Preparing and distributing audit report
6.5.1 Preparing audit report
6.5.2 Distributing audit report
6.6 Completing audit
6.7 Conducting audit follow-up
7 Competence and evaluation of auditors
7.1 General
7.2 Determining auditor competence
7.2.1 General
7.2.2 Personal behaviour
7.2.3 Knowledge and skills
7.2.4 Achieving auditor competence
7.2.5 Achieving audit team leader competence
7.3 Establishing auditor evaluation criteria
7.4 Selecting appropriate auditor evaluation method
7.5 Conducting auditor evaluation
7.6 Maintaining and improving auditor competence
Annex A (informative) Audit questionnaire
Annex B (informative) Auditor competences
Bibliography