Skip to main content

ISO/PAS 5112 (Guidelines for Auditing Cybersecurity Management Systems)

ISO/PAS 5112 is a guideline for auditing cybersecurity management systems (CSMS) for road vehicles. ISO published it in March 2022 as a Publicly Available Specification (PAS). It adds the specifics of vehicle cybersecurity to ISO 19011, the general guideline for auditing management systems.

What is in ISO/PAS 5112?

The guideline is aimed at organisations across the supply chain that contribute to vehicle cybersecurity. It describes how to set up and manage an audit programme for the CSMS, how audits within the organisation are run, what competence auditors need and what evidence the organisation provides during the audit.

It applies to internal and external audits. The audited CSMS elements are based on the processes of ISO/SAE 21434.

The organisation is audited

ISO/PAS 5112 explicitly leaves cybersecurity assessments out. A CSMS audit does not examine the individual product.

For the product, ISO/SAE 21434 has its own instrument. The cybersecurity assessment evaluates the cybersecurity of an item or component based on the work products. Whether a specific Threat Analysis and Risk Assessment (TARA) holds up belongs there, not in the CSMS audit. An audit can confirm that a TARA process exists. It does not say whether a single analysis is correct.

Relation to UNECE R155

UNECE R155 requires the vehicle manufacturer to have a CSMS with a certificate of compliance. The certificate is valid for three years at most. The regulation does not name a standard for auditing the CSMS. ISO/PAS 5112 offers a common yardstick for such audits, both at the manufacturer and at its suppliers.

ISO/SAE 21434 itself also includes an audit of the organisation, with its own report as a work product.

Status: successor in sight

In 2025, ISO decided to revise the PAS. The successor is called ISO/TS 5112. Its ballot closed in October 2026, and publication is imminent. Until then, ISO/PAS 5112:2022 applies.

Our Cyber Security page shows how regulations, standards and audits fit together in automotive cybersecurity.

More on this topic

Related terms

CSMS UNECE R155 ISO/SAE 21434 TARA

Frequently asked questions

Does UNECE R155 require ISO/PAS 5112?
No. R155 requires a certified CSMS, but its 2021 text names no standard for auditing it. ISO/PAS 5112 is a guideline that organisations can use for internal and external CSMS audits.
What is the difference between a CSMS audit and a cybersecurity assessment?
The CSMS audit checks the organisation: processes, responsibilities, evidence. The cybersecurity assessment according to ISO/SAE 21434 evaluates the cybersecurity of a specific item or component based on the work products. ISO/PAS 5112 explicitly covers only the audit.
What changes with ISO/TS 5112?
ISO/TS 5112 is the successor to the PAS. Its ballot closed in October 2026, and publication is imminent. Until then, ISO/PAS 5112 remains the valid version. ISO has not yet published what will change.
Reviewed by Jens Bühl, Product Owner on October 30, 2026