In today’s increasingly technology driven and connected world, protecting data is more challenging and more critical than ever before.
In response to the rising number of cybersecurity threats to the supply chain, the Automotive Industry Action Group (AIAG) today announced the release of the Cyber Security 3rd Party Information Security publication – cybersecurity guidelines for automotive trading partners.
The initial idea behind the document came from an OEM approaching AIAG, and discussing the growing vulnerability of both transactional and proprietary information being shared by trading partners throughout the global supply chain.
The OEM suggested that, by bringing the issue to AIAG and engaging other automakers, the industry could work toward a unified set of information security expectations.
As a result, the document was created at AIAG with information security leaders and executives from GM, Ford, FCA and Honda, and socialized with their counterparts from Toyota, Nissan, Caterpillar, Bosch, Continental and Magna.
“Over the course of the past 25 years we have seen a remarkable shift in enterprise value from tangible to intangible assets,” explained J. Scot Sharland, executive director of AIAG.
“Data is the new currency. As such, more effective command and control of data has become an enterprise risk management priority.”
While each OEM may require additional measures be taken to ensure information security, this newly developed document outlines minimum guidelines for the secure exchange of information for supplier partners who collect, process, manage, access or store OEM data outside of the OEM’s computing environment.
By implementing these guidelines, suppliers – particularly those working with multiple OEMs– will be able to focus on complying with a single, unified set of expectations, instead of having to meet different (and potentially conflicting) guidelines for information security.
(Learn More. David Chang, IT director, General Motors Company, explains that with security breaches on the rise, it’s important to realize that protecting data is not just an IT issue. Chang encourages individuals to educate themselves and work collaboratively on data security issues. Courtesy of AIAG and YouTube)
OEMs, in turn, will benefit from knowing that their supplier partners are helping protect confidential and sensitive data.
The information security strategies included in the publication are based on industry best practices and standards – specifically ISO 27002 and/or 27002:2013, NIST 800:53 and NIST 800:171.
In fact, the National Institute of Standards and Technology (NIST) was actually involved in the document’s creation; in addition to bringing “lessons learned” from their own experiences to the table, NIST helped facilitate the process of benchmarking one of their suppliers in the defense industry as well.
The General Computing Controls addressed in the guideline document are organized into nine chapters according to specific categories.
Examples include:
- Access controls
- Data encryption
- Vulnerability management
- Security audits of suppliers/Third Parties
- Data retention and disposal and security investigations, among others.
(Learn More. Thomas Crawford, regional data chief, Honda North America, Inc., suggests that the automotive industry needs to be more cognizant of securing its data, and points to the collaborative efforts of certain OEMs and AIAG to achieve that goal. Courtesy of AIAG and YouTube)
