[Module Name] Security Plan

Note

Document header

[Module Name] Security Plan		status: draft security: YES safety: ASIL_B
tags: template version: 1 realizes: wp__module_security_plan
doc__mod_temp_module_name_security_plan		Generic Document

Attention

The above directive must be updated according to your Module.

• Modify Your Module Name to be your Module Name

• Modify id to be your Module Name in lower snake case preceded by doc__ and followed by _security_plan

• Adjust status to be valid

• Adjust safety and tags according to your needs

Security Management Context

This Security Plan adds to the process security management guidance all the module development relevant work products needed for ISO SAE 21434 conformity.

Security Management Scope

This Security Plan’s scope is a SW module of the SW platform <link to module documentation in platform/modules/<modulename>/index.rst>. The module consists of one or more SW components and will be qualified as a Component Out-of-Context (OoC).

Security Management Roles

Table 18 Module roles

Role	Assignee
Security Manager	<link to Module’s Security Manager assignment or name>
Project Manager	<link to Module’s Project Lead assignment or name>

Tailoring

Additional to the tailoring in the SW platform project as defined in the process security management guidance we define here the additional tailoring on module level.

• Excluded for this module are additionally the following work products (and their related requirements):

  • <ISO SAE 21434 reference>: <work product/requirement> - <Argumentation why it is not needed or replaced by another work product or activity.>

Component Out-of-Context Assumptions

As this module is developed and qualified as a Component Out-of-Context (OoC), the following assumptions on its intended use, context and external interfaces are made. These assumptions are the basis for the module’s cybersecurity requirements and shall be validated upon integration into an item or a higher-level component:

• <assumption on intended use / operational environment>

• <assumption on external interfaces>

Off-the-Shelf / OSS Component Qualification

If off-the-shelf or Open Source Software (OSS) components are integrated into this module, their cybersecurity-relevant documentation is gathered and analysed to determine whether the allocated cybersecurity requirements can be fulfilled and whether the existing documentation is sufficient to support the cybersecurity activities. The following OTS/OSS components are planned to be qualified this way:

• <component name> - <maintenance status / known vulnerability history / available documentation> - <Link to qualification record or issue>

If the existing documentation is insufficient for a component, the cybersecurity activities necessary to close the gap are identified here: <Link to issue/activity>.

Cybersecurity Assessment Decision

The decision whether a Cybersecurity Assessment is performed for this module, and the rationale for that decision, is documented here:

• Decision: <YES | NO>

• Rationale: <rationale for the decision, e.g. based on the module’s TARA results and/or organizational criteria>

• If YES: responsible assessor, independent from the development team: <link to assignment>

Vulnerability Monitoring and Management

For this module, the following is defined for the continual cybersecurity activities after release:

• Sources monitored for new cybersecurity information (e.g. advisories for used OTS/OSS components): <list sources>

• SBOM generation: <tool/process used to generate and maintain the module’s SBOM>

• Vulnerability scan cadence: <e.g. on every release, on a fixed schedule, …>

• Triage and remediation responsible: <link to role/assignment>

• Escalation to the cybersecurity incident response process: <link to process/contact>

Security Module Work Products

One set of work products for the module and one set for each component of the module:

Table 19 Module Work Products

Work Product Id	Link to process	Process status	Link to issue	Link to WP	WP status
wp__module_security_plan	gd_guidl__security_plan_definitions	<automated>	<Link to issue>	this document	see above
wp__module_security_package	gd_guidl__security_package	<automated>	<Link to issue>	this document (including the linked documentation)	<automated>
wp__fdr_reports_security (Module Security Plan)	gd_chklst__security_plan	<automated>	<Link to issue>	[Module Name] Security Plan... (doc__mod_temp_module_name_security_plan_fdr)	<automated>
wp__fdr_reports_security (Module Security Package)	gd_chklst__security_package	<automated>	<Link to issue>	[Module Name] Security Pack... (doc__mod_temp_module_name_sec_pkg_fdr)	<automated>
wp__fdr_reports_security (Module’s Security Analyses)	Security Analysis FDR tbd	<automated>	<Link to issue>	<Link to WP>	<automated>
wp__audit_report_security	performed by external experts	n/a	<Link to issue>	<Link to WP>	<WP status (manual)>
wp__module_security_manual	gd_temp__module_security_manual	<automated>	<Link to issue>	[Module Name] Security Manual (doc__mod_temp_module_name_security_manual)	<automated>
wp__verification_module_ver_report	gd_temp__mod_ver_report	<automated>	<Link to issue>	[Module Name] Verification ... (doc__mod_temp_verification_report)	<automated>
wp__module_sw_release_note	gd_temp__rel_mod_rel_note	<automated>	<Link to issue>	[Module Name] Release Note (doc__mod_temp_module_name_release_note)	<automated>
wp__module_user_manual	gd_temp__rel_mod_user_manual	<automated>	<Link to issue>	[Module Name] User Manual (doc__mod_temp_module_name_user_manual)	<automated>
wp__sw_module_sbom	gd_guidl__security_plan_definitions	not started	<Link to issue>	<Link to WP>	<automated>

Table 20 Component <name> Work Products

Work Product Id	Link to process	Process status	Link to issue	Link to WP	WP status
wp__requirements_comp	gd_temp__req_comp_req	<automated>	<Link to issue>	[Component Name] Requirements (doc__mod_temp_component_name_requirements)	<automated>
wp__requirements_comp_aou	gd_temp__req_aou_req	<automated>	<Link to issue>	[Component Name] Component AoU (doc__mod_temp_component_name_comp_sec_aou)	<automated>
wp__requirements_inspect	gd_chklst__req_inspection	<automated>	n/a	Checklist used in Pull Request Review	n/a
wp__component_arch	gd_temp__arch_comp	<automated>	<Link to issue>	[Component Name] Architecture (doc__mod_temp_component_name_architecture)	<automated>
wp__sw_component_security_analysis	<Link to process>	<automated>	<Link to issue>	<Link to WP>	<automated>
wp__sw_arch_verification	gd_chklst__arch_inspection_checklist	<automated>	<Link to issue>	[Component Name] Architectu... (doc__mod_temp_component_name_arc_inspection)	<automated>
wp__sw_implementation	gd_guidl__implementation	<automated>	<Link to issue>	[Component Name] Detailed D... (doc__mod_temp_component_name_detailed_design) & <Link to code>	<automated>
wp__verification_sw_unit_test	gd_guidl__verification_guide	<automated>	<Link to issue>	[Module Name] Verification ... (doc__mod_temp_verification_report)	<automated>
wp__sw_implementation_inspection	gd_chklst__impl_inspection_checklist	<automated>	<Link to issue>	[Component Name] Implementa... (doc__mod_temp_component_name_impl_inspection)	<automated>
wp__verification_comp_int_test	gd_guidl__verification_guide	<automated>	<Link to issue>	[Module Name] Verification ... (doc__mod_temp_verification_report)	<automated>