1. Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA)
Mitigations:
OICA/CLEPA introduced proposal for “extended CIA” approach with corresponding mitigations defined (see document TFCS-06-11: > mitigations based on threats identified in the table > 18 mitigations identified
Based on comments from ITU/NICT the 18 mitigations in combination with the UK DfT principles had been reviewed
The group reviewed the threat table accordingly and cross checked the 18 mitigations with the ITS/AD guideline principles in order to identify necessary amendments/additions

2. Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA)
Mitigations (continued):
The group agree to clarify the terms „Software“, „Data“, „Messages“, „Configuration“ and „Information“
Reference document added: ISO „Security requirements for cryptographic modules“
An ad hoc meeting „Mitigations“ was agreed (mid/end July – doodle poll) to review the table of threats with mitigations by OICA, ITS/AD principles, UK DfT Principles and NL comments on the OICA/CLEPA mitigations in order to conclude on the mitigations

3. Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA)
Software updates:
While post-registration updates are dealt with nationally, the group agreed to exchange further on such national processes to support them.
The “S/W TAN” approach as measure to manage configuration control for the approval process (incl. pre- and post-registration issues) and checking during PTI/CTI was confirmed by the group An “offline meeting” for interested parties dealing with the S/W update approval process incl. S/W TAN was agreed (participants from GER, NL, JPN, CITA, OICA/CLEPA)

4. Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA)
Software updates (continued):
Further consideration shall be given to:
Software Type Approval Number (S/W TAN):
Review approach for „Whole Vehicle S/W TAN“ vs. „System-based S/W TAN“
2) Administrative process to realize S/W TAN concept:
Review approach for linking S/W versions, ECU‘s involved, etc. with S/W TAN
Clarify roles and responsibilities in the process, e.g. involvement of Technical Service, etc.
Role of customer involvement
Information requirements to support the process

5. Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA)
Software updates (continued):
3) Safety aspects of software updates:
Develop principles/recommendations for safe execution of software updates
4) Impact of different reasons for updates on the requirements/approval process

6. Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA)
Data protection
Cyber Security
Software updates
Legal aspects
Security aspects
Security aspects
Type approval aspects
Safety aspects
pre- registration
post- registration
Threat analysis
out of scope
Table of threats
Develop
recommendation for safe execution
Develop flow diagram
Define mitigation principles
Define approval method
Develop guidance/recommendation for ITS/AD

7. Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA)
Action items for next session:
Aim is to finalize the approach on S/W updates and the list of mitigation in order to start the drafting of the guidance/recommendation papers in the subsequent meetings

8. Outcome TFCS-06 // 13-14 June 2017 @ TIA, Arlington/VA (USA)
Next meetings:
ad hoc “Mitigations” Mid/End July Webex
ad hoc “S/W TAN” August Hamburg am – 4 pm
TFCS August NL
date confirmed exact place tbd
TFCS October Tokyo
date confirmed exact place (building) tbd
TFCS November Geneva
date to be confirmed exact place tbd
TFCS December London ?
tbd tbd